Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1455803 > unrolled thread

[PATCH 3/4] tracing: Fix use-after-free in hist_unreg_all/hist_enable_unreg_all

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH 3/4] tracing: Fix use-after-free in hist_unreg_all/hist_enable_unreg_all Steven Rostedt <rostedt@goodmis.org> - 2016-08-03 16:00 +0200
    Re: [PATCH 3/4] tracing: Fix use-after-free in hist_unreg_all/hist_enable_unreg_all Dmitry Vyukov <dvyukov@google.com> - 2016-08-03 16:30 +0200
      Re: [PATCH 3/4] tracing: Fix use-after-free in  hist_unreg_all/hist_enable_unreg_all Steven Rostedt <rostedt@goodmis.org> - 2016-08-03 17:50 +0200

#1455803 — [PATCH 3/4] tracing: Fix use-after-free in hist_unreg_all/hist_enable_unreg_all

From: Steven Rostedt <rostedt@goodmis.org>

While running tools/testing/selftests test suite with KASAN, Dmitry
Vyukov hit the following use-after-free report:

  ==================================================================
  BUG: KASAN: use-after-free in hist_unreg_all+0x1a1/0x1d0 at addr
  ffff880031632cc0
  Read of size 8 by task ftracetest/7413
  ==================================================================
  BUG kmalloc-128 (Not tainted): kasan: bad access detected
  ------------------------------------------------------------------

This fixes the problem, along with the same problem in
hist_enable_unreg_all().

Link: http://lkml.kernel.org/r/c3d05b79e42555b6e36a3a99aae0e37315ee5304.1467247517.git.tom.zanussi@linux.intel.com

Cc: Dmitry Vyukov <dvyukov@google.com>
[Copied Steve's hist_enable_unreg_all() fix to hist_unreg_all()]
Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
 kernel/trace/trace_events_hist.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 0c05b8a99806..19ae135120a3 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -1500,9 +1500,9 @@ static void hist_unregister_trigger(char *glob, struct event_trigger_ops *ops,
 
 static void hist_unreg_all(struct trace_event_file *file)
 {
-	struct event_trigger_data *test;
+	struct event_trigger_data *test, *n;
 
-	list_for_each_entry_rcu(test, &file->triggers, list) {
+	list_for_each_entry_safe(test, n, &file->triggers, list) {
 		if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
 			list_del_rcu(&test->list);
 			trace_event_trigger_enable_disable(file, 0);
@@ -1699,9 +1699,9 @@ hist_enable_get_trigger_ops(char *cmd, char *param)
 
 static void hist_enable_unreg_all(struct trace_event_file *file)
 {
-	struct event_trigger_data *test;
+	struct event_trigger_data *test, *n;
 
-	list_for_each_entry_rcu(test, &file->triggers, list) {
+	list_for_each_entry_safe(test, n, &file->triggers, list) {
 		if (test->cmd_ops->trigger_type == ETT_HIST_ENABLE) {
 			list_del_rcu(&test->list);
 			update_cond_flag(file);
-- 
2.8.1

[toc] | [next] | [standalone]

#1455826

On Wed, Aug 3, 2016 at 3:54 PM, Steven Rostedt <rostedt@goodmis.org> wrote:
> From: Steven Rostedt <rostedt@goodmis.org>
>
> While running tools/testing/selftests test suite with KASAN, Dmitry
> Vyukov hit the following use-after-free report:
>
>   ==================================================================
>   BUG: KASAN: use-after-free in hist_unreg_all+0x1a1/0x1d0 at addr
>   ffff880031632cc0
>   Read of size 8 by task ftracetest/7413
>   ==================================================================
>   BUG kmalloc-128 (Not tainted): kasan: bad access detected
>   ------------------------------------------------------------------
>
> This fixes the problem, along with the same problem in
> hist_enable_unreg_all().
>
> Link: http://lkml.kernel.org/r/c3d05b79e42555b6e36a3a99aae0e37315ee5304.1467247517.git.tom.zanussi@linux.intel.com
>
> Cc: Dmitry Vyukov <dvyukov@google.com>

s/Cc/Reported-by/ please

> [Copied Steve's hist_enable_unreg_all() fix to hist_unreg_all()]
> Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
> ---
>  kernel/trace/trace_events_hist.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> index 0c05b8a99806..19ae135120a3 100644
> --- a/kernel/trace/trace_events_hist.c
> +++ b/kernel/trace/trace_events_hist.c
> @@ -1500,9 +1500,9 @@ static void hist_unregister_trigger(char *glob, struct event_trigger_ops *ops,
>
>  static void hist_unreg_all(struct trace_event_file *file)
>  {
> -       struct event_trigger_data *test;
> +       struct event_trigger_data *test, *n;
>
> -       list_for_each_entry_rcu(test, &file->triggers, list) {
> +       list_for_each_entry_safe(test, n, &file->triggers, list) {
>                 if (test->cmd_ops->trigger_type == ETT_EVENT_HIST) {
>                         list_del_rcu(&test->list);
>                         trace_event_trigger_enable_disable(file, 0);
> @@ -1699,9 +1699,9 @@ hist_enable_get_trigger_ops(char *cmd, char *param)
>
>  static void hist_enable_unreg_all(struct trace_event_file *file)
>  {
> -       struct event_trigger_data *test;
> +       struct event_trigger_data *test, *n;
>
> -       list_for_each_entry_rcu(test, &file->triggers, list) {
> +       list_for_each_entry_safe(test, n, &file->triggers, list) {
>                 if (test->cmd_ops->trigger_type == ETT_HIST_ENABLE) {
>                         list_del_rcu(&test->list);
>                         update_cond_flag(file);
> --
> 2.8.1
>
>

[toc] | [prev] | [next] | [standalone]

#1455871 — Re: [PATCH 3/4] tracing: Fix use-after-free in hist_unreg_all/hist_enable_unreg_all

On Wed, 3 Aug 2016 16:19:53 +0200
Dmitry Vyukov <dvyukov@google.com> wrote:

> On Wed, Aug 3, 2016 at 3:54 PM, Steven Rostedt <rostedt@goodmis.org> wrote:
> > From: Steven Rostedt <rostedt@goodmis.org>
> >
> > While running tools/testing/selftests test suite with KASAN, Dmitry
> > Vyukov hit the following use-after-free report:
> >
> >   ==================================================================
> >   BUG: KASAN: use-after-free in hist_unreg_all+0x1a1/0x1d0 at addr
> >   ffff880031632cc0
> >   Read of size 8 by task ftracetest/7413
> >   ==================================================================
> >   BUG kmalloc-128 (Not tainted): kasan: bad access detected
> >   ------------------------------------------------------------------
> >
> > This fixes the problem, along with the same problem in
> > hist_enable_unreg_all().
> >
> > Link: http://lkml.kernel.org/r/c3d05b79e42555b6e36a3a99aae0e37315ee5304.1467247517.git.tom.zanussi@linux.intel.com
> >
> > Cc: Dmitry Vyukov <dvyukov@google.com>  
> 
> s/Cc/Reported-by/ please
> 

Wish you posted that back when this was posted (see Link above).
Because now it's in my git tree and tagged for Linus to pull. Too much
work to rebase for a tag change :-/


-- Steve

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web