[for-next][PATCH 6/8] tracing: Fix crash from reading trace_pipe with sendfile

Path	csiph.com!aioe.org!bofh.it!news.nic.it!robomod
From	Steven Rostedt <rostedt@goodmis.org>
Newsgroups	linux.kernel
Subject	[for-next][PATCH 6/8] tracing: Fix crash from reading trace_pipe with sendfile
Date	Sat, 19 Mar 2016 15:20:01 +0100
Message-ID	<repTr-VC-3@gated-at.bofh.it> (permalink)
References	<repTr-VC-5@gated-at.bofh.it>
X-Original-To	linux-kernel@vger.kernel.org
User-Agent	quilt/0.61-1
MIME-Version	1.0
Content-Type	text/plain; charset=ISO-8859-15
Content-Disposition	inline; filename=0006-tracing-Fix-crash-from-reading-trace_pipe-with-sendf.patch
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	36
Organization	linux.* mail to news gateway
X-Original-Cc	Ingo Molnar <mingo@kernel.org>, Andrew Morton <akpm@linux-foundation.org>, <stable@vger.kernel.org>, Rabin Vincent <rabin.vincent@gmail.com>
X-Original-Date	Sat, 19 Mar 2016 10:15:22 -0400
X-Original-Message-ID	<20160319141536.995426051@goodmis.org>
X-Original-References	<20160319141516.683762867@goodmis.org>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1361113

Show key headers only | View raw

From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

If tracing contains data and the trace_pipe file is read with sendfile(),
then it can trigger a NULL pointer dereference and various BUG_ON within the
VM code.

There's a patch to fix this in the splice_to_pipe() code, but it's also a
good idea to not let that happen from trace_pipe either.

Link: http://lkml.kernel.org/r/1457641146-9068-1-git-send-email-rabin@rab.in

Cc: stable@vger.kernel.org # 2.6.30+
Reported-by: Rabin Vincent <rabin.vincent@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
 kernel/trace/trace.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 0ae46048f724..cb2b708e4ea7 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4954,7 +4954,10 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
 
 	spd.nr_pages = i;
 
-	ret = splice_to_pipe(pipe, &spd);
+	if (i)
+		ret = splice_to_pipe(pipe, &spd);
+	else
+		ret = 0;
 out:
 	splice_shrink_spd(&spd);
 	return ret;
-- 
2.7.0

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[for-next][PATCH 6/8] tracing: Fix crash from reading trace_pipe with sendfile Steven Rostedt <rostedt@goodmis.org> - 2016-03-19 15:20 +0100

csiph-web