[PATCH 4/4] tracing/inject: Prevent overflow growing string fields

[Li Qiang]

parse_entry() appends dynamic string data by adding its length to the
current entry size. An oversized input can overflow this signed addition,
cause krealloc() to receive too small a length, and then write beyond it.

Reject a string length that cannot be added to entry_size before growing
the allocation.

Fixes: 6c3edaf9fd6a ("tracing: Introduce trace event injection")
Cc: sta...@vger.kernel.org
Signed-off-by: Li Qiang <liqian...@kylinos.cn>
---
 kernel/trace/trace_events_inject.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/trace/trace_events_inject.c 
b/kernel/trace/trace_events_inject.c
index b8b141c00d5c..5c551def44f6 100644
--- a/kernel/trace/trace_events_inject.c
+++ b/kernel/trace/trace_events_inject.c
@@ -243,6 +243,9 @@ static int parse_entry(char *str, struct trace_event_call 
*call, void **pentry)
                                int str_loc = entry_size & 0xffff;
                                u32 *str_item;
 
+                               if (str_len > INT_MAX - entry_size)
+                                       return -E2BIG;
+
                                entry_size += str_len;
                                *pentry = krealloc(entry, entry_size, 
GFP_KERNEL);
                                if (!*pentry) {
-- 
2.43.0