mirror/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
8b05a3a7503c2a982c9c462eae96cfbd59506783
linux/kernel
History
Andrea Righi 8b05a3a750 tracing/kprobes: Fix NULL pointer dereference in trace_kprobe_create() 
It is possible to trigger a NULL pointer dereference by writing an
incorrectly formatted string to krpobe_events (trying to create a
kretprobe omitting the symbol).

Example:

 echo "r:event_1 " >> /sys/kernel/debug/tracing/kprobe_events

That triggers this:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
 #PF error: [normal kernel read fault]
 PGD 0 P4D 0
 Oops: 0000 [#1] SMP PTI
 CPU: 6 PID: 1757 Comm: bash Not tainted 5.0.0-rc1+ #125
 Hardware name: Dell Inc. XPS 13 9370/0F6P3V, BIOS 1.5.1 08/09/2018
 RIP: 0010:kstrtoull+0x2/0x20
 Code: 28 00 00 00 75 17 48 83 c4 18 5b 41 5c 5d c3 b8 ea ff ff ff eb e1 b8 de ff ff ff eb da e8 d6 36 bb ff 66 0f 1f 44 00 00 31 c0 <80> 3f 2b 55 48 89 e5 0f 94 c0 48 01 c7 e8 5c ff ff ff 5d c3 66 2e
 RSP: 0018:ffffb5d482e57cb8 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff82b12720
 RDX: ffffb5d482e57cf8 RSI: 0000000000000000 RDI: 0000000000000000
 RBP: ffffb5d482e57d70 R08: ffffa0c05e5a7080 R09: ffffa0c05e003980
 R10: 0000000000000000 R11: 0000000040000000 R12: ffffa0c04fe87b08
 R13: 0000000000000001 R14: 000000000000000b R15: ffffa0c058d749e1
 FS:  00007f137c7f7740(0000) GS:ffffa0c05e580000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000000 CR3: 0000000497d46004 CR4: 00000000003606e0
 Call Trace:
  ? trace_kprobe_create+0xb6/0x840
  ? _cond_resched+0x19/0x40
  ? _cond_resched+0x19/0x40
  ? __kmalloc+0x62/0x210
  ? argv_split+0x8f/0x140
  ? trace_kprobe_create+0x840/0x840
  ? trace_kprobe_create+0x840/0x840
  create_or_delete_trace_kprobe+0x11/0x30
  trace_run_command+0x50/0x90
  trace_parse_run_command+0xc1/0x160
  probes_write+0x10/0x20
  __vfs_write+0x3a/0x1b0
  ? apparmor_file_permission+0x1a/0x20
  ? security_file_permission+0x31/0xf0
  ? _cond_resched+0x19/0x40
  vfs_write+0xb1/0x1a0
  ksys_write+0x55/0xc0
  __x64_sys_write+0x1a/0x20
  do_syscall_64+0x5a/0x120
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fix by doing the proper argument checks in trace_kprobe_create().

Cc: Ingo Molnar <mingo@redhat.com>
Link: https://lore.kernel.org/lkml/20190111095108.b79a2ee026185cbd62365977@kernel.org
Link: http://lkml.kernel.org/r/20190111060113.GA22841@xps-13
Fixes: 6212dd2968 ("tracing/kprobes: Use dyn_event framework for kprobe events")
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Andrea Righi <righi.andrea@gmail.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2019-01-15 11:33:45 -05:00
..
bpf
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
cgroup
Merge branch 'for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2018-12-29 10:57:20 -08:00
configs
kvm_config: add CONFIG_VIRTIO_MENU
2018-10-24 20:55:56 -04:00
debug
kdb: use bool for binary state indicators
2018-12-30 08:31:52 +00:00
dma
dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING for remapped allocations
2019-01-05 08:28:29 +01:00
events
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
gcov
…
irq
genirq/affinity: Add is_managed to struct irq_affinity_desc
2018-12-19 11:32:08 +01:00
livepatch
livepatch: Replace synchronize_sched() with synchronize_rcu()
2018-12-01 12:38:50 -08:00
locking
kernel/locking/mutex.c: remove caller signal_pending branch predictions
2019-01-04 13:13:48 -08:00
power
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
printk
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
rcu
rcutorture: Don't do busted forward-progress testing
2018-12-01 12:45:42 -08:00
sched
jump_label: move 'asm goto' support test to Kconfig
2019-01-06 09:46:51 +09:00
time
Merge tag 'y2038-for-4.21' of ssh://gitolite.kernel.org:/pub/scm/linux/kernel/git/arnd/playground
2018-12-28 12:45:04 -08:00
trace
tracing/kprobes: Fix NULL pointer dereference in trace_kprobe_create()
2019-01-15 11:33:45 -05:00
.gitignore
…
acct.c
…
async.c
…
audit_fsnotify.c
audit: minimize our use of audit_log_format()
2018-11-26 18:40:00 -05:00
audit_tree.c
audit: minimize our use of audit_log_format()
2018-11-26 18:40:00 -05:00
audit_watch.c
audit: minimize our use of audit_log_format()
2018-11-26 18:40:00 -05:00
audit.c
audit: remove duplicated include from audit.c
2018-12-14 12:09:30 -05:00
audit.h
audit: use current whenever possible
2018-11-26 18:41:21 -05:00
auditfilter.c
…
auditsc.c
audit: use current whenever possible
2018-11-26 18:41:21 -05:00
backtracetest.c
…
bounds.c
kbuild: fix kernel/bounds.c 'W=1' warning
2018-10-31 08:54:14 -07:00
capability.c
…
compat.c
make 'user_access_begin()' do 'access_ok()'
2019-01-04 12:56:09 -08:00
configs.c
…
context_tracking.c
…
cpu_pm.c
…
cpu.c
x86/speculation: Rework SMT state change
2018-11-28 11:57:07 +01:00
crash_core.c
kernel/crash_core.c: print timestamp using time64_t
2018-08-22 10:52:47 -07:00
crash_dump.c
…
cred.c
cred: export get_task_cred().
2018-12-19 13:52:44 -05:00
delayacct.c
delayacct: track delays from thrashing cache pages
2018-10-26 16:26:32 -07:00
dma.c
…
elfcore.c
…
exec_domain.c
…
exit.c
make 'user_access_begin()' do 'access_ok()'
2019-01-04 12:56:09 -08:00
extable.c
…
fail_function.c
kernel/fail_function.c: remove meaningless null pointer check before debugfs_remove_recursive
2018-10-31 08:54:12 -07:00
fork.c
fork: fix some -Wmissing-prototypes warnings
2019-01-04 13:13:47 -08:00
freezer.c
PM / reboot: Eliminate race between reboot and suspend
2018-08-06 12:35:20 +02:00
futex.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
groups.c
…
hung_task.c
kernel/hung_task.c: break RCU locks based on jiffies
2019-01-04 13:13:45 -08:00
iomem.c
…
irq_work.c
…
jump_label.c
jump_label: move 'asm goto' support test to Kconfig
2019-01-06 09:46:51 +09:00
kallsyms.c
kallsyms: reduce size a little on 64-bit
2018-09-10 22:54:33 +09:00
kcmp.c
…
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.locks
…
Kconfig.preempt
kconfig: warn no new line at end of file
2018-12-15 17:44:35 +09:00
kcov.c
kernel/kcov.c: mark write_comp_data() as notrace
2019-01-04 13:13:47 -08:00
kexec_core.c
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
kexec_file.c
kexec_file: kexec_walk_memblock() only walks a dedicated region at kdump
2018-12-06 14:38:50 +00:00
kexec_internal.h
…
kexec.c
kexec: add call to LSM hook in original kexec_load syscall
2018-07-16 12:31:57 -07:00
kmod.c
…
kprobes.c
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-12-26 14:45:18 -08:00
ksysfs.c
…
kthread.c
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
latencytop.c
…
Makefile
kbuild: change filechk to surround the given command with { }
2019-01-06 09:46:51 +09:00
memremap.c
mm/hmm: fix memremap.h, move dev_page_fault_t callback to hmm
2018-12-28 12:11:52 -08:00
module_signing.c
modsign: use all trusted keys to verify module signature
2018-11-07 14:41:41 +01:00
module-internal.h
modsign: log module name in the event of an error
2018-07-02 11:36:17 +02:00
module.c
jump_label: move 'asm goto' support test to Kconfig
2019-01-06 09:46:51 +09:00
notifier.c
…
nsproxy.c
…
padata.c
padata: clean an indentation issue, remove extraneous space
2018-11-16 14:11:04 +08:00
panic.c
kernel/sysctl: add panic_print into sysctl
2019-01-04 13:13:47 -08:00
params.c
…
pid_namespace.c
signal: Use group_send_sig_info to kill all processes in a pid namespace
2018-09-16 16:08:25 +02:00
pid.c
Fix failure path in alloc_pid()
2018-12-28 12:42:30 -08:00
profile.c
mm: remove include/linux/bootmem.h
2018-10-31 08:54:16 -07:00
ptrace.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
range.c
…
reboot.c
kernel/reboot.c: export pm_power_off_prepare
2018-09-11 16:13:24 +01:00
relay.c
…
resource.c
kernel, resource: check for IORESOURCE_SYSRAM in release_mem_region_adjustable
2018-12-28 12:11:49 -08:00
rseq.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
seccomp.c
seccomp: fix poor type promotion
2018-12-13 16:49:01 -08:00
signal.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
smp.c
smp,cpumask: introduce on_each_cpu_cond_mask
2018-10-09 16:51:11 +02:00
smpboot.c
smpboot: Remove cpumask from the API
2018-07-03 09:20:44 +02:00
smpboot.h
…
softirq.c
Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-10-25 11:43:47 -07:00
stackleak.c
stackleak: Mark stackleak_track_stack() as notrace
2018-12-05 19:31:44 -08:00
stacktrace.c
…
stop_machine.c
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
sys_ni.c
y2038: socket: Add compat_sys_recvmmsg_time64
2018-12-18 16:13:04 +01:00
sys.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
sysctl_binary.c
kernel/sysctl: add panic_print into sysctl
2019-01-04 13:13:47 -08:00
sysctl.c
kernel/sysctl: add panic_print into sysctl
2019-01-04 13:13:47 -08:00
task_work.c
…
taskstats.c
…
test_kprobes.c
…
torture.c
torture: Remove unnecessary "ret" variables
2018-12-01 12:45:35 -08:00
tracepoint.c
tracing: Replace synchronize_sched() and call_rcu_sched()
2018-11-27 09:21:41 -08:00
tsacct.c
…
ucount.c
…
uid16.c
…
uid16.h
…
umh.c
umh: Add command line to user mode helpers
2018-10-22 19:37:36 -07:00
up.c
smp,cpumask: introduce on_each_cpu_cond_mask
2018-10-09 16:51:11 +02:00
user_namespace.c
userns: also map extents in the reverse map to kernel IDs
2018-11-07 23:51:16 -06:00
user-return-notifier.c
…
user.c
userns: use irqsave variant of refcount_dec_and_lock()
2018-08-22 10:52:47 -07:00
utsname_sysctl.c
sys: don't hold uts_sem while accessing userspace memory
2018-08-11 02:05:53 -05:00
utsname.c
…
watchdog_hld.c
watchdog: Mark watchdog touch functions as notrace
2018-08-30 12:56:40 +02:00
watchdog.c
watchdog: Mark watchdog touch functions as notrace
2018-08-30 12:56:40 +02:00
workqueue_internal.h
…
workqueue.c
workqueue: Replace call_rcu_sched() with call_rcu()
2018-11-27 09:21:44 -08:00