lkml.org 
[lkml]   [2015]   [Jul]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.19.y-ckt 171/251] tracing/filter: Do not allow infix to exceed end of string
    Date
    3.19.8-ckt4 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

    commit 6b88f44e161b9ee2a803e5b2b1fbcf4e20e8b980 upstream.

    While debugging a WARN_ON() for filtering, I found that it is possible
    for the filter string to be referenced after its end. With the filter:

    # echo '>' > /sys/kernel/debug/events/ext4/ext4_truncate_exit/filter

    The filter_parse() function can call infix_get_op() which calls
    infix_advance() that updates the infix filter pointers for the cnt
    and tail without checking if the filter is already at the end, which
    will put the cnt to zero and the tail beyond the end. The loop then calls
    infix_next() that has

    ps->infix.cnt--;
    return ps->infix.string[ps->infix.tail++];

    The cnt will now be below zero, and the tail that is returned is
    already passed the end of the filter string. So far the allocation
    of the filter string usually has some buffer that is zeroed out, but
    if the filter string is of the exact size of the allocated buffer
    there's no guarantee that the charater after the nul terminating
    character will be zero.

    Luckily, only root can write to the filter.

    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    kernel/trace/trace_events_filter.c | 6 ++++++
    1 file changed, 6 insertions(+)

    diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
    index 2900d77..52adf02 100644
    --- a/kernel/trace/trace_events_filter.c
    +++ b/kernel/trace/trace_events_filter.c
    @@ -1056,6 +1056,9 @@ static void parse_init(struct filter_parse_state *ps,

    static char infix_next(struct filter_parse_state *ps)
    {
    + if (!ps->infix.cnt)
    + return 0;
    +
    ps->infix.cnt--;

    return ps->infix.string[ps->infix.tail++];
    @@ -1071,6 +1074,9 @@ static char infix_peek(struct filter_parse_state *ps)

    static void infix_advance(struct filter_parse_state *ps)
    {
    + if (!ps->infix.cnt)
    + return;
    +
    ps->infix.cnt--;
    ps->infix.tail++;
    }
    --
    1.9.1


    \
     
     \ /
      Last update: 2015-07-16 04:01    [W:4.034 / U:0.560 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site