blk_trace_setup() accepts any non-zero buf_size from userspace and passes it directly to relay_open(). If buf_size is smaller than sizeof(struct blk_io_trace2), relay_reserve() always returns NULL and all trace events are silently dropped.
Reject such values early with -EINVAL. Signed-off-by: Deepanshu Kartikey <[email protected]> --- Changes in v2: - Use sizeof(struct blk_io_trace2) instead of sizeof(struct blk_io_trace) as it is the larger of the two structs - Remove incorrect syzbot link from commit message --- kernel/trace/blktrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index 8cd2520b4c99..20f941495151 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -773,7 +773,7 @@ int blk_trace_setup(struct request_queue *q, char *name, dev_t dev, if (ret) return -EFAULT; - if (!buts.buf_size || !buts.buf_nr) + if (buts.buf_size < sizeof(struct blk_io_trace2) || !buts.buf_nr) return -EINVAL; buts2 = (struct blk_user_trace_setup2) { -- 2.43.0
