linux-kernel - [GIT PULL] tracing: probeevent: Correctly update remaining space in dynamic area

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 12 Feb 2019 21:07:45 -0500
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Andreas Ziegler <andreas.ziegler@....de>
Subject: [GIT PULL] tracing: probeevent: Correctly update remaining space in
 dynamic area


Linus,

This fixes kprobes/uprobes dynamic processing of strings, where
it processes the args but does not update the remaining length
of the buffer that the string arguments will be placed in. It
constantly passes in the total size of buffer used instead of
passing in the remaining size of the buffer used. This could cause
issues if the strings are larger than the max size of an event
which could cause the strings to be written beyond what was reserved
on the buffer.


Please pull the latest trace-v5.0-rc4 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
trace-v5.0-rc4

Tag SHA1: 2ed4d789cd16de14657339cec2bbeb5ce3cc192f
Head SHA1: f6675872db57305fa957021efc788f9983ed3b67


Andreas Ziegler (1):
      tracing: probeevent: Correctly update remaining space in dynamic area

----
 kernel/trace/trace_probe_tmpl.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
---------------------------
commit f6675872db57305fa957021efc788f9983ed3b67
Author: Andreas Ziegler <andreas.ziegler@....de>
Date:   Wed Feb 6 20:00:13 2019 +0100

    tracing: probeevent: Correctly update remaining space in dynamic area
    
    Commit 9178412ddf5a ("tracing: probeevent: Return consumed
    bytes of dynamic area") improved the string fetching
    mechanism by returning the number of required bytes after
    copying the argument to the dynamic area. However, this
    return value is now only used to increment the pointer
    inside the dynamic area but misses updating the 'maxlen'
    variable which indicates the remaining space in the dynamic
    area.
    
    This means that fetch_store_string() always reads the *total*
    size of the dynamic area from the data_loc pointer instead of
    the *remaining* size (and passes it along to
    strncpy_from_{user,unsafe}) even if we're already about to
    copy data into the middle of the dynamic area.
    
    Link: http://lkml.kernel.org/r/20190206190013.16405-1-andreas.ziegler@fau.de
    
    Cc: Ingo Molnar <mingo@...hat.com>
    Cc: stable@...r.kernel.org
    Fixes: 9178412ddf5a ("tracing: probeevent: Return consumed bytes of dynamic area")
    Acked-by: Masami Hiramatsu <mhiramat@...nel.org>
    Signed-off-by: Andreas Ziegler <andreas.ziegler@....de>
    Signed-off-by: Steven Rostedt (VMware) <rostedt@...dmis.org>

diff --git a/kernel/trace/trace_probe_tmpl.h b/kernel/trace/trace_probe_tmpl.h
index 5c56afc17cf8..4737bb8c07a3 100644
--- a/kernel/trace/trace_probe_tmpl.h
+++ b/kernel/trace/trace_probe_tmpl.h
@@ -180,10 +180,12 @@ store_trace_args(void *data, struct trace_probe *tp, struct pt_regs *regs,
 		if (unlikely(arg->dynamic))
 			*dl = make_data_loc(maxlen, dyndata - base);
 		ret = process_fetch_insn(arg->code, regs, dl, base);
-		if (unlikely(ret < 0 && arg->dynamic))
+		if (unlikely(ret < 0 && arg->dynamic)) {
 			*dl = make_data_loc(0, dyndata - base);
-		else
+		} else {
 			dyndata += ret;
+			maxlen -= ret;
+		}
 	}
 }