Skip to content

Commit

Permalink
tracing/filters: NIL-terminate user input filter
Browse files Browse the repository at this point in the history
Make sure messages from user space are NIL-terminated strings,
otherwise we could dump random memory while reading filter file.

Try this:
 # echo 'parent_comm ==' > events/sched/sched_process_fork/filter
 # cat events/sched/sched_process_fork/filter
 parent_comm == �

Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Tom Zanussi <tzanussi@gmail.com>
Acked-by: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
LKML-Reference: <49E04C32.6060508@cn.fujitsu.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
  • Loading branch information
Li Zefan authored and Ingo Molnar committed Apr 12, 2009
1 parent 0462b56 commit 8433a40
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions kernel/trace/trace_events.c
Original file line number Diff line number Diff line change
Expand Up @@ -503,6 +503,7 @@ event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt,

if (copy_from_user(&buf, ubuf, cnt))
return -EFAULT;
buf[cnt] = '\0';

pred = kzalloc(sizeof(*pred), GFP_KERNEL);
if (!pred)
Expand Down Expand Up @@ -569,6 +570,7 @@ subsystem_filter_write(struct file *filp, const char __user *ubuf, size_t cnt,

if (copy_from_user(&buf, ubuf, cnt))
return -EFAULT;
buf[cnt] = '\0';

pred = kzalloc(sizeof(*pred), GFP_KERNEL);
if (!pred)
Expand Down

0 comments on commit 8433a40

Please sign in to comment.