[PATCH 4/4] tracing/inject: Prevent overflow growing string fields

[Li Qiang]

parse_entry() appends dynamic string data by adding its length to the
current entry size. An oversized input can overflow this signed addition,
cause krealloc() to receive too small a length, and then write beyond it.

Reject a string length that cannot be added to entry_size before growing
the allocation.

Fixes: 6c3edaf9fd6a ("tracing: Introduce trace event injection")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Li Qiang <liqiang01@xxxxxxxxxx>
---
 kernel/trace/trace_events_inject.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/trace/trace_events_inject.c b/kernel/trace/trace_events_inject.c
index b8b141c00d5c..5c551def44f6 100644
--- a/kernel/trace/trace_events_inject.c
+++ b/kernel/trace/trace_events_inject.c
@@ -243,6 +243,9 @@ static int parse_entry(char *str, struct trace_event_call *call, void **pentry)
 				int str_loc = entry_size & 0xffff;
 				u32 *str_item;
 
+				if (str_len > INT_MAX - entry_size)
+					return -E2BIG;
+
 				entry_size += str_len;
 				*pentry = krealloc(entry, entry_size, GFP_KERNEL);
 				if (!*pentry) {
-- 
2.43.0