Commit a4b3ada8 authored Apr 03, 2009 by Carl Henrik Lunde Committed by Ingo Molnar Apr 03, 2009

blktrace: NUL-terminate user space messages



Impact: fix corrupted blkparse output

Make sure messages from user space are NUL-terminated strings,
otherwise we could dump random memory to the block trace file.

Additionally, I've limited the message to BLK_TN_MAX_MSG-1
characters, because the last character would be stripped by
vscnprintf anyway.

Signed-off-by: Carl Henrik Lunde <chlunde@ping.uio.no>
Cc: Li Zefan <lizf@cn.fujitsu.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: "Alan D. Brunelle" <alan.brunelle@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
LKML-Reference: <20090403122714.GT5178@kernel.dk>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

parent 18cea459

kernel/trace/blktrace.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -327,10 +327,10 @@ static ssize_t blk_msg_write(struct file filp, const char __user buffer,
		char *msg;
		struct blk_trace *bt;

		if (count > BLK_TN_MAX_MSG)
		if (count > BLK_TN_MAX_MSG - 1)
		return -EINVAL;

		msg = kmalloc(count, GFP_KERNEL);
		msg = kmalloc(count + 1, GFP_KERNEL);
		if (msg == NULL)
		return -ENOMEM;

		@@ -339,6 +339,7 @@ static ssize_t blk_msg_write(struct file filp, const char __user buffer,
		return -EFAULT;
		}

		msg[count] = '\0';
		bt = filp->private_data;
		__trace_note_message(bt, "%s", msg);
		kfree(msg);