[PATCH 0/3] tools/mm: fix three out-of-bounds accesses in page_owner_sort

[2-D Godoy]

page_owner_sort walks the records it copies out of a page_owner dump and, in
three places, reads outside of the buffers it allocated: the copy of the
record is handed to regexec() before it is terminated, the removal of the
timestamp moves overlapping memory with memcpy(), and the allocator
classification walks back before the beginning of the record.

All three are reachable by sorting a regular dump and are reported by
AddressSanitizer.  The tool is a user-space helper, so what is at stake is
the dump file being read and the memory of whoever runs the tool, not the
kernel.

The series fixes one bug per patch.  The behaviour of the tool does not
change: the allocator classification of a dump carrying a
__vmalloc_node_range frame is byte-identical before and after, and the
three patches pass checkpatch.pl --strict with 0 errors, 0 warnings and 0
checks.

Henrique Godoy (3):
  tools/mm: terminate the record buffer before matching the timestamp
  tools/mm: use memmove() to drop the timestamp from a record
  tools/mm: keep the allocator scan inside the record

 tools/mm/page_owner_sort.c | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

-- 
2.39.5