lkml.org 
[lkml]   [2018]   [May]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 29/62] tracing: Fix regex_match_front() to not over compare the test string
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Steven Rostedt (VMware) <rostedt@goodmis.org>

    commit dc432c3d7f9bceb3de6f5b44fb9c657c9810ed6d upstream.

    The regex match function regex_match_front() in the tracing filter logic,
    was fixed to test just the pattern length from testing the entire test
    string. That is, it went from strncmp(str, r->pattern, len) to
    strcmp(str, r->pattern, r->len).

    The issue is that str is not guaranteed to be nul terminated, and if r->len
    is greater than the length of str, it can access more memory than is
    allocated.

    The solution is to add a simple test if (len < r->len) return 0.

    Cc: stable@vger.kernel.org
    Fixes: 285caad415f45 ("tracing/filters: Fix MATCH_FRONT_ONLY filter matching")
    Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    kernel/trace/trace_events_filter.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/kernel/trace/trace_events_filter.c
    +++ b/kernel/trace/trace_events_filter.c
    @@ -338,6 +338,9 @@ static int regex_match_full(char *str, s

    static int regex_match_front(char *str, struct regex *r, int len)
    {
    + if (len < r->len)
    + return 0;
    +
    if (strncmp(str, r->pattern, r->len) == 0)
    return 1;
    return 0;

    \
     
     \ /
      Last update: 2018-05-14 09:15    [W:3.635 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site