linux-kernel - event tracing, ringbuffer and RB_MAX_SMALL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 14 Jul 2009 19:18:11 +0200
From:	Johannes Berg <johannes@...solutions.net>
To:	linux-kernel <linux-kernel@...r.kernel.org>
Cc:	Ingo Molnar <mingo@...e.hu>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Steven Rostedt <rostedt@...dmis.org>
Subject: event tracing, ringbuffer and RB_MAX_SMALL_DATA

Hi,

By code inspection, I think there's a bug if your event contains only

	__dynamic_array(u8, buf, buflen)

and your buflen is only, say, 3. Then the event size will be the common
event size (12 bytes) plus this, so 15, which is well below
RB_MAX_SMALL_DATA (4*28 = 112), so it'll be divided by four to be stored
into type_len. At this point, however, you've lost the information that
your dynamic array was only three bytes, and it'll be considered _four_
bytes long by parsers as far as I can tell?

johannes

Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)