Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Two fixes for rtla in v6.17: 

- Fix a buffer overflow in actions_parse()
 
   The "trigger_c" variable did not account for the nul byte when
   determining its size.
 
 - Fix a compare that had the values reversed
 
   actions_destroy() is to reallocate when len is greater than the current size,
   but the compare was testing if size is greater than the new length.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaNfbFhQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qmozAPwKEWRb1gbDIeeva7r6HVRc1jKO3EfK
 qT72fgqfKlwUawD/fM3mlW1+n25ZHMX+1e8eQV1CP5VOldgdQEHFzDEz0gI=
 =i8D5
 -----END PGP SIGNATURE-----

Merge tag 'trace-tools-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull rtla tool fixes from Steven Rostedt:

 - Fix a buffer overflow in actions_parse()

   The "trigger_c" variable did not account for the nul byte when
   determining its size

 - Fix a compare that had the values reversed

   actions_destroy() is supposed to reallocate when len is greater than
   the current size, but the compare was testing if size is greater than
   the new length

* tag 'trace-tools-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  rtla/actions: Fix condition for buffer reallocation
  rtla: Fix buffer overflow in actions_parse
This commit is contained in:
Linus Torvalds 2025-09-27 09:50:46 -07:00
parent fec734e8d5 2227f273b7
commit 51a24b7dea
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/tracing/rtla/src/actions.c
View File

@ -49,7 +49,7 @@ actions_destroy(struct actions *self)
static struct action * static struct action *
actions_new(struct actions *self) actions_new(struct actions *self)
{ {
if (self->size >= self->len) { if (self->len >= self->size) {
self->size *= 2; self->size *= 2;
self->list = realloc(self->list, self->size * sizeof(struct action)); self->list = realloc(self->list, self->size * sizeof(struct action));
} }
@ -131,7 +131,7 @@ actions_parse(struct actions *self, const char *trigger)
{ {
enum action_type type = ACTION_NONE; enum action_type type = ACTION_NONE;
char *token; char *token;
char trigger_c[strlen(trigger)]; char trigger_c[strlen(trigger) + 1];
/* For ACTION_SIGNAL */ /* For ACTION_SIGNAL */
int signal = 0, pid = 0; int signal = 0, pid = 0;