1 files changed, 45 insertions, 20 deletions

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index ce11fa50a2f0..1af4f8f2ab5d 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -939,19 +939,20 @@ out:
         return ret;
 }
 
+/* TODO add a seq_buf_to_buffer() */
 static ssize_t trace_seq_to_buffer(struct trace_seq *s, void *buf, size_t cnt)
 {
         int len;
 
-        if (s->len <= s->readpos)
+        if (trace_seq_used(s) <= s->seq.readpos)
                 return -EBUSY;
 
-        len = s->len - s->readpos;
+        len = trace_seq_used(s) - s->seq.readpos;
         if (cnt > len)
                 cnt = len;
-        memcpy(buf, s->buffer + s->readpos, cnt);
+        memcpy(buf, s->buffer + s->seq.readpos, cnt);
 
-        s->readpos += cnt;
+        s->seq.readpos += cnt;
         return cnt;
 }
 
@@ -4313,6 +4314,8 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
                 goto out;
         }
 
+        trace_seq_init(&iter->seq);
+
         /*
          * We make a copy of the current tracer to avoid concurrent
          * changes on it while we are reading.
@@ -4506,18 +4509,18 @@ waitagain:
         trace_access_lock(iter->cpu_file);
         while (trace_find_next_entry_inc(iter) != NULL) {
                 enum print_line_t ret;
-                int len = iter->seq.len;
+                int save_len = iter->seq.seq.len;
 
                 ret = print_trace_line(iter);
                 if (ret == TRACE_TYPE_PARTIAL_LINE) {
                         /* don't print partial lines */
-                        iter->seq.len = len;
+                        iter->seq.seq.len = save_len;
                         break;
                 }
                 if (ret != TRACE_TYPE_NO_CONSUME)
                         trace_consume(iter);
 
-                if (iter->seq.len >= cnt)
+                if (trace_seq_used(&iter->seq) >= cnt)
                         break;
 
                 /*
@@ -4533,7 +4536,7 @@ waitagain:
 
         /* Now copy what we have to the user */
         sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
-        if (iter->seq.readpos >= iter->seq.len)
+        if (iter->seq.seq.readpos >= trace_seq_used(&iter->seq))
                 trace_seq_init(&iter->seq);
 
         /*
@@ -4567,20 +4570,33 @@ static size_t
 tracing_fill_pipe_page(size_t rem, struct trace_iterator *iter)
 {
         size_t count;
+        int save_len;
         int ret;
 
         /* Seq buffer is page-sized, exactly what we need. */
         for (;;) {
-                count = iter->seq.len;
+                save_len = iter->seq.seq.len;
                 ret = print_trace_line(iter);
-                count = iter->seq.len - count;
-                if (rem < count) {
-                        rem = 0;
-                        iter->seq.len -= count;
+
+                if (trace_seq_has_overflowed(&iter->seq)) {
+                        iter->seq.seq.len = save_len;
                         break;
                 }
+
+                /*
+                 * This should not be hit, because it should only
+                 * be set if the iter->seq overflowed. But check it
+                 * anyway to be safe.
+                 */
                 if (ret == TRACE_TYPE_PARTIAL_LINE) {
-                        iter->seq.len -= count;
+                        iter->seq.seq.len = save_len;
+                        break;
+                }
+
+                count = trace_seq_used(&iter->seq) - save_len;
+                if (rem < count) {
+                        rem = 0;
+                        iter->seq.seq.len = save_len;
                         break;
                 }
 
@@ -4661,13 +4677,13 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
                 /* Copy the data into the page, so we can start over. */
                 ret = trace_seq_to_buffer(&iter->seq,
                                           page_address(spd.pages[i]),
-                                          iter->seq.len);
+                                          trace_seq_used(&iter->seq));
                 if (ret < 0) {
                         __free_page(spd.pages[i]);
                         break;
                 }
                 spd.partial[i].offset = 0;
-                spd.partial[i].len = iter->seq.len;
+                spd.partial[i].len = trace_seq_used(&iter->seq);
 
                 trace_seq_init(&iter->seq);
         }
@@ -5667,7 +5683,8 @@ tracing_stats_read(struct file *filp, char __user *ubuf,
         cnt = ring_buffer_read_events_cpu(trace_buf->buffer, cpu);
         trace_seq_printf(s, "read events: %ld\n", cnt);
 
-        count = simple_read_from_buffer(ubuf, count, ppos, s->buffer, s->len);
+        count = simple_read_from_buffer(ubuf, count, ppos,
+                                        s->buffer, trace_seq_used(s));
 
         kfree(s);
 
@@ -6630,11 +6647,19 @@ void
 trace_printk_seq(struct trace_seq *s)
 {
         /* Probably should print a warning here. */
-        if (s->len >= TRACE_MAX_PRINT)
-                s->len = TRACE_MAX_PRINT;
+        if (s->seq.len >= TRACE_MAX_PRINT)
+                s->seq.len = TRACE_MAX_PRINT;
+
+        /*
+         * More paranoid code. Although the buffer size is set to
+         * PAGE_SIZE, and TRACE_MAX_PRINT is 1000, this is just
+         * an extra layer of protection.
+         */
+        if (WARN_ON_ONCE(s->seq.len >= s->seq.size))
+                s->seq.len = s->seq.size - 1;
 
         /* should be zero ended, but we are paranoid. */
-        s->buffer[s->len] = 0;
+        s->buffer[s->seq.len] = 0;
 
         printk(KERN_TRACE "%s", s->buffer);