summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDavid Sharp <dhsharp@google.com>2010-01-06 17:12:07 -0800
committerSteven Rostedt <rostedt@goodmis.org>2010-01-06 20:38:25 -0500
commit5ded3dc6a3c7549b36a8ac27bbd81b33756a2c29 (patch)
treee18c745a2b1b147a9222a615e9d0c39e8a6f7938
parentc6f7afaeeda5b3c42ea8d7b27e197d223a04675e (diff)
downloadlinux-stable-5ded3dc6a3c7549b36a8ac27bbd81b33756a2c29.tar.gz
linux-stable-5ded3dc6a3c7549b36a8ac27bbd81b33756a2c29.tar.bz2
linux-stable-5ded3dc6a3c7549b36a8ac27bbd81b33756a2c29.zip
ring-buffer: Wrap a list.next reference with rb_list_head()
This reference at the end of rb_get_reader_page() was causing off-by-one writes to the prev pointer of the page after the reader page when that page is the head page, and therefore the reader page has the RB_PAGE_HEAD flag in its list.next pointer. This eventually results in a GPF in a subsequent call to rb_set_head_page() (usually from rb_get_reader_page()) when that prev pointer is dereferenced. The dereferenced register would characteristically have an address that appears shifted left by one byte (eg, ffxxxxxxxxxxxxyy instead of ffffxxxxxxxxxxxx) due to being written at an address one byte too high. Signed-off-by: David Sharp <dhsharp@google.com> LKML-Reference: <1262826727-9090-1-git-send-email-dhsharp@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
-rw-r--r--kernel/trace/ring_buffer.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 2326b04c95c4..d5b7308b7e1b 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2906,7 +2906,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
*
* Now make the new head point back to the reader page.
*/
- reader->list.next->prev = &cpu_buffer->reader_page->list;
+ rb_list_head(reader->list.next)->prev = &cpu_buffer->reader_page->list;
rb_inc_page(cpu_buffer, &cpu_buffer->head_page);
/* Finally update the reader page to the new head */