From 6e77b325a2219eb7a2e2fa2731288eed2c769e2d Mon Sep 17 00:00:00 2001 From: Pratyush Yadav Date: Fri, 16 Dec 2022 14:42:41 +0100 Subject: [PATCH] tracing/ring-buffer: Only do full wait when cpu != RING_BUFFER_ALL_CPUS full_hit() directly uses cpu as an array index. Since RING_BUFFER_ALL_CPUS == -1, calling full_hit() with cpu == RING_BUFFER_ALL_CPUS will cause an invalid memory access. The upstream commit bf7966d96b74 ("tracing/ring-buffer: Have polling block on watermark") already does this. This was missed when backporting to v5.4.y. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: 9b7faceb5367 ("tracing/ring-buffer: Have polling block on watermark") Signed-off-by: Pratyush Yadav Acked-by: Steven Rostedt (Google) Signed-off-by: Greg Kroah-Hartman --- kernel/trace/ring_buffer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 176d858903bdb..11e8189dd8ae9 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -727,6 +727,7 @@ __poll_t ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu, if (cpu == RING_BUFFER_ALL_CPUS) { work = &buffer->irq_work; + full = 0; } else { if (!cpumask_test_cpu(cpu, buffer->cpumask)) return -EINVAL; -- 2.39.5