diff options
| author | Rabin Vincent <rabin@rab.in> | 2014-10-29 18:06:58 -0400 |
|---|---|---|
| committer | Steven Rostedt <rostedt@goodmis.org> | 2014-10-30 20:58:38 -0400 |
| commit | 086ba77a6db00ed858ff07451bedee197df868c9 (patch) | |
| tree | 69dd28823e19c8de176989efc51f03c6a4035e6f /kernel | |
| parent | 4fc409048d5afb1ad853f294b4262ecf2c980a49 (diff) | |
tracing/syscalls: Ignore numbers outside NR_syscalls' range
ARM has some private syscalls (for example, set_tls(2)) which lie
outside the range of NR_syscalls. If any of these are called while
syscall tracing is being performed, out-of-bounds array access will
occur in the ftrace and perf sys_{enter,exit} handlers.
# trace-cmd record -e raw_syscalls:* true && trace-cmd report
...
true-653 [000] 384.675777: sys_enter: NR 192 (0, 1000, 3, 4000022, ffffffff, 0)
true-653 [000] 384.675812: sys_exit: NR 192 = 1995915264
true-653 [000] 384.675971: sys_enter: NR 983045 (76f74480, 76f74000, 76f74b28, 76f74480, 76f76f74, 1)
true-653 [000] 384.675988: sys_exit: NR 983045 = 0
...
# trace-cmd record -e syscalls:* true
[ 17.289329] Unable to handle kernel paging request at virtual address aaaaaace
[ 17.289590] pgd = 9e71c000
[ 17.289696] [aaaaaace] *pgd=00000000
[ 17.289985] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[ 17.290169] Modules linked in:
[ 17.290391] CPU: 0 PID: 704 Comm: true Not tainted 3.18.0-rc2+ #21
[ 17.290585] task: 9f4dab00 ti: 9e710000 task.ti: 9e710000
[ 17.290747] PC is at ftrace_syscall_enter+0x48/0x1f8
[ 17.290866] LR is at syscall_trace_enter+0x124/0x184
Fix this by ignoring out-of-NR_syscalls-bounds syscall numbers.
Commit cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls"
added the check for less than zero, but it should have also checked
for greater than NR_syscalls.
Link: http://lkml.kernel.org/p/1414620418-29472-1-git-send-email-rabin@rab.in
Fixes: cd0980fc8add "tracing: Check invalid syscall nr while tracing syscalls"
Cc: stable@vger.kernel.org # 2.6.33+
Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/trace/trace_syscalls.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c index 4dc8b79c5f75..29228c4d5696 100644 --- a/kernel/trace/trace_syscalls.c +++ b/kernel/trace/trace_syscalls.c | |||
| @@ -313,7 +313,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id) | |||
| 313 | int size; | 313 | int size; |
| 314 | 314 | ||
| 315 | syscall_nr = trace_get_syscall_nr(current, regs); | 315 | syscall_nr = trace_get_syscall_nr(current, regs); |
| 316 | if (syscall_nr < 0) | 316 | if (syscall_nr < 0 || syscall_nr >= NR_syscalls) |
| 317 | return; | 317 | return; |
| 318 | 318 | ||
| 319 | /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */ | 319 | /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */ |
| @@ -360,7 +360,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret) | |||
| 360 | int syscall_nr; | 360 | int syscall_nr; |
| 361 | 361 | ||
| 362 | syscall_nr = trace_get_syscall_nr(current, regs); | 362 | syscall_nr = trace_get_syscall_nr(current, regs); |
| 363 | if (syscall_nr < 0) | 363 | if (syscall_nr < 0 || syscall_nr >= NR_syscalls) |
| 364 | return; | 364 | return; |
| 365 | 365 | ||
| 366 | /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */ | 366 | /* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */ |
| @@ -567,7 +567,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id) | |||
| 567 | int size; | 567 | int size; |
| 568 | 568 | ||
| 569 | syscall_nr = trace_get_syscall_nr(current, regs); | 569 | syscall_nr = trace_get_syscall_nr(current, regs); |
| 570 | if (syscall_nr < 0) | 570 | if (syscall_nr < 0 || syscall_nr >= NR_syscalls) |
| 571 | return; | 571 | return; |
| 572 | if (!test_bit(syscall_nr, enabled_perf_enter_syscalls)) | 572 | if (!test_bit(syscall_nr, enabled_perf_enter_syscalls)) |
| 573 | return; | 573 | return; |
| @@ -641,7 +641,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret) | |||
| 641 | int size; | 641 | int size; |
| 642 | 642 | ||
| 643 | syscall_nr = trace_get_syscall_nr(current, regs); | 643 | syscall_nr = trace_get_syscall_nr(current, regs); |
| 644 | if (syscall_nr < 0) | 644 | if (syscall_nr < 0 || syscall_nr >= NR_syscalls) |
| 645 | return; | 645 | return; |
| 646 | if (!test_bit(syscall_nr, enabled_perf_exit_syscalls)) | 646 | if (!test_bit(syscall_nr, enabled_perf_exit_syscalls)) |
| 647 | return; | 647 | return; |