| From: Masami Hiramatsu <mhiramat@kernel.org> |
| Date: Tue, 10 Apr 2018 21:20:08 +0900 |
| Subject: tracing/uprobe_event: Fix strncpy corner case |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| commit 50268a3d266ecfdd6c5873d62b2758d9732fc598 upstream. |
| |
| Fix string fetch function to terminate with NUL. |
| It is OK to drop the rest of string. |
| |
| Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> |
| Cc: Linus Torvalds <torvalds@linux-foundation.org> |
| Cc: Peter Zijlstra <peterz@infradead.org> |
| Cc: Song Liu <songliubraving@fb.com> |
| Cc: Thomas Gleixner <tglx@linutronix.de> |
| Cc: security@kernel.org |
| Cc: 范龙飞 <long7573@126.com> |
| Fixes: 5baaa59ef09e ("tracing/probes: Implement 'memory' fetch method for uprobes") |
| Signed-off-by: Ingo Molnar <mingo@kernel.org> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| kernel/trace/trace_uprobe.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/kernel/trace/trace_uprobe.c |
| +++ b/kernel/trace/trace_uprobe.c |
| @@ -149,6 +149,8 @@ static void FETCH_FUNC_NAME(memory, stri |
| return; |
| |
| ret = strncpy_from_user(dst, src, maxlen); |
| + if (ret == maxlen) |
| + dst[--ret] = '\0'; |
| |
| if (ret < 0) { /* Failed to fetch string */ |
| ((u8 *)get_rloc_data(dest))[0] = '\0'; |
