* [PATCH] libtraceevent: Reset right arg when copying TEP_PRINT_OP
@ 2022-06-06 19:58 Namhyung Kim
2022-06-08 15:17 ` Steven Rostedt
0 siblings, 1 reply; 2+ messages in thread
From: Namhyung Kim @ 2022-06-06 19:58 UTC (permalink / raw)
To: linux-trace-devel; +Cc: Ian Rogers
When processing a TEP_PRINT_OP type arg, the original arg was copied
to the left arg and resets itself. But it misses the reset the right
in some places and it could result in a use-after-free.
A fuzzer test found out that something like below can trigger it
print fmt: "", c * ((3 * t)[
At the time it sees the "[" token, the arg would have like
arg->type = TEP_PRINT_OP
arg->op.op = "*"
arg->op.left = (arg of 3)
arg->op.right = (arg of t)
and it creates a new left and copies the contents. Also it resets
itself with
arg->op.op = "["
arg->op.left = (new left)
But it can have the same arg->op.right if the process_array() fails
before setting it. It should reset the right pointer as it passed the
ownership before. The same thing can happend for process_cond().
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
src/event-parse.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/event-parse.c b/src/event-parse.c
index 8b839cb..8f4fb59 100644
--- a/src/event-parse.c
+++ b/src/event-parse.c
@@ -2317,6 +2317,7 @@ process_op(struct tep_event *event, struct tep_print_arg *arg, char **tok)
arg->type = TEP_PRINT_OP;
arg->op.op = token;
arg->op.left = left;
+ arg->op.right = NULL;
arg->op.prio = 0;
/* it will set arg->op.right */
@@ -2422,6 +2423,7 @@ process_op(struct tep_event *event, struct tep_print_arg *arg, char **tok)
arg->type = TEP_PRINT_OP;
arg->op.op = token;
arg->op.left = left;
+ arg->op.right = NULL;
arg->op.prio = 0;
--
2.36.1.255.ge46751e96f-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] libtraceevent: Reset right arg when copying TEP_PRINT_OP
2022-06-06 19:58 [PATCH] libtraceevent: Reset right arg when copying TEP_PRINT_OP Namhyung Kim
@ 2022-06-08 15:17 ` Steven Rostedt
0 siblings, 0 replies; 2+ messages in thread
From: Steven Rostedt @ 2022-06-08 15:17 UTC (permalink / raw)
To: Namhyung Kim; +Cc: linux-trace-devel, Ian Rogers
On Mon, 6 Jun 2022 12:58:59 -0700
Namhyung Kim <namhyung@kernel.org> wrote:
> When processing a TEP_PRINT_OP type arg, the original arg was copied
> to the left arg and resets itself. But it misses the reset the right
> in some places and it could result in a use-after-free.
>
> A fuzzer test found out that something like below can trigger it
>
> print fmt: "", c * ((3 * t)[
>
> At the time it sees the "[" token, the arg would have like
>
> arg->type = TEP_PRINT_OP
> arg->op.op = "*"
> arg->op.left = (arg of 3)
> arg->op.right = (arg of t)
>
> and it creates a new left and copies the contents. Also it resets
> itself with
>
> arg->op.op = "["
> arg->op.left = (new left)
>
> But it can have the same arg->op.right if the process_array() fails
> before setting it. It should reset the right pointer as it passed the
> ownership before. The same thing can happend for process_cond().
>
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> ---
> src/event-parse.c | 2 ++
> 1 file changed, 2 insertions(+)
Applied. Thanks Namhyung!
-- Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-06-08 15:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-06 19:58 [PATCH] libtraceevent: Reset right arg when copying TEP_PRINT_OP Namhyung Kim
2022-06-08 15:17 ` Steven Rostedt
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.