forked from ~ljy/RK356X_SDK_RELEASE

blame | history | patch | commit | commitdiff
hc
2024-02-20 102a0743326a03cd1a1202ceda21e175b7d3575c 
 kernel/kernel/trace/trace_events_hist.c
....@@ -417,7 +417,7 @@
417417 	 * event param, and is passed to the synthetic event
418418 	 * invocation.
419419 	 */
420
-	unsigned int		var_ref_idx[TRACING_MAP_VARS_MAX];
420
+	unsigned int		var_ref_idx[SYNTH_FIELDS_MAX];
421421 	struct synth_event	*synth_event;
422422 	bool			use_trace_keyword;
423423 	char			*synth_event_name;
....@@ -1087,6 +1087,9 @@
10871087 {
10881088 	const char *field_name = "";
10891089 
1090
+	if (WARN_ON_ONCE(!field))
1091
+		return field_name;
1092
+
10901093 	if (level > 1)
10911094 		return field_name;
10921095 
....@@ -1646,6 +1649,8 @@
16461649 		unsigned long fl = flags & ~HIST_FIELD_FL_LOG2;
16471650 		hist_field->fn = hist_field_log2;
16481651 		hist_field->operands[0] = create_hist_field(hist_data, field, fl, NULL);
1652
+		if (!hist_field->operands[0])
1653
+			goto free;
16491654 		hist_field->size = hist_field->operands[0]->size;
16501655 		hist_field->type = kstrdup(hist_field->operands[0]->type, GFP_KERNEL);
16511656 		if (!hist_field->type)
....@@ -1846,7 +1851,9 @@
18461851 			return ref_field;
18471852 		}
18481853 	}
1849
-
1854
+	/* Sanity check to avoid out-of-bound write on 'hist_data->var_refs' */
1855
+	if (hist_data->n_var_refs >= TRACING_MAP_VARS_MAX)
1856
+		return NULL;
18501857 	ref_field = create_hist_field(var_field->hist_data, NULL, flags, NULL);
18511858 	if (ref_field) {
18521859 		if (init_var_ref(ref_field, var_field, system, event_name)) {
....@@ -3113,6 +3120,7 @@
31133120 	while (params) {
31143121 		if (data->n_params >= SYNTH_FIELDS_MAX) {
31153122 			hist_err(tr, HIST_ERR_TOO_MANY_PARAMS, 0);
3123
+			ret = -EINVAL;
31163124 			goto out;
31173125 		}
31183126 
....@@ -3448,6 +3456,10 @@
34483456 	int var_ref_idx, ret = 0;
34493457 
34503458 	lockdep_assert_held(&event_mutex);
3459
+
3460
+	/* Sanity check to avoid out-of-bound write on 'data->var_ref_idx' */
3461
+	if (data->n_params > SYNTH_FIELDS_MAX)
3462
+		return -EINVAL;
34513463 
34523464 	if (data->use_trace_keyword)
34533465 		synth_event_name = data->synth_event_name;
....@@ -5805,12 +5817,15 @@
58055817 	if (get_named_trigger_data(trigger_data))
58065818 		goto enable;
58075819 
5808
-	if (has_hist_vars(hist_data))
5809
-		save_hist_vars(hist_data);
5810
-
58115820 	ret = create_actions(hist_data);
58125821 	if (ret)
58135822 		goto out_unreg;
5823
+
5824
+	if (has_hist_vars(hist_data) || hist_data->n_var_refs) {
5825
+		ret = save_hist_vars(hist_data);
5826
+		if (ret)
5827
+			goto out_unreg;
5828
+	}
58145829 
58155830 	ret = tracing_map_init(hist_data->map);
58165831 	if (ret)
....@@ -5827,7 +5842,7 @@
58275842 	/* Just return zero, not the number of registered triggers */
58285843 	ret = 0;
58295844  out:
5830
-	if (ret == 0)
5845
+	if (ret == 0 && glob[0])
58315846 		hist_err_clear();
58325847 
58335848 	return ret;