Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754165Ab3JNI3Q (ORCPT ); Mon, 14 Oct 2013 04:29:16 -0400 Received: from mail-ie0-f173.google.com ([209.85.223.173]:63838 "EHLO mail-ie0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753370Ab3JNI3O (ORCPT ); Mon, 14 Oct 2013 04:29:14 -0400 MIME-Version: 1.0 In-Reply-To: <20131009222323.04fd1a0d@gandalf.local.home> References: <20131002185723.GA32614@redhat.com> <1380745082.12351.6.camel@pippen.local.home> <20131002223437.GA15728@redhat.com> <20131009222323.04fd1a0d@gandalf.local.home> Date: Mon, 14 Oct 2013 12:29:13 +0400 Message-ID: Subject: Re: Potential out-of-bounds in ftrace_regex_release From: Andrey Konovalov To: Steven Rostedt Cc: Dave Jones , linux-kernel@vger.kernel.org, =?ISO-8859-1?Q?Fr=E9d=E9ric_Weisbecker?= , mingo@redhat.com, Dmitry Vyukov , Kostya Serebryany Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1812 Lines: 48 Testing now with your patch. I've seen this report only twice, so it will be difficult to say if it's not happening any more or just not triggered. On Thu, Oct 10, 2013 at 6:23 AM, Steven Rostedt wrote: > On Wed, 9 Oct 2013 14:05:26 +0400 > Andrey Konovalov wrote: > >> So I still think that the bug is in 'trage_get_user()': >> Checking that 'parser->idx < parser->size - 1' is not performed in 'if >> (isspace(ch))' section, so 'parser->idx' becomes equal to >> 'parser->size' after 'parser->buffer[parser->idx++] = ch;'. >> (However in 'while (cnt && !isspace(ch))' loop checking is performed.) > > Yep, you are correct. I put in some printk's and did same writing to > the set_events file and was able to prove that I could get that "0" > written into the +1 overflow boundary. > > Can you try this patch to see if it fixes it for you. > > Thanks, > > -- Steve > > diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c > index d5f7c4d..063a92b 100644 > --- a/kernel/trace/trace.c > +++ b/kernel/trace/trace.c > @@ -843,9 +843,12 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf, > if (isspace(ch)) { > parser->buffer[parser->idx] = 0; > parser->cont = false; > - } else { > + } else if (parser->idx < parser->size - 1) { > parser->cont = true; > parser->buffer[parser->idx++] = ch; > + } else { > + ret = -EINVAL; > + goto out; > } > > *ppos += read; > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/