From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F343FC77B61 for ; Tue, 25 Apr 2023 14:43:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234263AbjDYOn2 (ORCPT ); Tue, 25 Apr 2023 10:43:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54348 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234175AbjDYOn1 (ORCPT ); Tue, 25 Apr 2023 10:43:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D557B268F; Tue, 25 Apr 2023 07:43:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6FC7162ACA; Tue, 25 Apr 2023 14:43:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8532CC4339B; Tue, 25 Apr 2023 14:43:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1682433805; bh=yu5XudPSm8Hf0iGdr9YVHx9Rr6jvIBiIKYFbeWm+AfE=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=ZDpFkNkusx7+yCfV2AUsN3QqyoViX+tEQObnbdGAVJ0dl3ipPavoOXOl2SVht2wTm +VR3KWEY7C0pygqgKRKDBCiIpQqi4j9lZs9FJIwCbnfJpjZJ/yYOdc+yXqSUbTaGg9 A2B2g2O4CaS7MgcRF9j+V8UP9R6QZJw9eyDYlWOOSehVo//pR2RUmevLrnlWUkuMp0 aAWk+cHuS4R+uHBPdfSeknWy8+ZFV5InzzmQ2fxz5ABs4wojS3eGvihQ6lGTDqbVzt D6EI7pPqPIsbkTm4+K1RK0olVvLAqXTAS4KFj7iOvKkgbUNkM9kmAwNQHWTL7UEVmj GkADSovtsmt5A== Date: Tue, 25 Apr 2023 23:43:22 +0900 From: Masami Hiramatsu (Google) To: Beau Belgrave Cc: rostedt@goodmis.org, mathieu.desnoyers@efficios.com, dcook@linux.microsoft.com, alanau@linux.microsoft.com, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org Subject: Re: [PATCH 1/3] tracing/user_events: Ensure write index cannot be negative Message-Id: <20230425234322.64936672edb26dd2afdb3a55@kernel.org> In-Reply-To: <20230411211709.15018-2-beaub@linux.microsoft.com> References: <20230411211709.15018-1-beaub@linux.microsoft.com> <20230411211709.15018-2-beaub@linux.microsoft.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-trace-kernel@vger.kernel.org On Tue, 11 Apr 2023 14:17:07 -0700 Beau Belgrave wrote: > The write index indicates which event the data is for and accesses a > per-file array. The index is passed by user processes during write() > calls as the first 4 bytes. Ensure that it cannot be negative by > returning -EINVAL to prevent out of bounds accesses. > > Update ftrace self-test to ensure this occurs properly. > > Fixes: 7f5a08c79df3 ("user_events: Add minimal support for trace_event into ftrace") > Reported-by: Doug Cook > Signed-off-by: Beau Belgrave Looks good to me. Acked-by: Masami Hiramatsu (Google) Thanks! > --- > kernel/trace/trace_events_user.c | 3 +++ > tools/testing/selftests/user_events/ftrace_test.c | 5 +++++ > 2 files changed, 8 insertions(+) > > diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c > index cc8c6d8b69b5..e7dff24aa724 100644 > --- a/kernel/trace/trace_events_user.c > +++ b/kernel/trace/trace_events_user.c > @@ -1821,6 +1821,9 @@ static ssize_t user_events_write_core(struct file *file, struct iov_iter *i) > if (unlikely(copy_from_iter(&idx, sizeof(idx), i) != sizeof(idx))) > return -EFAULT; > > + if (idx < 0) > + return -EINVAL; > + > rcu_read_lock_sched(); > > refs = rcu_dereference_sched(info->refs); > diff --git a/tools/testing/selftests/user_events/ftrace_test.c b/tools/testing/selftests/user_events/ftrace_test.c > index aceafacfb126..91272f9d6fce 100644 > --- a/tools/testing/selftests/user_events/ftrace_test.c > +++ b/tools/testing/selftests/user_events/ftrace_test.c > @@ -296,6 +296,11 @@ TEST_F(user, write_events) { > ASSERT_NE(-1, writev(self->data_fd, (const struct iovec *)io, 3)); > after = trace_bytes(); > ASSERT_GT(after, before); > + > + /* Negative index should fail with EINVAL */ > + reg.write_index = -1; > + ASSERT_EQ(-1, writev(self->data_fd, (const struct iovec *)io, 3)); > + ASSERT_EQ(EINVAL, errno); > } > > TEST_F(user, write_fault) { > -- > 2.25.1 > -- Masami Hiramatsu (Google)