From c1acb4ac1a892cf08d27efcb964ad281728b0545 Mon Sep 17 00:00:00 2001

From: Qiujun Huang <hqjagain@gmail.com>

Date: Fri, 30 Oct 2020 00:19:05 +0800

Subject: [PATCH] tracing: Fix out of bounds write in get_trace_buf

Git-commit: c1acb4ac1a892cf08d27efcb964ad281728b0545

Patch-mainline: v5.10-rc3

References: bsc#1179403

The nesting count of trace_printk allows for 4 levels of nesting. The

nesting counter starts at zero and is incremented before being used to

retrieve the current context's buffer. But the index to the buffer uses the

nesting counter after it was incremented, and not its original number,

which in needs to do.

Link: https://lkml.kernel.org/r/20201029161905.4269-1-hqjagain@gmail.com

Cc: stable@vger.kernel.org

Fixes: 3d9622c12c887 ("tracing: Add barrier to trace_printk() buffer nesting modification")

Signed-off-by: Qiujun Huang <hqjagain@gmail.com>

Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>

Acked-by: Petr Mladek <pmladek@suse.com>

---

 kernel/trace/trace.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c

index 528971714fc6..daa96215e294 100644

--- a/kernel/trace/trace.c

+++ b/kernel/trace/trace.c

@@ -3132,7 +3132,7 @@ static char *get_trace_buf(void)

 	/* Interrupts must see nesting incremented before we use the buffer */

 	barrier();

-	return &buffer->buffer[buffer->nesting][0];

+	return &buffer->buffer[buffer->nesting - 1][0];

 }

 static void put_trace_buf(void)

-- 

2.26.2