mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Steven Rostedt <rostedt@goodmis.org>
To: LKML <linux-kernel@vger.kernel.org>
Cc: Ingo Molnar <mingo@elte.hu>, Robert Swiecki <swiecki@google.com>,
	Chris Wright <chrisw@sous-sol.org>,
	Tavis Ormandy <taviso@google.com>, Eugene Teo <eugene@redhat.com>,
	vendor-sec <vendor-sec@lst.de>,
	stable@kernel.org
Subject: [PATCH][GIT PULL][v2.6.36 & stable] tracing: Do not allow llseek to set_ftrace_filter
Date: Wed, 08 Sep 2010 11:53:15 -0400	[thread overview]
Message-ID: <1283961195.5133.140.camel@gandalf.stny.rr.com> (raw)


Ingo,

Please pull the latest tip/perf/urgent tree, which can be found at:

  git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-2.6-trace.git
tip/perf/urgent


root (1):
      tracing: Do not allow llseek to set_ftrace_filter

----
 kernel/trace/ftrace.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
---------------------------
commit 47933d55f8d3652a0319ab1e0c6854fa326f78fa
Author: root <root@ixf.(none)>
Date:   Wed Sep 8 11:20:37 2010 -0400

    tracing: Do not allow llseek to set_ftrace_filter
    
    Reading the file set_ftrace_filter does three things.
    
    1) shows whether or not filters are set for the function tracer
    2) shows what functions are set for the function tracer
    3) shows what triggers are set on any functions
    
    3 is independent from 1 and 2.
    
    The way this file currently works is that it is a state machine,
    and as you read it, it may change state. But this assumption breaks
    when you use lseek() on the file. The state machine gets out of sync
    and the t_show() may use the wrong pointer and cause a kernel oops.
    
    Luckily, this will only kill the app that does the lseek, but the app
    dies while holding a mutex. This prevents anyone else from using the
    set_ftrace_filter file (or any other function tracing file for that matter).
    
    A real fix for this is to rewrite the code, but that is too much for
    a -rc release or stable. This patch simply disables llseek on the
    set_ftrace_filter() file for now, and we can do the proper fix for the
    next major release.
    
    Reported-by: Robert Swiecki <swiecki@google.com>
    Cc: Chris Wright <chrisw@sous-sol.org>
    Cc: Tavis Ormandy <taviso@google.com>
    Cc: Eugene Teo <eugene@redhat.com>
    Cc: vendor-sec@lst.de
    Cc: <stable@kernel.org>
    Signed-off-by: root <root@ixf.(none)>

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 7cb1f45..83a16e9 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -2416,7 +2416,7 @@ static const struct file_operations ftrace_filter_fops = {
 	.open = ftrace_filter_open,
 	.read = seq_read,
 	.write = ftrace_filter_write,
-	.llseek = ftrace_regex_lseek,
+	.llseek = no_llseek,
 	.release = ftrace_filter_release,
 };
 



             reply	other threads:[~2010-09-08 15:53 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-09-08 15:53 Steven Rostedt [this message]
2010-09-08 15:59 ` Ingo Molnar
2010-09-08 15:59 ` Steven Rostedt

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1283961195.5133.140.camel@gandalf.stny.rr.com \
    --to=rostedt@goodmis.org \
    --cc=chrisw@sous-sol.org \
    --cc=eugene@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@elte.hu \
    --cc=stable@kernel.org \
    --cc=swiecki@google.com \
    --cc=taviso@google.com \
    --cc=vendor-sec@lst.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®