tracing: t_start: reset FTRACE_ITER_HASH in case of seek/pread

Be sure to avoid entering t_show() with FTRACE_ITER_HASH set without having properly started the iterator to iterate the hash. This case is degenerate and, as discovered by Robert Swiecki, can cause t_hash_show() to misuse a pointer. This causes a NULL ptr deref with possible security implications. Tracked as CVE-2010-3079. Cc: Robert Swiecki <[email protected]> Cc: Eugene Teo <[email protected]> Cc: <[email protected]> Signed-off-by: Chris Wright <[email protected]> Signed-off-by: Steven Rostedt <[email protected]>
ambv · Sep 10, 2010 · df09162 · df09162
1 parent 5e11637
commit df09162
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
@@ -1510,6 +1510,8 @@ static void *t_start(struct seq_file *m, loff_t *pos)
 		if (*pos > 0)
 			return t_hash_start(m, pos);
 		iter->flags |= FTRACE_ITER_PRINTALL;
+		/* reset in case of seek/pread */
+		iter->flags &= ~FTRACE_ITER_HASH;
 		return iter;
 	}