linux-kernel - Re: [RFC] apparent bogosity in unregister_ftrace_function_probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180129224944.8d706976e6bcda761905ac0f@kernel.org>
Date:   Mon, 29 Jan 2018 22:49:44 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Al Viro <viro@...IV.linux.org.uk>
Cc:     mhiramat@...nel.org, Steven Rostedt <rostedt@...dmis.org>,
        Dmitry Safonov <0x7f454c46@...il.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [RFC] apparent bogosity in
 unregister_ftrace_function_probe_func()

On Sat, 27 Jan 2018 03:17:06 +0000
Al Viro <viro@...IV.linux.org.uk> wrote:

> It contains something very odd:
> 
>                 func_g.type = filter_parse_regex(glob, strlen(glob),
>                                                  &func_g.search, &not);
>                 func_g.len = strlen(func_g.search);
>                 func_g.search = glob;
> 
>                 /* we do not support '!' for function probes */
>                 if (WARN_ON(not))
>                         return -EINVAL;
> 
> What the hell is the last assignment for?  After that call of
> filter_parse_regex() we could have func_g.search not equal to glob
> only if glob started with '!' or '*'.  In the former case we would've
> buggered off with -EINVAL (not = 1).  In the latter we would've set
> func_g.search equal to glob + 1, calculated the length of that thing
> in func_g.len and proceeded to reset func_g.search back to glob.

Ah, right. It must be a bug! func_g.search should be assigned in
filter_parse_regex(), and it should be "glob" without "!" if
it is MATCH_GLOB. Of course above assignment should be removed.

Thank you,

-- 
Masami Hiramatsu <mhiramat@...nel.org>