On 5/3/26 10:55 AM, Deepanshu Kartikey wrote:
blk_trace_setup() accepts any non-zero buf_size from userspace and passes it directly to relay_open(). If buf_size is smaller than sizeof(struct blk_io_trace2), relay_reserve() always returns NULL and all trace events are silently dropped.
That's the intended behavior, isn't it?
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index 8cd2520b4c99..20f941495151 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -773,7 +773,7 @@ int blk_trace_setup(struct request_queue *q, char *name, dev_t dev, if (ret) return -EFAULT;- if (!buts.buf_size || !buts.buf_nr)+ if (buts.buf_size < sizeof(struct blk_io_trace2) || !buts.buf_nr) return -EINVAL;buts2 = (struct blk_user_trace_setup2) {
We may be better off not changing this code because there may be users who rely on the current behavior and who will report this change in
behavior as a regression. Thanks, Bart.
