As pointed out by Smatch, the ring-buffer descriptor array page_va is counted by nr_page_va, but the accessor ring_buffer_desc_page() allows access off by one.
Currently, this does not cause problems, as the page ID always comes from a trusted source. Nonetheless, ensure robustness and fix the accessor. While at it, make the page_id unsigned. Reported-by: Dan Carpenter <[email protected]> Signed-off-by: Vincent Donnefort <[email protected]> --- Currently based on kvmarm/next. diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 96e0d80d492b..2c77020e7aac 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -2238,9 +2238,9 @@ static struct ring_buffer_desc *ring_buffer_desc(struct trace_buffer_desc *trace return NULL; } -static void *ring_buffer_desc_page(struct ring_buffer_desc *desc, int page_id) +static void *ring_buffer_desc_page(struct ring_buffer_desc *desc, unsigned int page_id) { - return page_id > desc->nr_page_va ? NULL : (void *)desc->page_va[page_id]; + return page_id >= desc->nr_page_va ? NULL : (void *)desc->page_va[page_id]; } static int __rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, base-commit: 94b4ae79ebb42a8a6f2124b4d4b033b15a98e4f9 -- 2.53.0.1213.gd9a14994de-goog
