mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 02:01:18 -04:00
Code Issues Packages Projects Releases Wiki Activity

ring-buffer: Prevent off-by-one array access in ring_buffer_desc_page()

Browse Source 
As pointed out by Smatch, the ring-buffer descriptor array page_va is
counted by nr_page_va, but the accessor ring_buffer_desc_page() allows
access off by one.

Currently, this does not cause problems, as the page ID always comes
from a trusted source. Nonetheless, ensure robustness and fix the
accessor. While at it, make the page_id unsigned.

Link: https://patch.msgid.link/20260410124527.3563970-1-vdonnefort@google.com
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
This commit is contained in:
Vincent Donnefort
2026-04-10 13:45:27 +01:00
committed by Steven Rostedt (Google)
parent 1111e9bd83
commit 6170922f13
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
kernel/trace/ring_buffer.c
View File

@@ -2238,9 +2238,9 @@ static struct ring_buffer_desc *ring_buffer_desc(struct trace_buffer_desc *trace
return NULL;
}
static void *ring_buffer_desc_page(struct ring_buffer_desc *desc, int page_id)
static void *ring_buffer_desc_page(struct ring_buffer_desc *desc, unsigned int page_id)
{
return page_id > desc->nr_page_va ? NULL : (void *)desc->page_va[page_id];
return page_id >= desc->nr_page_va ? NULL : (void *)desc->page_va[page_id];
}
static int __rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer,