From mboxrd@z Thu Jan 1 00:00:00 1970 From: compudj@krystal.dyndns.org (Mathieu Desnoyers) Date: Mon, 2 Aug 2010 15:48:54 -0400 Subject: [ltt-dev] Bug in add_marker (marker.c) In-Reply-To: <2AC7D4AD8BA1C640B4C60C61C8E5201539DED6C058@EXDCVYMBSTM006.EQ1STM.local> References: <2AC7D4AD8BA1C640B4C60C61C8E5201539DED6C058@EXDCVYMBSTM006.EQ1STM.local> Message-ID: <20100802194854.GC3910@Krystal> Good catch ! Here is the patch. Pierre-Marc, can you apply it to UST too ? Thanks, Mathieu markers fix out of bound array While creating my own probes, I've observed that I get format mismatch error... While digging into the executed code I observe that my format (stored in a marker_entry) was overwritten by a new allocated structure. Finally I found that in add_marker function the format pointer seems to be set to the wrong position: e->format = &e->name[channel_len + name_len]; while the proper assignment should be e->format = &e->name[name_len]; indead: size_t channel_len = strlen(channel) + 1; size_t name_len = strlen(name) + 1; ... size_t format_len ...= strlen(format) + 1; and struct marker_entry { .... char channel[0]; /* Contains channel'\0'name'\0'format'\0' * / }; ... e = kmalloc(sizeof(struct marker_entry) + channel_len + name_len + format_len, GFP_KERNEL); .... e->name = &e->channel[channel_len]; Rgds, Damien COTTIER. Signed-off-by: Mathieu Desnoyers --- kernel/marker.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: linux-2.6-lttng/kernel/marker.c =================================================================== --- linux-2.6-lttng.orig/kernel/marker.c 2010-08-02 15:44:51.000000000 -0400 +++ linux-2.6-lttng/kernel/marker.c 2010-08-02 15:45:55.000000000 -0400 @@ -436,7 +436,7 @@ static struct marker_entry *add_marker(c e->name = &e->channel[channel_len]; memcpy(e->name, name, name_len); if (format) { - e->format = &e->name[channel_len + name_len]; + e->format = &e->name[name_len]; memcpy(e->format, format, format_len); if (strcmp(e->format, MARK_NOARGS) == 0) e->call = marker_probe_cb_noarg; -- Mathieu Desnoyers Operating System Efficiency R&D Consultant EfficiOS Inc. http://www.efficios.com