From: David Daney on
Under some circumstances, I'm not sure exactly which, a trace.dat file
may contain a bunch of zeros at the end of one or more of the trace
logs. This can lead to tracecmd_peek_data() attempting to read past
the end of the mmaped log, causing SIGSEGV.

This is a two part fix.

1) For 'new format' data, we always try to read 8 bytes of data. Make
sure that they are all on the current page.

2) In pevent_print_event(), if record->size is negative, warn and then
skip attempting to print it.

Signed-off-by: David Daney <ddaney(a)caviumnetworks.com>
---
parse-events.c | 5 +++++
trace-input.c | 3 ++-
2 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/parse-events.c b/parse-events.c
index 16fff12..52b68f0 100644
--- a/parse-events.c
+++ b/parse-events.c
@@ -3881,6 +3881,11 @@ void pevent_print_event(struct pevent *pevent, struct trace_seq *s,
usecs = record->ts - secs * NSECS_PER_SEC;
usecs = (usecs + 500) / NSECS_PER_USEC;

+ if (record->size < 0) {
+ do_warning("ug! negative record size %d", record->size);
+ return;
+ }
+
type = trace_parse_common_type(pevent, data);

event = pevent_find_event(pevent, type);
diff --git a/trace-input.c b/trace-input.c
index 398d0f9..7241197 100644
--- a/trace-input.c
+++ b/trace-input.c
@@ -1511,7 +1511,8 @@ read_again:
if (index < 0)
die("negative index on cpu record %d", cpu);

- if (index >= handle->cpu_data[cpu].page_size + pevent->header_page_data_offset) {
+ if (index + (pevent->old_format ? 0 : 4) >=
+ handle->cpu_data[cpu].page_size + pevent->header_page_data_offset) {
if (get_next_page(handle, cpu))
return NULL;
return tracecmd_peek_data(handle, cpu);
--
1.7.1.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/