lkml.org 
[lkml]   [2009]   [Apr]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [tip:tracing/blktrace-v2] blktrace: fix a bug in blk_msg_write()
    Hi Ingo,

    Though Carl <chlunde@ping.uio.no>'s patch has been applied,
    (a4b3ada83d06554d307dd54abdc62b2e5648264a), this patch hasn't
    been dropped, thus the code in -tip looks like:

    static ssize_t blk_msg_write(...)
    {
    ...
    if (copy_from_user(msg, buffer, count)) {
    kfree(msg);
    return -EFAULT;
    }
    msg[count] = '\0'; <---

    msg[count] = '\0'; <---
    ...
    }


    Li Zefan wrote:
    > Commit-ID: 48cefde3c17bbf37fee99e2889bcc718e5805dfa
    > Gitweb: http://git.kernel.org/tip/48cefde3c17bbf37fee99e2889bcc718e5805dfa
    > Author: Li Zefan <lizf@cn.fujitsu.com>
    > AuthorDate: Fri, 3 Apr 2009 15:31:34 +0800
    > Committer: Ingo Molnar <mingo@elte.hu>
    > CommitDate: Fri, 3 Apr 2009 13:15:53 +0200
    >
    > blktrace: fix a bug in blk_msg_write()
    >
    > Impact: fix corrupted blkparse output
    >
    > This is another long-standing blktrace bug:
    >
    > (console 1)
    > # echo -n 'a' > /sys/kernel/debug/block/sda/msg
    > (console 2)
    > # blktrace -d /dev/sda -a pc -o - | blkparse -i -
    > 8,0 0 0 0.000000000 0 m N a������@��
    >
    > We should terminate the msg buffer with '\0'.
    >
    > Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
    > Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
    > Cc: "Alan D. Brunelle" <alan.brunelle@hp.com>
    > Cc: Jens Axboe <jens.axboe@oracle.com>
    > LKML-Reference: <49D5BB56.7000807@cn.fujitsu.com>
    > Signed-off-by: Ingo Molnar <mingo@elte.hu>
    >
    >
    > ---
    > kernel/trace/blktrace.c | 5 +++--
    > 1 files changed, 3 insertions(+), 2 deletions(-)
    >
    > diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
    > index 947c5b3..b7fa92c 100644
    > --- a/kernel/trace/blktrace.c
    > +++ b/kernel/trace/blktrace.c
    > @@ -327,10 +327,10 @@ static ssize_t blk_msg_write(struct file *filp, const char __user *buffer,
    > char *msg;
    > struct blk_trace *bt;
    >
    > - if (count > BLK_TN_MAX_MSG)
    > + if (count >= BLK_TN_MAX_MSG)
    > return -EINVAL;
    >
    > - msg = kmalloc(count, GFP_KERNEL);
    > + msg = kmalloc(count + 1, GFP_KERNEL);
    > if (msg == NULL)
    > return -ENOMEM;
    >
    > @@ -338,6 +338,7 @@ static ssize_t blk_msg_write(struct file *filp, const char __user *buffer,
    > kfree(msg);
    > return -EFAULT;
    > }
    > + msg[count] = '\0';
    >
    > bt = filp->private_data;
    > __trace_note_message(bt, "%s", msg);
    >
    >

    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2009-04-08 03:35    [W:0.023 / U:89.344 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site