linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Steven Rostedt <rostedt@goodmis.org>
To: "Du, Changbin" <changbin.du@intel.com>
Cc: jolsa@redhat.com, peterz@infradead.org, mingo@redhat.com,
	alexander.shishkin@linux.intel.com, linux-kernel@vger.kernel.org,
	linux-perf-users@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH 2/3] tracing: make sure the parsed string always terminates with '\0'
Date: Tue, 9 Jan 2018 23:10:22 -0500	[thread overview]
Message-ID: <20180109231022.5e9ca245@vmware.local.home> (raw)
In-Reply-To: <20180110030206.wciy7y4mvtqoqjz3@intel.com>

On Wed, 10 Jan 2018 11:02:06 +0800
"Du, Changbin" <changbin.du@intel.com> wrote:

> On Tue, Jan 09, 2018 at 06:02:58PM -0500, Steven Rostedt wrote:
> > On Tue,  9 Jan 2018 17:55:47 +0800
> > changbin.du@intel.com wrote:
> >   
> > > From: Changbin Du <changbin.du@intel.com>
> > > 
> > > The parser parse every string into parser.buffer. And some of the callers
> > > assume that parser.buffer contains a C string. So it is dangerous that the
> > > parser returns a unterminated string. The userspace can leverage this to
> > > attack the kernel.  
> > 
> > Is this only a bug if we apply your first patch?
> >  
> I don't think so. Seems it is there already.
>  

OK. I'll have to take a deeper look into this so that I completely
understand the problem and your solution. I'm currently traveling and
may not get to do that this week. Please ping me next week if you don't
hear back from me on this issue.

Thanks!

-- Steve

  reply	other threads:[~2018-01-10  4:10 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-01-09  9:55 [PATCH 0/3] tracing: Fix the parser when processing strings w/ or w/o terminated '\0' changbin.du
2018-01-09  9:55 ` [PATCH 1/3] tracing: detect the string termination character when parsing user input string changbin.du
2018-01-09 22:54   ` Steven Rostedt
2018-01-10  3:01     ` Du, Changbin
2018-01-10  4:09       ` Steven Rostedt
2018-01-09  9:55 ` [PATCH 2/3] tracing: make sure the parsed string always terminates with '\0' changbin.du
2018-01-09 23:02   ` Steven Rostedt
2018-01-10  3:02     ` Du, Changbin
2018-01-10  4:10       ` Steven Rostedt [this message]
2018-01-15 10:49         ` Du, Changbin
2018-01-09  9:55 ` [PATCH 3/3] tracing: don't set parser->cont if it has reached the end of input buffer changbin.du
2018-01-09 23:12   ` Steven Rostedt
2018-01-10  3:18     ` Du, Changbin
2018-01-10  4:19       ` Steven Rostedt
2018-01-12  4:05         ` Du, Changbin
2018-01-12 15:31           ` Steven Rostedt
2018-01-14  5:43             ` Du, Changbin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180109231022.5e9ca245@vmware.local.home \
    --to=rostedt@goodmis.org \
    --cc=alexander.shishkin@linux.intel.com \
    --cc=changbin.du@intel.com \
    --cc=jolsa@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-perf-users@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=peterz@infradead.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).