Unverified Commit 16913cc9 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12797 uprobe: avoid out-of-bounds memory access of fetching args 

Merge Pull Request from: @ci-robot 
 
PR sync from: Pu Lehui <pulehui@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/7E5F6F6YOZQZ72DDSMFIV5X62E4OXO4E/ 
 
https://gitee.com/src-openeuler/kernel/issues/IB036G 
 
Link:https://gitee.com/openeuler/kernel/pulls/12797

 

Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 29951b95 89016fd0

kernel/trace/trace_uprobe.c

+9 −3
Original line number Diff line number Diff line
@@ -856,6 +856,7 @@ struct uprobe_cpu_buffer { 
};

static struct uprobe_cpu_buffer __percpu *uprobe_cpu_buffer;

static int uprobe_buffer_refcnt;

#define MAX_UCB_BUFFER_SIZE PAGE_SIZE



static int uprobe_buffer_init(void)

{
@@ -956,9 +957,6 @@ static void __uprobe_trace_func(struct trace_uprobe *tu, 


	WARN_ON(call != trace_file->event_call);



	if (WARN_ON_ONCE(tu->tp.size + dsize > PAGE_SIZE))

		return;



	if (trace_trigger_soft_disabled(trace_file))

		return;
@@ -1500,6 +1498,10 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs) 
	esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));



	ucb = uprobe_buffer_get();



	if (WARN_ON_ONCE(tu->tp.size + dsize > MAX_UCB_BUFFER_SIZE))

		dsize = MAX_UCB_BUFFER_SIZE - tu->tp.size;



	store_trace_args(ucb->buf, &tu->tp, regs, esize, dsize);



	if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
@@ -1535,6 +1537,10 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con, 
	esize = SIZEOF_TRACE_ENTRY(is_ret_probe(tu));



	ucb = uprobe_buffer_get();



	if (WARN_ON_ONCE(tu->tp.size + dsize > MAX_UCB_BUFFER_SIZE))

		dsize = MAX_UCB_BUFFER_SIZE - tu->tp.size;



	store_trace_args(ucb->buf, &tu->tp, regs, esize, dsize);



	if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))