diff options
| author | Vincent Donnefort <vdonnefort@google.com> | 2026-09-11 20:39:36 +0100 |
|---|---|---|
| committer | Steven Rostedt <rostedt@goodmis.org> | 2026-09-13 13:06:43 -0400 |
| commit | d059d8bf2c9b5d563d15e7552d73e17d7535013a (patch) | |
| tree | a958db6ff48b5c897c2da0c2801844e27e135781 /include/linux | |
| parent | 442ffa742daa65a0e8fe003abe9fbe472366e4de (diff) | |
tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing
The number of pages per remote ring buffer is capped by
ring_buffer_desc::nr_page_va (32 bits). A buffer_size large enough to
overflow that field would silently allocate a descriptor smaller than
what was asked for.
Return SIZE_MAX from trace_buffer_desc_size() on nr_page_va overflow.
Link: https://patch.msgid.link/20260911193937.602202-3-vdonnefort@google.com
Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/ring_buffer.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h index 11bffb6a142d..eac3e9080c3c 100644 --- a/include/linux/ring_buffer.h +++ b/include/linux/ring_buffer.h @@ -295,6 +295,10 @@ static inline size_t trace_buffer_desc_size(size_t buffer_size, unsigned int nr_ unsigned long nr_pages = __calc_nr_pages_ring_buffer_desc(buffer_size); struct ring_buffer_desc *rbdesc; + /* Capped by ring_buffer_desc::nr_page_va */ + if (nr_pages > UINT_MAX) + return SIZE_MAX; + return size_add(offsetof(struct trace_buffer_desc, __data), size_mul(nr_cpus, struct_size(rbdesc, page_va, nr_pages))); } |