From 3639d6f43500618e35f05dfe2c174f6bfff44a73 Mon Sep 17 00:00:00 2001 From: Deepanshu Kartikey Date: Sun, 3 May 2026 14:25:19 +0530 Subject: [PATCH] blktrace: reject buf_size smaller than blk_io_trace2 blk_trace_setup() accepts any non-zero buf_size from userspace and passes it directly to relay_open(). If buf_size is smaller than sizeof(struct blk_io_trace2), relay_reserve() always returns NULL and all trace events are silently dropped. Reject such values early with -EINVAL. Signed-off-by: Deepanshu Kartikey --- kernel/trace/blktrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index 8cd2520b4c99e..20f941495151f 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c @@ -773,7 +773,7 @@ int blk_trace_setup(struct request_queue *q, char *name, dev_t dev, if (ret) return -EFAULT; - if (!buts.buf_size || !buts.buf_nr) + if (buts.buf_size < sizeof(struct blk_io_trace2) || !buts.buf_nr) return -EINVAL; buts2 = (struct blk_user_trace_setup2) {