Steven Rostedt (VMware) a0997a86f5 tracing: Check length before giving out the filter buffer ... commit b220c049d5196dd94d992dd2dc8cba1a5e6123bf upstream. When filters are used by trace events, a page is allocated on each CPU and used to copy the trace event fields to this page before writing to the ring buffer. The reason to use the filter and not write directly into the ring buffer is because a filter may discard the event and there's more overhead on discarding from the ring buffer than the extra copy. The problem here is that there is no check against the size being allocated when using this page. If an event asks for more than a page size while being filtered, it will get only a page, leading to the caller writing more that what was allocated. Check the length of the request, and if it is more than PAGE_SIZE minus the header default back to allocating from the ring buffer directly. The ring buffer may reject the event if its too big anyway, but it wont overflow. Link: https://lore.kernel.org/ath10k/1612839593-2308-1-git-send-email-wgong@codeaurora.org/ Cc: stable@vger.kernel.org Fixes: 0fc1b09ff1 ("tracing: Use temp buffer when filtering events") Reported-by: Wen Gong <wgong@codeaurora.org> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-02-17 10:35:14 +01:00
..
bpf	bpf: Fix 32 bit src register truncation on div/mod	2021-02-13 13:52:56 +01:00
cgroup	cgroup: Fix memory leak when parsing multiple source parameters	2021-01-06 14:48:37 +01:00
configs
debug	kgdb: Make "kgdbcon" work properly with "kgdb_earlycon"	2020-11-05 11:43:16 +01:00
dma	swiotlb: fix "x86: Don't panic if can not alloc buffer for swiotlb"	2020-11-18 19:20:32 +01:00
events	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:44:55 +01:00
gcov	gcov: add support for GCC 10.1	2020-09-17 13:47:56 +02:00
irq	genirq/msi: Activate Multi-MSI early when MSI_FLAG_ACTIVATE_EARLY is set	2021-02-10 09:25:30 +01:00
livepatch
locking	rtmutex: Remove unused argument from rt_mutex_proxy_unlock()	2021-01-30 13:54:09 +01:00
power	PM: hibernate: flush swap writer after marking	2021-02-03 23:25:57 +01:00
printk	printk: handle blank console arguments passed in.	2020-10-01 13:18:04 +02:00
rcu	arm64: smp: Tell RCU about CPUs that fail to come online	2020-11-24 13:29:01 +01:00
sched	sched: Reenable interrupts in do_sched_yield()	2020-12-30 11:51:03 +01:00
time	tick/sched: Remove bogus boot "safety" check	2021-01-06 14:48:40 +01:00
trace	tracing: Check length before giving out the filter buffer	2021-02-17 10:35:14 +01:00
.gitignore
acct.c
async.c
audit_fsnotify.c
audit_tree.c
audit_watch.c	audit: CONFIG_CHANGE don't log internal bookkeeping as an event	2020-10-01 13:17:32 +02:00
audit.c	audit: fix a net reference leak in audit_list_rules_send()	2020-06-22 09:30:59 +02:00
audit.h	audit: fix a net reference leak in audit_list_rules_send()	2020-06-22 09:30:59 +02:00
auditfilter.c	audit: fix a net reference leak in audit_list_rules_send()	2020-06-22 09:30:59 +02:00
auditsc.c
backtracetest.c
bounds.c
capability.c
compat.c
configs.c
context_tracking.c
cpu_pm.c	kernel/cpu_pm: Fix uninitted local in cpu_pm	2020-06-22 09:31:22 +02:00
cpu.c	kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling	2020-12-30 11:50:56 +01:00
crash_core.c
crash_dump.c
cred.c	keys: Fix request_key() cache	2020-01-17 19:48:42 +01:00
delayacct.c
dma.c
exec_domain.c
exit.c	don't dump the threads that had been already exiting when zapped.	2020-11-18 19:20:31 +01:00
extable.c
fail_function.c	fail_function: Remove a redundant mutex unlock	2020-11-24 13:29:18 +01:00
fork.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:44:55 +01:00
freezer.c	Revert "libata, freezer: avoid block device removal while system is frozen"	2019-10-06 09:11:37 -06:00
futex.c	futex: Handle faults correctly for PI futexes	2021-01-30 13:54:10 +01:00
gen_kheaders.sh	kbuild: add variables for compression tools	2020-09-03 11:27:10 +02:00
groups.c
hung_task.c
iomem.c
irq_work.c
jump_label.c
kallsyms.c	kallsyms: Refactor kallsyms_show_value() to take cred	2020-07-16 08:16:44 +02:00
kcmp.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:44:55 +01:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c
kexec_core.c	kernel: kexec: remove the lock operation of system_transition_mutex	2021-02-03 23:25:56 +01:00
kexec_elf.c
kexec_file.c	Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-09-28 08:14:15 -07:00
kexec_internal.h
kexec.c
kheaders.c
kmod.c	kmod: make request_module() return an error when autoloading is disabled	2020-04-17 10:50:22 +02:00
kprobes.c	tracing/kprobe: Fix to support kretprobe events on unloaded modules	2021-02-13 13:52:54 +01:00
ksysfs.c
kthread.c	kthread: Extract KTHREAD_IS_PER_CPU	2021-02-07 15:35:49 +01:00
latencytop.c
Makefile	elfcore: fix building with clang	2021-01-23 15:57:55 +01:00
module_signature.c
module_signing.c
module-internal.h
module.c	module: delay kobject uevent until after module init call	2021-01-06 14:48:40 +01:00
notifier.c	kernel/notifier.c: intercept duplicate registrations to avoid infinite loops	2020-10-01 13:17:23 +02:00
nsproxy.c
padata.c	padata: add separate cpuhp node for CPUHP_PADATA_DEAD	2020-06-17 16:40:22 +02:00
panic.c	panic: ensure preemption is disabled during panic()	2019-10-07 15:47:19 -07:00
params.c
pid_namespace.c
pid.c
profile.c
ptrace.c	ptrace: Set PF_SUPERPRIV when checking capability	2020-11-24 13:29:24 +01:00
range.c
reboot.c	reboot: fix overflow parsing reboot cpu number	2020-11-18 19:20:30 +01:00
relay.c	kernel/relay.c: fix memleak on destroy relay channel	2020-08-26 10:40:51 +02:00
resource.c	/dev/mem: Revoke mappings when a driver claims the region	2020-06-24 17:50:35 +02:00
rseq.c
seccomp.c	seccomp: Set PF_SUPERPRIV when checking capability	2020-11-24 13:29:24 +01:00
signal.c	ptrace: fix task_join_group_stop() for the case when current is traced	2020-11-10 12:37:24 +01:00
smp.c
smpboot.c	kthread: Extract KTHREAD_IS_PER_CPU	2021-02-07 15:35:49 +01:00
smpboot.h
softirq.c
stackleak.c
stacktrace.c	stacktrace: Don't skip first entry on noncurrent tasks	2019-11-04 21:19:25 +01:00
stop_machine.c	stop_machine: Avoid potential race behaviour	2019-10-17 12:47:12 +02:00
sys_ni.c
sys.c	kernel/sys.c: avoid copying possible padding bytes in copy_to_user	2020-10-01 13:17:23 +02:00
sysctl_binary.c
sysctl-test.c	kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()	2020-10-01 13:17:10 +02:00
sysctl.c	kernel: sysctl: make drop_caches write-only	2020-01-04 19:18:32 +01:00
task_work.c
taskstats.c	taskstats: fix data-race	2020-01-09 10:19:54 +01:00
test_kprobes.c
torture.c
tracepoint.c
tsacct.c
ucount.c
uid16.c
uid16.h
umh.c	usermodehelper: reset umask to default before executing user process	2020-10-14 10:32:58 +02:00
up.c
user_namespace.c
user-return-notifier.c
user.c
utsname_sysctl.c
utsname.c
watchdog_hld.c
watchdog.c	watchdog/softlockup: Enforce that timestamp is valid on boot	2020-02-24 08:36:52 +01:00
workqueue_internal.h
workqueue.c	workqueue: Restrict affinity change to rescuer	2021-02-07 15:35:49 +01:00