diff options
author | Li Zefan <lizf@cn.fujitsu.com> | 2009-04-11 03:52:18 -0400 |
---|---|---|
committer | Ingo Molnar <mingo@elte.hu> | 2009-04-12 05:59:27 -0400 |
commit | 8433a40eb7f2c4883ad57f9900f63e4d59240eb7 (patch) | |
tree | 7fab36945d0266ca00a9a13c2061cc2a0a2ae5dc /kernel | |
parent | 0462b5664b2bda5a18fef7efb5bb32ce36590c1a (diff) |
tracing/filters: NIL-terminate user input filter
Make sure messages from user space are NIL-terminated strings,
otherwise we could dump random memory while reading filter file.
Try this:
# echo 'parent_comm ==' > events/sched/sched_process_fork/filter
# cat events/sched/sched_process_fork/filter
parent_comm == �
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Tom Zanussi <tzanussi@gmail.com>
Acked-by: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
LKML-Reference: <49E04C32.6060508@cn.fujitsu.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Diffstat (limited to 'kernel')
-rw-r--r-- | kernel/trace/trace_events.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 64ec4d278ffb..054bc1802bcd 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c | |||
@@ -503,6 +503,7 @@ event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt, | |||
503 | 503 | ||
504 | if (copy_from_user(&buf, ubuf, cnt)) | 504 | if (copy_from_user(&buf, ubuf, cnt)) |
505 | return -EFAULT; | 505 | return -EFAULT; |
506 | buf[cnt] = '\0'; | ||
506 | 507 | ||
507 | pred = kzalloc(sizeof(*pred), GFP_KERNEL); | 508 | pred = kzalloc(sizeof(*pred), GFP_KERNEL); |
508 | if (!pred) | 509 | if (!pred) |
@@ -569,6 +570,7 @@ subsystem_filter_write(struct file *filp, const char __user *ubuf, size_t cnt, | |||
569 | 570 | ||
570 | if (copy_from_user(&buf, ubuf, cnt)) | 571 | if (copy_from_user(&buf, ubuf, cnt)) |
571 | return -EFAULT; | 572 | return -EFAULT; |
573 | buf[cnt] = '\0'; | ||
572 | 574 | ||
573 | pred = kzalloc(sizeof(*pred), GFP_KERNEL); | 575 | pred = kzalloc(sizeof(*pred), GFP_KERNEL); |
574 | if (!pred) | 576 | if (!pred) |