markers-fix-out-of-bound-array

markers fix out of bound array

While creating my own probes, I've observed that I get format mismatch error...
While digging into the executed code I observe that my format (stored in a
marker_entry) was overwritten by a new allocated structure. Finally I found
that in add_marker function the format pointer seems to be set to the wrong
position:

e->format = &e->name[channel_len + name_len];
while the proper assignment should be
e->format = &e->name[name_len];

indead:

size_t channel_len = strlen(channel) + 1;
size_t name_len = strlen(name) + 1;
...
size_t format_len ...= strlen(format) + 1;

and

struct marker_entry {
....
    char channel[0];        /* Contains channel'\0'name'\0'format'\0' *     /

};

...

e = kmalloc(sizeof(struct marker_entry)
      + channel_len + name_len + format_len,
      GFP_KERNEL);
....
e->name = &e->channel[channel_len];

Rgds,
Damien COTTIER.

Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/kernel/marker.c b/kernel/marker.c
index a8d9ee7c6fe..619d868377e 100644
--- a/kernel/marker.c
+++ b/kernel/marker.c
@@ -436,7 +436,7 @@ static struct marker_entry *add_marker(const char *channel, const char *name,
 	e->name = &e->channel[channel_len];
 	memcpy(e->name, name, name_len);
 	if (format) {
-		e->format = &e->name[channel_len + name_len];
+		e->format = &e->name[name_len];
 		memcpy(e->format, format, format_len);
 		if (strcmp(e->format, MARK_NOARGS) == 0)
 			e->call = marker_probe_cb_noarg;