]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ring-buffer: Prevent off-by-one array access in ring_buffer_desc_page()
authorVincent Donnefort <vdonnefort@google.com>
Fri, 10 Apr 2026 12:45:27 +0000 (13:45 +0100)
committerSteven Rostedt (Google) <rostedt@goodmis.org>
Tue, 14 Apr 2026 09:13:09 +0000 (05:13 -0400)
commit6170922f137231b98fc568571befef63e1edff3f
treecd2f5f906de6d37a2e7940dbf6a7495a106b2fcf
parent1111e9bd83f8562391f9052af37ddbdfee5b76db
ring-buffer: Prevent off-by-one array access in ring_buffer_desc_page()

As pointed out by Smatch, the ring-buffer descriptor array page_va is
counted by nr_page_va, but the accessor ring_buffer_desc_page() allows
access off by one.

Currently, this does not cause problems, as the page ID always comes
from a trusted source. Nonetheless, ensure robustness and fix the
accessor. While at it, make the page_id unsigned.

Link: https://patch.msgid.link/20260410124527.3563970-1-vdonnefort@google.com
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
kernel/trace/ring_buffer.c