[kernel/f17] tracing: NULL pointer dereference (rhbz 952197 952217)
Josh Boyer
jwboyer at fedoraproject.org
Mon Apr 15 12:28:45 UTC 2013
commit cceeebddab537070973826a494f9d3a1973f286b
Author: Josh Boyer <jwboyer at redhat.com>
Date: Mon Apr 15 08:27:47 2013 -0400
tracing: NULL pointer dereference (rhbz 952197 952217)
kernel.spec | 9 ++
...ng-Fix-possible-NULL-pointer-dereferences.patch | 111 ++++++++++++++++++++
2 files changed, 120 insertions(+), 0 deletions(-)
---
diff --git a/kernel.spec b/kernel.spec
index 9a4c26c..b4be312 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -777,6 +777,9 @@ Patch25007: fix-child-thread-introspection.patch
#rhbz 844750
Patch25008: 0001-bluetooth-Add-support-for-atheros-04ca-3004-device-t.patch
+#CVE-xxxx-xxxx rhbz 952197 952217
+Patch25009: tracing-Fix-possible-NULL-pointer-dereferences.patch
+
# END OF PATCH DEFINITIONS
%endif
@@ -1512,6 +1515,9 @@ ApplyPatch fix-child-thread-introspection.patch
ApplyPatch 0001-bluetooth-Add-support-for-atheros-04ca-3004-device-t.patch
+#CVE-xxxx-xxxx rhbz 952197 952217
+ApplyPatch tracing-Fix-possible-NULL-pointer-dereferences.patch
+
# END OF PATCH APPLICATIONS
%endif
@@ -2368,6 +2374,9 @@ fi
# '-' | |
# '-'
%changelog
+* Mon Apr 15 2013 Josh Boyer <jwboyer at redhat.com>
+- tracing: NULL pointer dereference (rhbz 952197 952217)
+
* Fri Apr 12 2013 Dave Jones <davej at redhat.com> - 3.8.7-100
- 3.8.7
dropped: HID-magicmouse-fix-race-between-input_register-and-probe.patch
diff --git a/tracing-Fix-possible-NULL-pointer-dereferences.patch b/tracing-Fix-possible-NULL-pointer-dereferences.patch
new file mode 100644
index 0000000..71af4dd
--- /dev/null
+++ b/tracing-Fix-possible-NULL-pointer-dereferences.patch
@@ -0,0 +1,111 @@
+From 6a76f8c0ab19f215af2a3442870eeb5f0e81998d Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung.kim at lge.com>
+Date: Thu, 11 Apr 2013 15:55:01 +0900
+Subject: [PATCH] tracing: Fix possible NULL pointer dereferences
+
+Currently set_ftrace_pid and set_graph_function files use seq_lseek
+for their fops. However seq_open() is called only for FMODE_READ in
+the fops->open() so that if an user tries to seek one of those file
+when she open it for writing, it sees NULL seq_file and then panic.
+
+It can be easily reproduced with following command:
+
+ $ cd /sys/kernel/debug/tracing
+ $ echo 1234 | sudo tee -a set_ftrace_pid
+
+In this example, GNU coreutils' tee opens the file with fopen(, "a")
+and then the fopen() internally calls lseek().
+
+Link: http://lkml.kernel.org/r/1365663302-2170-1-git-send-email-namhyung@kernel.org
+
+Cc: Frederic Weisbecker <fweisbec at gmail.com>
+Cc: Ingo Molnar <mingo at kernel.org>
+Cc: Namhyung Kim <namhyung.kim at lge.com>
+Cc: stable at vger.kernel.org
+Signed-off-by: Namhyung Kim <namhyung at kernel.org>
+Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
+---
+ include/linux/ftrace.h | 2 +-
+ kernel/trace/ftrace.c | 10 +++++-----
+ kernel/trace/trace_stack.c | 2 +-
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index 167abf9..eb3ce32 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -396,7 +396,7 @@ ssize_t ftrace_filter_write(struct file *file, const char __user *ubuf,
+ size_t cnt, loff_t *ppos);
+ ssize_t ftrace_notrace_write(struct file *file, const char __user *ubuf,
+ size_t cnt, loff_t *ppos);
+-loff_t ftrace_regex_lseek(struct file *file, loff_t offset, int whence);
++loff_t ftrace_filter_lseek(struct file *file, loff_t offset, int whence);
+ int ftrace_regex_release(struct inode *inode, struct file *file);
+
+ void __init
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 926ebfb..affc35d 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2697,7 +2697,7 @@ ftrace_notrace_open(struct inode *inode, struct file *file)
+ }
+
+ loff_t
+-ftrace_regex_lseek(struct file *file, loff_t offset, int whence)
++ftrace_filter_lseek(struct file *file, loff_t offset, int whence)
+ {
+ loff_t ret;
+
+@@ -3570,7 +3570,7 @@ static const struct file_operations ftrace_filter_fops = {
+ .open = ftrace_filter_open,
+ .read = seq_read,
+ .write = ftrace_filter_write,
+- .llseek = ftrace_regex_lseek,
++ .llseek = ftrace_filter_lseek,
+ .release = ftrace_regex_release,
+ };
+
+@@ -3578,7 +3578,7 @@ static const struct file_operations ftrace_notrace_fops = {
+ .open = ftrace_notrace_open,
+ .read = seq_read,
+ .write = ftrace_notrace_write,
+- .llseek = ftrace_regex_lseek,
++ .llseek = ftrace_filter_lseek,
+ .release = ftrace_regex_release,
+ };
+
+@@ -3783,8 +3783,8 @@ static const struct file_operations ftrace_graph_fops = {
+ .open = ftrace_graph_open,
+ .read = seq_read,
+ .write = ftrace_graph_write,
++ .llseek = ftrace_filter_lseek,
+ .release = ftrace_graph_release,
+- .llseek = seq_lseek,
+ };
+ #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+
+@@ -4439,7 +4439,7 @@ static const struct file_operations ftrace_pid_fops = {
+ .open = ftrace_pid_open,
+ .write = ftrace_pid_write,
+ .read = seq_read,
+- .llseek = seq_lseek,
++ .llseek = ftrace_filter_lseek,
+ .release = ftrace_pid_release,
+ };
+
+diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
+index 42ca822..83a8b5b 100644
+--- a/kernel/trace/trace_stack.c
++++ b/kernel/trace/trace_stack.c
+@@ -322,7 +322,7 @@ static const struct file_operations stack_trace_filter_fops = {
+ .open = stack_trace_filter_open,
+ .read = seq_read,
+ .write = ftrace_filter_write,
+- .llseek = ftrace_regex_lseek,
++ .llseek = ftrace_filter_lseek,
+ .release = ftrace_regex_release,
+ };
+
+--
+1.8.1.4
+
More information about the scm-commits
mailing list