From 30cddf693eea0129b25c9761db6b202ddef549b3 Mon Sep 17 00:00:00 2001 From: Mathieu Desnoyers Date: Fri, 7 May 2021 15:03:04 -0400 Subject: [PATCH] Fix: increment buffer offset when failing to copy from user-space Upon failure to copy from user-space due to failing access ok check, the ring buffer offset is not incremented, which could generate unreadable traces because we don't account for the padding we write into the ring buffer. Note that this typically won't affect a common use-case of copying strings from user-space, because unless mprotect is invoked within a narrow race window (between user strlen and user strcpy), the strlen will fail on access ok when calculating the space to reserve, which will match what happens on strcpy. Signed-off-by: Mathieu Desnoyers Change-Id: Ic4d9487dd8870a526bae3023bb80f5e6301cec50 --- lib/ringbuffer/backend.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/ringbuffer/backend.h b/lib/ringbuffer/backend.h index 855f1e01..d8119110 100644 --- a/lib/ringbuffer/backend.h +++ b/lib/ringbuffer/backend.h @@ -313,6 +313,7 @@ fill_buffer: * the pollution of static inline code. */ _lib_ring_buffer_memset(bufb, offset, 0, len, 0); + ctx->priv.buf_offset += len; } /** @@ -395,6 +396,7 @@ fill_buffer: _lib_ring_buffer_memset(bufb, offset, pad, len - 1, 0); offset += len - 1; _lib_ring_buffer_memset(bufb, offset, '\0', 1, 0); + ctx->priv.buf_offset += len; } /* -- 2.34.1