linux-kernel - Re: [RFC] apparent bogosity in unregister_ftrace_function_probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 6 Feb 2018 11:26:14 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Al Viro <viro@...IV.linux.org.uk>,
        Dmitry Safonov <0x7f454c46@...il.com>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [RFC] apparent bogosity in
 unregister_ftrace_function_probe_func()

On Mon, 5 Feb 2018 17:54:33 -0500
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Mon, 29 Jan 2018 22:59:42 +0900
> Masami Hiramatsu <mhiramat@...nel.org> wrote:
> 
> > On Sat, 27 Jan 2018 17:07:48 +0000
> > Al Viro <viro@...IV.linux.org.uk> wrote:
> > 
> > > On Sat, Jan 27, 2018 at 01:59:56PM +0000, Dmitry Safonov wrote:  
> > > >   
> > > > > Incidentally, shouldn't filter_parse_regex("*[ab]", 5, &s, &not)
> > > > > end up with s = "*[ab]"?  We are returning MATCH_GLOB, after all,
> > > > > so we want the entire pattern there...  I would've assumed that
> > > > > this is what the code in unregister_ftrace_function_probe_func()
> > > > > is trying to compensate for, the first oddity predates MATCH_GLOB...  
> > > > 
> > > > No, I don't think filter_parse_regex() should return the full regex..
> > > > ftrace_match() expects search would be processed string, not a glob.
> > > > So, this unnecessary assignment broke unregistering multiple kprobs
> > > > with a middle/end pattern..  
> > > 
> > > For substring - sure, but what about something like "*a*b" and "a*b"?
> > > AFAICS, filter_parse_regex() ends up with identical results in both
> > > cases - MATCH_GLOB and *search = "a*b".  And no way for the caller
> > > to tell one from another.
> > > 
> > > IOW, it's a different bug sometimes obscured by the one in
> > > unregister_ftrace_function_probe_func().  filter_parse_regex()
> > > ought to revert to *search = buff; when it decides to return
> > > MATCH_GLOB.  Or something like
> > >         for (i = 0; i < len; i++) {
> > >                 if (buff[i] == '*') {
> > >                         if (!i) {
> > >                                 type = MATCH_END_ONLY;
> > >                         } else if (i == len - 1) {
> > >                                 if (type == MATCH_END_ONLY)
> > >                                         type = MATCH_MIDDLE_ONLY;
> > >                                 else
> > >                                         type = MATCH_FRONT_ONLY;
> > >                                 buff[i] = 0;
> > >                                 break;
> > >                         } else {        /* pattern continues, use full glob */
> > >                                 return MATCH_GLOB;
> > >                         }
> > >                 } else if (strchr("[?\\", buff[i])) {
> > >                         return MATCH_GLOB;
> > >                 }
> > >         }
> > >         if (buff[0] == '*')
> > >                 *search = buff + 1;
> > > for that matter - i.e. delay that "we want everything past the first character"
> > > until we are certain it's not a MATCH_GLOB.  
> > 
> > Looks nice to me!
> > 
> 
> I'll implement this code giving Al credit and referencing this email
> thread. Anyone have objections to that?

No, that code looks good to me. :)

BTW, did you also remove "search = buff;" line in 
unregister_ftrace_function_probe_func() too?

Thanks!


-- 
Masami Hiramatsu <mhiramat@...nel.org>