]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
tracing: ring-buffer: Fix to check event length before using
authorMasami Hiramatsu (Google) <mhiramat@kernel.org>
Mon, 16 Feb 2026 09:30:15 +0000 (18:30 +0900)
committerSteven Rostedt (Google) <rostedt@goodmis.org>
Thu, 19 Feb 2026 20:21:12 +0000 (15:21 -0500)
commit912b0ee248c529a4f45d1e7f568dc1adddbf2a4a
treebecc73482af4fecf9344d9dd3bc4d67db74dfae9
parentf1547779402c4cd67755c33616b7203baa88420b
tracing: ring-buffer: Fix to check event length before using

Check the event length before adding it for accessing next index in
rb_read_data_buffer(). Since this function is used for validating
possibly broken ring buffers, the length of the event could be broken.
In that case, the new event (e + len) can point a wrong address.
To avoid invalid memory access at boot, check whether the length of
each event is in the possible range before using it.

Cc: stable@vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Fixes: 5f3b6e839f3c ("ring-buffer: Validate boot range memory events")
Link: https://patch.msgid.link/177123421541.142205.9414352170164678966.stgit@devnote2
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
kernel/trace/ring_buffer.c