linux-kernel - [tip:tracing/blktrace-v2] blktrace: NUL-terminate user space messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 3 Apr 2009 12:51:30 GMT
From:	Carl Henrik Lunde <chlunde@...g.uio.no>
To:	linux-tip-commits@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, acme@...hat.com, hpa@...or.com,
	mingo@...hat.com, lizf@...fujitsu.com, alan.brunelle@...com,
	chlunde@...g.uio.no, rostedt@...dmis.org, tglx@...utronix.de,
	mingo@...e.hu
Subject: [tip:tracing/blktrace-v2] blktrace: NUL-terminate user space messages

Commit-ID:  a4b3ada83d06554d307dd54abdc62b2e5648264a
Gitweb:     http://git.kernel.org/tip/a4b3ada83d06554d307dd54abdc62b2e5648264a
Author:     Carl Henrik Lunde <chlunde@...g.uio.no>
AuthorDate: Fri, 3 Apr 2009 14:27:15 +0200
Committer:  Ingo Molnar <mingo@...e.hu>
CommitDate: Fri, 3 Apr 2009 14:46:22 +0200

blktrace: NUL-terminate user space messages

Impact: fix corrupted blkparse output

Make sure messages from user space are NUL-terminated strings,
otherwise we could dump random memory to the block trace file.

Additionally, I've limited the message to BLK_TN_MAX_MSG-1
characters, because the last character would be stripped by
vscnprintf anyway.

Signed-off-by: Carl Henrik Lunde <chlunde@...g.uio.no>
Cc: Li Zefan <lizf@...fujitsu.com>
Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
Cc: "Alan D. Brunelle" <alan.brunelle@...com>
Cc: Steven Rostedt <rostedt@...dmis.org>
LKML-Reference: <20090403122714.GT5178@...nel.dk>
Signed-off-by: Ingo Molnar <mingo@...e.hu>


---
 kernel/trace/blktrace.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 947c5b3..a400b86 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -327,10 +327,10 @@ static ssize_t blk_msg_write(struct file *filp, const char __user *buffer,
 	char *msg;
 	struct blk_trace *bt;
 
-	if (count > BLK_TN_MAX_MSG)
+	if (count > BLK_TN_MAX_MSG - 1)
 		return -EINVAL;
 
-	msg = kmalloc(count, GFP_KERNEL);
+	msg = kmalloc(count + 1, GFP_KERNEL);
 	if (msg == NULL)
 		return -ENOMEM;
 
@@ -339,6 +339,7 @@ static ssize_t blk_msg_write(struct file *filp, const char __user *buffer,
 		return -EFAULT;
 	}
 
+	msg[count] = '\0';
 	bt = filp->private_data;
 	__trace_note_message(bt, "%s", msg);
 	kfree(msg);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/