From: Li Zefan Date: Sat, 11 Apr 2009 07:52:18 +0000 (+0800) Subject: tracing/filters: NIL-terminate user input filter X-Git-Tag: v2.6.30-rc2~75^2~3 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=8433a40eb7f2c4883ad57f9900f63e4d59240eb7;p=platform%2Fupstream%2Fkernel-adaptation-pc.git tracing/filters: NIL-terminate user input filter Make sure messages from user space are NIL-terminated strings, otherwise we could dump random memory while reading filter file. Try this: # echo 'parent_comm ==' > events/sched/sched_process_fork/filter # cat events/sched/sched_process_fork/filter parent_comm == � Signed-off-by: Li Zefan Acked-by: Tom Zanussi Acked-by: Frederic Weisbecker Cc: Steven Rostedt LKML-Reference: <49E04C32.6060508@cn.fujitsu.com> Signed-off-by: Ingo Molnar --- diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 64ec4d2..054bc18 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -503,6 +503,7 @@ event_filter_write(struct file *filp, const char __user *ubuf, size_t cnt, if (copy_from_user(&buf, ubuf, cnt)) return -EFAULT; + buf[cnt] = '\0'; pred = kzalloc(sizeof(*pred), GFP_KERNEL); if (!pred) @@ -569,6 +570,7 @@ subsystem_filter_write(struct file *filp, const char __user *ubuf, size_t cnt, if (copy_from_user(&buf, ubuf, cnt)) return -EFAULT; + buf[cnt] = '\0'; pred = kzalloc(sizeof(*pred), GFP_KERNEL); if (!pred)