[PATCH 4/4] tracing/inject: Prevent overflow growing string fields
Li Qiang <[email protected]>
| Newsgroups | org.kernel.vger.linux-trace-kernel,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
parse_entry() appends dynamic string data by adding its length to the
current entry size. An oversized input can overflow this signed addition,
cause krealloc() to receive too small a length, and then write beyond it.
Reject a string length that cannot be added to entry_size before growing
the allocation.
Fixes: 6c3edaf9fd6a ("tracing: Introduce trace event injection")
Cc: [email protected]
Signed-off-by: Li Qiang <[email protected]>
---
kernel/trace/trace_events_inject.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/trace/trace_events_inject.c b/kernel/trace/trace_events_inject.c
index b8b141c00d5c..5c551def44f6 100644
--- a/kernel/trace/trace_events_inject.c
+++ b/kernel/trace/trace_events_inject.c
@@ -243,6 +243,9 @@ static int parse_entry(char *str, struct trace_event_call *call, void **pentry)
int str_loc = entry_size & 0xffff;
u32 *str_item;
+ if (str_len > INT_MAX - entry_size)
+ return -E2BIG;
+
entry_size += str_len;
*pentry = krealloc(entry, entry_size, GFP_KERNEL);
if (!*pentry) {
--
2.43.0