2006-10-20 13:58:49

by Martin Peschke

Subject: [Patch] statistics: fix buffer overflow in histogram with linear scale

Values outside the range covered by a histogram with linear
scale resulted in invalid indices pointing to non-existing
'buckets'. Index is adjusted to array boundaries, if required.

Signed-off-by: Martin Peschke <[email protected]>
---

statistic.c | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)

diff -urp a/lib/statistic.c b/lib/statistic.c
--- a/lib/statistic.c 2006-10-08 23:03:56.000000000 +0200
+++ b/lib/statistic.c 2006-10-12 19:38:08.000000000 +0200
@@ -994,9 +994,12 @@ static s64 statistic_histogram_calc_valu

static int statistic_histogram_calc_index_lin(struct statistic *stat, s64 value)
{
- unsigned long long i = value - stat->u.histogram.range_min;
+ unsigned long long i;
+ if (value <= stat->u.histogram.range_min)
+ return 0;
+ i = value - stat->u.histogram.range_min;
do_div(i, stat->u.histogram.base_interval);
- return i;
+ return min(i, (unsigned long long)(stat->u.histogram.last_index));
}

static int statistic_histogram_calc_index_log2(struct statistic *stat,

2006-10-20 18:52:51

by Andrew Morton

Subject: Re: [Patch] statistics: fix buffer overflow in histogram with linear scale

On Fri, 20 Oct 2006 15:58:44 +0200
Martin Peschke <[email protected]> wrote:

> --- a/lib/statistic.c 2006-10-08 23:03:56.000000000 +0200
> +++ b/lib/statistic.c 2006-10-12 19:38:08.000000000 +0200

So... what are we going to do with the statistics stuff? It needs users
to prove its desirability/suitability. I think there was some work done in
the SCSI area - did that come to anything?

2006-10-20 21:16:30

by Frank Ch. Eigler

Subject: Re: [Patch] statistics: fix buffer overflow in histogram with linear scale

Andrew Morton <[email protected]> writes:

> So... what are we going to do with the statistics stuff? It needs users
> to prove its desirability/suitability. I think there was some work done in
> the SCSI area - did that come to anything?

There may be an opportunity here for combining this and the
markers-based lttng work. Statistics gathering would be just one of
several possible back-end for events corresponding to scsi quantity
changes: tracing or more elaborate probing would also be enabled.

- FChE