linux-kernel - [PATCH 1/2] trace-cmd: Don't try to read unmapped memory (v2).

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 19 Jul 2010 17:46:49 -0700
From:	David Daney <ddaney@...iumnetworks.com>
To:	rostedt@...dmis.org
Cc:	linux-kernel@...r.kernel.org,
	David Daney <ddaney@...iumnetworks.com>
Subject: [PATCH 1/2] trace-cmd: Don't try to read unmapped memory (v2).

Under some circumstances, I'm not sure exactly which, a trace.dat file
may contain a bunch of zeros at the end of one or more of the trace
logs.  This can lead to tracecmd_peek_data() attempting to read past
the end of the mmaped log, causing SIGSEGV.

This is a two part fix.

1) For 'new format' data, we always try to read 8 bytes of data.  Make
sure that they are all on the current page.

2) In pevent_print_event(), if record->size is negative, warn and then
skip attempting to print it.

Signed-off-by: David Daney <ddaney@...iumnetworks.com>
---
 parse-events.c |    5 +++++
 trace-input.c  |    3 ++-
 2 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/parse-events.c b/parse-events.c
index 16fff12..52b68f0 100644
--- a/parse-events.c
+++ b/parse-events.c
@@ -3881,6 +3881,11 @@ void pevent_print_event(struct pevent *pevent, struct trace_seq *s,
 	usecs = record->ts - secs * NSECS_PER_SEC;
 	usecs = (usecs + 500) / NSECS_PER_USEC;
 
+	if (record->size < 0) {
+		do_warning("ug! negative record size %d", record->size);
+		return;
+	}
+
 	type = trace_parse_common_type(pevent, data);
 
 	event = pevent_find_event(pevent, type);
diff --git a/trace-input.c b/trace-input.c
index 398d0f9..7241197 100644
--- a/trace-input.c
+++ b/trace-input.c
@@ -1511,7 +1511,8 @@ read_again:
 	if (index < 0)
 		die("negative index on cpu record %d", cpu);
 
-	if (index >= handle->cpu_data[cpu].page_size + pevent->header_page_data_offset) {
+	if (index + (pevent->old_format ? 0 : 4) >=
+	    handle->cpu_data[cpu].page_size + pevent->header_page_data_offset) {
 		if (get_next_page(handle, cpu))
 			return NULL;
 		return tracecmd_peek_data(handle, cpu);
-- 
1.7.1.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/