linux-kernel - Re: uprobe: checking probe event include directory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACV3sbKBsj288s=2FKKM+zuoga7Jy9QOxgzciTwREFVHLgR=Lw@mail.gmail.com>
Date:	Wed, 18 Jul 2012 10:36:28 +0800
From:	Jovi Zhang <bookjovi@...il.com>
To:	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>
Cc:	Frederic Weisbecker <fweisbec@...il.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Ingo Molnar <mingo@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: uprobe: checking probe event include directory

On Wed, Jul 18, 2012 at 1:27 AM, Srikar Dronamraju
<srikar@...ux.vnet.ibm.com> wrote:
> * Frederic Weisbecker <fweisbec@...il.com> [2012-07-17 12:59:39]:
>
>> On Tue, Jul 17, 2012 at 06:12:28PM +0800, Jovi Zhang wrote:
>> > From 16ed13ee9098ae01705e8456005d1ad6d9909128 Mon Sep 17 00:00:00 2001
>> > From: Jovi Zhang <bookjovi@...il.com>
>> > Date: Wed, 18 Jul 2012 01:16:23 +0800
>> > Subject: [PATCH] uprobe: checking probe event include directory
>> >
>> > Currently below command run successful:
>> > $ echo 'p /bin:0x4245c0' > /sys/kernel/debug/tracing/uprobe_events
>
> good catch.
>
>> >
>> > this don't make sense, because /bin is a directory,
>> > so make this checking earily, not report error untill probe enable.
>> >
>> > Signed-off-by: Jovi Zhang <bookjovi@...il.com>
>>
>> Adding Srikar in Cc.
>>
>> > ---
>> >  kernel/trace/trace_uprobe.c |    5 +++++
>> >  1 file changed, 5 insertions(+)
>> >
>> > diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
>> > index 85158fa..cf382de 100644
>> > --- a/kernel/trace/trace_uprobe.c
>> > +++ b/kernel/trace/trace_uprobe.c
>> > @@ -259,6 +259,11 @@ static int create_trace_uprobe(int argc, char **argv)
>> >             goto fail_address_parse;
>> >
>> >     inode = igrab(path.dentry->d_inode);
>> > +    if (S_ISDIR(inode->i_mode)) {
>
> How about checking for regular files but not directory.
> i.e it should avoid tracing special files
>
> Something like:
>
>         if (!S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)) {
>
>> > +           ret = -EINVAL;
>> > +           pr_info("probe file cannot be directory.\n");
>
> we could drop the pr_info line here, since we would any print we
> failed to parse the address.
>
> Probably you could change the last pr_info from
>
> pr_info("Failed to parse address.\n");
>
> to
>
> pr_info("Failed to parse address or file.\n");
>
>

Thanks srikar, try below patch:

>From dd37d3cc563e2619ec325d6c11d769a32def411b Mon Sep 17 00:00:00 2001
From: Jovi Zhang <bookjovi@...il.com>
Date: Wed, 18 Jul 2012 18:16:44 +0800
Subject: [PATCH] uprobe: checking uprobe event inode valid

Currently below command run successful:
$ echo 'p /bin:0x4245c0' > /sys/kernel/debug/tracing/uprobe_events

this don't make sense, because /bin is a directory,
we need to check uprobe event inode valid more earily.

Signed-off-by: Jovi Zhang <bookjovi@...il.com>
Reviewed-by: Srikar Dronamraju <srikar@...ux.vnet.ibm.com>
---
 kernel/trace/trace_uprobe.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 85158fa..3b5f646 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -259,6 +259,10 @@ static int create_trace_uprobe(int argc, char **argv)
 		goto fail_address_parse;

 	inode = igrab(path.dentry->d_inode);
+	 if (!S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)) {
+		ret = -EINVAL;
+		goto fail_address_parse;
+	}

 	argc -= 2;
 	argv += 2;
@@ -358,7 +362,7 @@ fail_address_parse:
 	if (inode)
 		iput(inode);

-	pr_info("Failed to parse address.\n");
+	pr_info("Failed to parse address or file.\n");

 	return ret;
 }
-- 
1.7.9.7
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/