From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754765AbZFAFoh (ORCPT ); Mon, 1 Jun 2009 01:44:37 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751730AbZFAFoa (ORCPT ); Mon, 1 Jun 2009 01:44:30 -0400 Received: from cn.fujitsu.com ([222.73.24.84]:55474 "EHLO song.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1751346AbZFAFo3 (ORCPT ); Mon, 1 Jun 2009 01:44:29 -0400 Message-ID: <4A236B0B.3000604@cn.fujitsu.com> Date: Mon, 01 Jun 2009 13:45:47 +0800 From: Li Zefan User-Agent: Thunderbird 2.0.0.9 (X11/20071115) MIME-Version: 1.0 To: Frederic Weisbecker CC: Steven Rostedt , Tom Zanussi , Ingo Molnar , LKML Subject: Re: [PATCH 2/2] tracing/filters: use strcmp() instead of strncmp() References: <4A1F9FAC.6020506@cn.fujitsu.com> <4A20F71F.6030703@cn.fujitsu.com> <20090530135236.GB5969@nowhere> <4A223F7E.3090203@cn.fujitsu.com> <20090531132853.GA6013@nowhere> In-Reply-To: <20090531132853.GA6013@nowhere> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org >>>> I don't think there's any security issue. It's irrelevant how big the user-input >>>> strings are. The point is those strings are guaranteed to be NULL-terminated. >>>> Am I missing something? >>>> >>>> And I don't think it's necessary to make 2 patches that each patch converts >>>> one strncmp to strcmp. But maybe it's better to improve this changelog? >>> Hmm, you must be right, indeed they seem to be guaranted beeing NULL-terminated >>> strings. >>> >> Sorry, I was wrong. :( >> >> Though the user-input strings are guaranted to be NULL-terminated, strings >> generated by TRACE_EVENT might not. >> >> We define static strings this way: >> TP_struct( >> __array(char, foo, LEN) >> ) >> But foo is not necessarily a string, though I doubt someone will use it >> as non-string char array. > > > Yeah, but the user defined comparison operand is NULL terminated. > So the strcmp will stop at this boundary. > The user input string is NULL terminated and is limited to MAX_FILTER_STR_VAL, and it's strcmp() not strcpy(), but it's still unsafe. No? cmp = strcmp(addr, pred->str_val); If addr is not NULL-terminated string but char array, and length of str_val > length of addr, then we'll be exceeding the boundary of the array. > > >> Dynamic string is fine, because assign_str() makes it NULL-terminated. >> >> So we can use strcmp() for dynamic strings, but we'd better use strncmp() for >> static string. >> >> > > >