Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1251212
| From | lizf@kernel.org |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.4 47/65] tracing/filter: Do not allow infix to exceed end of string |
| Date | 2015-10-20 03:00 +0200 |
| Message-ID | <qltrt-4x1-45@gated-at.bofh.it> (permalink) |
| References | <qlthL-4kA-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
3.4.110-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 upstream.
While debugging a WARN_ON() for filtering, I found that it is possible
for the filter string to be referenced after its end. With the filter:
# echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter
The filter_parse() function can call infix_get_op() which calls
infix_advance() that updates the infix filter pointers for the cnt
and tail without checking if the filter is already at the end, which
will put the cnt to zero and the tail beyond the end. The loop then calls
infix_next() that has
ps->infix.cnt--;
return ps->infix.string[ps->infix.tail++];
The cnt will now be below zero, and the tail that is returned is
already passed the end of the filter string. So far the allocation
of the filter string usually has some buffer that is zeroed out, but
if the filter string is of the exact size of the allocated buffer
there's no guarantee that the charater after the nul terminating
character will be zero.
Luckily, only root can write to the filter.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
kernel/trace/trace_events_filter.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index ae6c572..096d774 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1044,6 +1044,9 @@ static void parse_init(struct filter_parse_state *ps,
static char infix_next(struct filter_parse_state *ps)
{
+ if (!ps->infix.cnt)
+ return 0;
+
ps->infix.cnt--;
return ps->infix.string[ps->infix.tail++];
@@ -1059,6 +1062,9 @@ static char infix_peek(struct filter_parse_state *ps)
static void infix_advance(struct filter_parse_state *ps)
{
+ if (!ps->infix.cnt)
+ return;
+
ps->infix.cnt--;
ps->infix.tail++;
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.4 00/65] 3.4.110-rc1 review lizf@kernel.org - 2015-10-20 02:50 +0200
[PATCH 3.4 16/65] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset lizf@kernel.org - 2015-10-20 02:50 +0200
[PATCH 3.4 50/65] crush: fix a bug in tree bucket decode lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 54/65] KVM: x86: properly restore LVT0 lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 56/65] Revert "drm/i915: Don't skip request retirement if the active list is empty" lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 43/65] stmmac: troubleshoot unexpected bits in des0 & des1 lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 35/65] nfs: increase size of EXCHANGE_ID name string buffer lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 55/65] 9p: forgetting to cancel request on interrupted zero-copy RPC lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 46/65] tracing/filter: Do not WARN on operand count going below zero lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 61/65] usb: dwc3: Reset the transfer resource index on SET_INTERFACE lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 24/65] x86/PCI: Use host bridge _CRS info on Foxconn K8M890-8237A lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 44/65] mm: kmemleak: allow safe memory scanning during kmemleak disabling lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 23/65] regulator: core: fix constraints output buffer lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 60/65] ARM: Fix incorrect backport of 0b59d8806a31 lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 40/65] ext4: don't retry file block mapping on bigalloc fs with non-extent file lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 30/65] jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail() lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 63/65] IB/qib: Change lkey table allocation to support more MRs lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 65/65] vfs: Test for and handle paths that are unreachable from their mnt_root lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 62/65] jbd2: avoid infinite loop when destroying aborted journal lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 37/65] ext4: call sync_blockdev() before invalidate_bdev() in put_super() lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 48/65] __bitmap_parselist: fix bug in empty string handling lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 59/65] crypto: s390/ghash: Fix incorrect backport of a1cae34e23b1 lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 47/65] tracing/filter: Do not allow infix to exceed end of string lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 58/65] drm/radeon: partially revert "fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling" lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 52/65] ACPICA: Tables: Fix an issue that FACS initialization is performed twice lizf@kernel.org - 2015-10-20 03:00 +0200
RE: [PATCH 3.4 52/65] ACPICA: Tables: Fix an issue that FACS initialization is performed twice "Moore, Robert" <robert.moore@intel.com> - 2015-10-20 15:40 +0200
RE: [PATCH 3.4 52/65] ACPICA: Tables: Fix an issue that FACS initialization is performed twice "Zheng, Lv" <lv.zheng@intel.com> - 2015-10-21 03:30 +0200
[PATCH 3.4 53/65] KVM: x86: make vapics_in_nmi_mode atomic lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 34/65] mmc: card: Fixup request missing in mmc_blk_issue_rw_rq lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 42/65] bridge: multicast: restore router configuration on port link down/up lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 64/65] dcache: Handle escaped paths in prepend_path lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 36/65] bridge: fix br_stp_set_bridge_priority race conditions lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 51/65] fuse: initialize fc->release before calling it lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 38/65] packet: read num_members once in packet_rcv_fanout() lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 57/65] Revert "drm/radeon: Use drm_calloc_ab for CS relocs" lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 49/65] agp/intel: Fix typo in needs_ilk_vtd_wa() lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 27/65] ext4: fix race between truncate and __ext4_journalled_writepage() lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 39/65] packet: avoid out of bounds read in round robin fanout lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 45/65] dell-laptop: Fix allocating & freeing SMI buffer page lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 41/65] watchdog: omap: assert the counter being stopped before reprogramming lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 25/65] dmaengine: mv_xor: bug fix for racing condition in descriptors cleanup lizf@kernel.org - 2015-10-20 03:00 +0200
[PATCH 3.4 33/65] ideapad: fix software rfkill setting lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 19/65] SUNRPC: Fix a memory leak in the backchannel code lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 10/65] rndis_wlan: harmless issue calling set_bit() lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 32/65] jbd2: fix ocfs2 corrupt when updating journal superblock fails lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 12/65] usb: dwc3: gadget: return error if command sent to DEPCMD register fails lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 20/65] ipr: Increase default adapter init stage change timeout lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 26/65] ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1] lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 06/65] ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 01/65] hrtimer: Allow concurrent hrtimer_start() for self restarting timers lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 09/65] tty/serial: at91: RS485 mode: 0 is valid for delay_rts_after_send lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 28/65] Disable write buffering on Toshiba ToPIC95 lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 13/65] rcu: Correctly handle non-empty Tiny RCU callback list with none ready lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 22/65] ath9k: fix DMA stop sequence for AR9003+ lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 31/65] regmap: Fix regmap_bulk_read in BE mode lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 15/65] staging: rtl8712: prevent buffer overrun in recvbuf2recvframe lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 02/65] mtd: fix: avoid race condition when accessing mtd->usecount lizf@kernel.org - 2015-10-20 03:10 +0200
[PATCH 3.4 29/65] sctp: fix ASCONF list handling lizf@kernel.org - 2015-10-20 03:10 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-10-20 04:20 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Geert Uytterhoeven <geert@linux-m68k.org> - 2015-10-20 09:10 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Geert Uytterhoeven <geert@linux-m68k.org> - 2015-10-20 11:10 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-10-20 15:00 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-10-20 15:20 +0200
Re: [PATCH 3.4 00/65] 3.4.110-rc1 review Zefan Li <lizefan@huawei.com> - 2015-10-21 10:10 +0200
csiph-web