lkml.org 
[lkml]   [2010]   [Sep]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[046/123] tracing: t_start: reset FTRACE_ITER_HASH in case of seek/pread
    From: Chris Wright <chrisw@sous-sol.org>

    commit df09162550fbb53354f0c88e85b5d0e6129ee9cc upstream.

    Be sure to avoid entering t_show() with FTRACE_ITER_HASH set without
    having properly started the iterator to iterate the hash. This case is
    degenerate and, as discovered by Robert Swiecki, can cause t_hash_show()
    to misuse a pointer. This causes a NULL ptr deref with possible security
    implications. Tracked as CVE-2010-3079.

    Cc: Robert Swiecki <swiecki@google.com>
    Cc: Eugene Teo <eugene@redhat.com>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    kernel/trace/ftrace.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/kernel/trace/ftrace.c
    +++ b/kernel/trace/ftrace.c
    @@ -1480,6 +1480,8 @@ static void *t_start(struct seq_file *m,
    if (*pos > 0)
    return t_hash_start(m, pos);
    iter->flags |= FTRACE_ITER_PRINTALL;
    + /* reset in case of seek/pread */
    + iter->flags &= ~FTRACE_ITER_HASH;
    return iter;
    }




    \
     
     \ /
      Last update: 2010-09-18 21:57    [W:0.020 / U:59.268 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site