* [PATCH] blktrace: reject buf_size smaller than blk_io_trace
@ 2026-03-22 5:18 Deepanshu Kartikey
2026-03-31 8:47 ` Deepanshu Kartikey
0 siblings, 1 reply; 2+ messages in thread
From: Deepanshu Kartikey @ 2026-03-22 5:18 UTC (permalink / raw)
To: axboe, rostedt, mhiramat, mathieu.desnoyers
Cc: linux-block, linux-kernel, linux-trace-kernel, Deepanshu Kartikey,
syzbot+ed8bc247f231c1a48e21, Deepanshu Kartikey
blk_trace_setup() accepts any non-zero buf_size.
If buf_size < sizeof(struct blk_io_trace), relay_reserve()
always returns NULL and all trace events are silently dropped.
Reject such values early with -EINVAL.
Reported-by: syzbot+ed8bc247f231c1a48e21@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ed8bc247f231c1a48e21
Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
---
kernel/trace/blktrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 8cd2520b4c99..6cc7d83ed1c2 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -773,7 +773,7 @@ int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
if (ret)
return -EFAULT;
- if (!buts.buf_size || !buts.buf_nr)
+ if (buts.buf_size < sizeof(struct blk_io_trace) || !buts.buf_nr)
return -EINVAL;
buts2 = (struct blk_user_trace_setup2) {
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] blktrace: reject buf_size smaller than blk_io_trace
2026-03-22 5:18 [PATCH] blktrace: reject buf_size smaller than blk_io_trace Deepanshu Kartikey
@ 2026-03-31 8:47 ` Deepanshu Kartikey
0 siblings, 0 replies; 2+ messages in thread
From: Deepanshu Kartikey @ 2026-03-31 8:47 UTC (permalink / raw)
To: axboe, rostedt, mhiramat, mathieu.desnoyers
Cc: linux-block, linux-kernel, linux-trace-kernel,
syzbot+ed8bc247f231c1a48e21
On Sun, Mar 22, 2026 at 10:48 AM Deepanshu Kartikey
<kartikey406@gmail.com> wrote:
>
> blk_trace_setup() accepts any non-zero buf_size.
> If buf_size < sizeof(struct blk_io_trace), relay_reserve()
> always returns NULL and all trace events are silently dropped.
>
> Reject such values early with -EINVAL.
>
> Reported-by: syzbot+ed8bc247f231c1a48e21@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=ed8bc247f231c1a48e21
> Signed-off-by: Deepanshu Kartikey <Kartikey406@gmail.com>
> ---
> kernel/trace/blktrace.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
> index 8cd2520b4c99..6cc7d83ed1c2 100644
> --- a/kernel/trace/blktrace.c
> +++ b/kernel/trace/blktrace.c
> @@ -773,7 +773,7 @@ int blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
> if (ret)
> return -EFAULT;
>
> - if (!buts.buf_size || !buts.buf_nr)
> + if (buts.buf_size < sizeof(struct blk_io_trace) || !buts.buf_nr)
> return -EINVAL;
>
> buts2 = (struct blk_user_trace_setup2) {
> --
> 2.43.0
>
Gentle ping on this patch . Let me know if anything else required
Thanks
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-03-31 8:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-22 5:18 [PATCH] blktrace: reject buf_size smaller than blk_io_trace Deepanshu Kartikey
2026-03-31 8:47 ` Deepanshu Kartikey
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox