#undef TRACE_SYSTEM
#define TRACE_SYSTEM page_ref

#if !defined(_TRACE_PAGE_REF_H) || defined(TRACE_HEADER_MULTI_READ)
#define _TRACE_PAGE_REF_H

#include <linux/types.h>
#include <linux/page_ref.h>
#include <linux/tracepoint.h>
#include <trace/events/mmflags.h>

DECLARE_EVENT_CLASS(page_ref_mod_template,

	TP_PROTO(struct page *page, int v),

	TP_ARGS(page, v),

	TP_STRUCT__entry(
		__field(unsigned long, pfn)
		__field(unsigned long, flags)
		__field(int, count)
		__field(int, mapcount)
		__field(void *, mapping)
		__field(int, mt)
		__field(int, val)
	),

	TP_fast_assign(
		__entry->pfn = page_to_pfn(page);
		__entry->flags = page->flags;
		__entry->count = page_ref_count(page);
		__entry->mapcount = page_mapcount(page);
		__entry->mapping = page->mapping;
		__entry->mt = get_pageblock_migratetype(page);
		__entry->val = v;
	),

	TP_printk("pfn=0x%lx flags=%s count=%d mapcount=%d mapping=%p mt=%d val=%d",
		__entry->pfn,
		show_page_flags(__entry->flags & ((1UL << NR_PAGEFLAGS) - 1)),
		__entry->count,
		__entry->mapcount, __entry->mapping, __entry->mt,
		__entry->val)
);

DEFINE_EVENT(page_ref_mod_template, page_ref_set,

	TP_PROTO(struct page *page, int v),

	TP_ARGS(page, v)
);

DEFINE_EVENT(page_ref_mod_template, page_ref_mod,

	TP_PROTO(struct page *page, int v),

	TP_ARGS(page, v)
);

DECLARE_EVENT_CLASS(page_ref_mod_and_test_template,

	TP_PROTO(struct page *page, int v, int ret),

	TP_ARGS(page, v, ret),

	TP_STRUCT__entry(
		__field(unsigned long, pfn)
		__field(unsigned long, flags)
		__field(int, count)
		__field(int, mapcount)
		__field(void *, mapping)
		__field(int, mt)
		__field(int, val)
		__field(int, ret)
	),

	TP_fast_assign(
		__entry->pfn = page_to_pfn(page);
		__entry->flags = page->flags;
		__entry->count = page_ref_count(page);
		__entry->mapcount = page_mapcount(page);
		__entry->mapping = page->mapping;
		__entry->mt = get_pageblock_migratetype(page);
		__entry->val = v;
		__entry->ret = ret;
	),

	TP_printk("pfn=0x%lx flags=%s count=%d mapcount=%d mapping=%p mt=%d val=%d ret=%d",
		__entry->pfn,
		show_page_flags(__entry->flags & ((1UL << NR_PAGEFLAGS) - 1)),
		__entry->count,
		__entry->mapcount, __entry->mapping, __entry->mt,
		__entry->val, __entry->ret)
);

DEFINE_EVENT(page_ref_mod_and_test_template, page_ref_mod_and_test,

	TP_PROTO(struct page *page, int v, int ret),

	TP_ARGS(page, v, ret)
);

DEFINE_EVENT(page_ref_mod_and_test_template, page_ref_mod_and_return,

	TP_PROTO(struct page *page, int v, int ret),

	TP_ARGS(page, v, ret)
);

DEFINE_EVENT(page_ref_mod_and_test_template, page_ref_mod_unless,

	TP_PROTO(struct page *page, int v, int ret),

	TP_ARGS(page, v, ret)
);

DEFINE_EVENT(page_ref_mod_and_test_template, page_ref_freeze,

	TP_PROTO(struct page *page, int v, int ret),

	TP_ARGS(page, v, ret)
);

DEFINE_EVENT(page_ref_mod_template, page_ref_unfreeze,

	TP_PROTO(struct page *page, int v),

	TP_ARGS(page, v)
);

#endif /* _TRACE_PAGE_COUNT_H */

/* This part must be outside protection */
#include <trace/define_trace.h>
294ad5e539acaebfc4625e3&amp;showmsg=1'>ipv4</a>/<a href='/cgit.cgi/linux/net-next.git/log/net/ipv4/cipso_ipv4.c?id=432d4f8ab03527958294ad5e539acaebfc4625e3&amp;showmsg=1'>cipso_ipv4.c</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/cgit.cgi/linux/net-next.git/log/net/ipv4/cipso_ipv4.c?id=432d4f8ab03527958294ad5e539acaebfc4625e3'>Collapse</a>)</th><th class='left'>Author</th><th class='left'>Files</th><th class='left'>Lines</th></tr>
<tr class='logheader'><td><span title='2017-02-04 19:44:22 -0500'>2017-02-04</span></td><td class='logsubject'><a href='/cgit.cgi/linux/net-next.git/commit/net/ipv4/cipso_ipv4.c?id=d71b7896886345c53ef1d84bda2bc758554f5d61'>netlabel: out of bound access in cipso_v4_validate()</a></td><td>Eric Dumazet</td><td>1</td><td><span class='deletions'>-0</span>/<span class='insertions'>+4</span></td></tr>
<tr class='nohover-highlight'><td/><td colspan='5' class='logmsg'>
syzkaller found another out of bound access in ip_options_compile(),
or more exactly in cipso_v4_validate()

Fixes: 20e2a8648596 ("cipso: handle CIPSO options correctly when NetLabel is disabled")
Fixes: 446fda4f2682 ("[NetLabel]: CIPSOv4 engine")
Signed-off-by: Eric Dumazet &lt;edumazet@google.com&gt;
Reported-by: Dmitry Vyukov  &lt;dvyukov@google.com&gt;
Cc: Paul Moore &lt;paul@paul-moore.com&gt;
Acked-by: Paul Moore &lt;paul@paul-moore.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;


</td></tr>