diff options
Diffstat (limited to 'debian/patches/bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch')
-rw-r--r-- | debian/patches/bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch | 61 |
1 files changed, 0 insertions, 61 deletions
diff --git a/debian/patches/bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch b/debian/patches/bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch deleted file mode 100644 index b7fac2ec6469..000000000000 --- a/debian/patches/bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch +++ /dev/null @@ -1,61 +0,0 @@ -From: "Steven Rostedt (VMware)" <rostedt@goodmis.org> -Date: Thu, 21 Jun 2018 13:20:53 -0400 -Subject: tracing: Check for no filter when processing event filters -Origin: https://git.kernel.org/linus/70303420b5721c38998cf987e6b7d30cc62d4ff1 -Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-12714 - -The syzkaller detected a out-of-bounds issue with the events filter code, -specifically here: - - prog[N].pred = NULL; /* #13 */ - prog[N].target = 1; /* TRUE */ - prog[N+1].pred = NULL; - prog[N+1].target = 0; /* FALSE */ --> prog[N-1].target = N; - prog[N-1].when_to_branch = false; - -As that's the first reference to a "N-1" index, it appears that the code got -here with N = 0, which means the filter parser found no filter to parse -(which shouldn't ever happen, but apparently it did). - -Add a new error to the parsing code that will check to make sure that N is -not zero before going into this part of the code. If N = 0, then -EINVAL is -returned, and a error message is added to the filter. - -Cc: stable@vger.kernel.org -Fixes: 80765597bc587 ("tracing: Rewrite filter logic to be simpler and faster") -Reported-by: air icy <icytxw@gmail.com> -bugzilla url: https://bugzilla.kernel.org/show_bug.cgi?id=200019 -Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> ---- - kernel/trace/trace_events_filter.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - -diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c -index e1c818dbc0d7..0dceb77d1d42 100644 ---- a/kernel/trace/trace_events_filter.c -+++ b/kernel/trace/trace_events_filter.c -@@ -78,7 +78,8 @@ static const char * ops[] = { OPS }; - C(TOO_MANY_PREDS, "Too many terms in predicate expression"), \ - C(INVALID_FILTER, "Meaningless filter expression"), \ - C(IP_FIELD_ONLY, "Only 'ip' field is supported for function trace"), \ -- C(INVALID_VALUE, "Invalid value (did you forget quotes)?"), -+ C(INVALID_VALUE, "Invalid value (did you forget quotes)?"), \ -+ C(NO_FILTER, "No filter found"), - - #undef C - #define C(a, b) FILT_ERR_##a -@@ -550,6 +551,13 @@ predicate_parse(const char *str, int nr_parens, int nr_preds, - goto out_free; - } - -+ if (!N) { -+ /* No program? */ -+ ret = -EINVAL; -+ parse_error(pe, FILT_ERR_NO_FILTER, ptr - str); -+ goto out_free; -+ } -+ - prog[N].pred = NULL; /* #13 */ - prog[N].target = 1; /* TRUE */ - prog[N+1].pred = NULL; |