diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2019-01-15 12:28:26 -0500 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2019-01-15 12:28:26 -0500 |
| commit | 7939f8beecf1cfb10d255be65bfbd3793fae82a1 (patch) | |
| tree | fec9c6025cd4397ba4c447eb019d9e36beaedeff | |
| parent | e8746440bf68212f19688f1454dad593c74abee1 (diff) | |
| parent | 8b05a3a7503c2a982c9c462eae96cfbd59506783 (diff) | |
Merge tag 'trace-v5.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace
Pull tracing fix from Steven Rostedt:
"Andrea Righi fixed a NULL pointer dereference in trace_kprobe_create()
It is possible to trigger a NULL pointer dereference by writing an
incorrectly formatted string to the krpobe_events file"
* tag 'trace-v5.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
tracing/kprobes: Fix NULL pointer dereference in trace_kprobe_create()
| -rw-r--r-- | kernel/trace/trace_kprobe.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index 5c19b8c41c7e..d5fb09ebba8b 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c | |||
| @@ -607,11 +607,17 @@ static int trace_kprobe_create(int argc, const char *argv[]) | |||
| 607 | char buf[MAX_EVENT_NAME_LEN]; | 607 | char buf[MAX_EVENT_NAME_LEN]; |
| 608 | unsigned int flags = TPARG_FL_KERNEL; | 608 | unsigned int flags = TPARG_FL_KERNEL; |
| 609 | 609 | ||
| 610 | /* argc must be >= 1 */ | 610 | switch (argv[0][0]) { |
| 611 | if (argv[0][0] == 'r') { | 611 | case 'r': |
| 612 | is_return = true; | 612 | is_return = true; |
| 613 | flags |= TPARG_FL_RETURN; | 613 | flags |= TPARG_FL_RETURN; |
| 614 | } else if (argv[0][0] != 'p' || argc < 2) | 614 | break; |
| 615 | case 'p': | ||
| 616 | break; | ||
| 617 | default: | ||
| 618 | return -ECANCELED; | ||
| 619 | } | ||
| 620 | if (argc < 2) | ||
| 615 | return -ECANCELED; | 621 | return -ECANCELED; |
| 616 | 622 | ||
| 617 | event = strchr(&argv[0][1], ':'); | 623 | event = strchr(&argv[0][1], ':'); |
