From: Qiujun Huang Date: Thu, 29 Oct 2020 16:19:05 +0000 (+0800) Subject: tracing: Fix out of bounds write in get_trace_buf X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=c1acb4ac1a892cf08d27efcb964ad281728b0545;p=linux.git tracing: Fix out of bounds write in get_trace_buf The nesting count of trace_printk allows for 4 levels of nesting. The nesting counter starts at zero and is incremented before being used to retrieve the current context's buffer. But the index to the buffer uses the nesting counter after it was incremented, and not its original number, which in needs to do. Link: https://lkml.kernel.org/r/20201029161905.4269-1-hqjagain@gmail.com Cc: stable@vger.kernel.org Fixes: 3d9622c12c887 ("tracing: Add barrier to trace_printk() buffer nesting modification") Signed-off-by: Qiujun Huang Signed-off-by: Steven Rostedt (VMware) --- diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 528971714fc65..daa96215e2948 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -3132,7 +3132,7 @@ static char *get_trace_buf(void) /* Interrupts must see nesting incremented before we use the buffer */ barrier(); - return &buffer->buffer[buffer->nesting][0]; + return &buffer->buffer[buffer->nesting - 1][0]; } static void put_trace_buf(void)