)]}'
{
  "commit": "af15b7691766d99f0f84bae9b3444ab06e9beb29",
  "tree": "5d22a78374519c3feeabeaddad7e4f0fb58360a6",
  "parents": [
    "9736cb3f9aa9c620965d937f4ff0261f6ac32ee1"
  ],
  "author": {
    "name": "Steven Rostedt",
    "email": "rostedt@goodmis.org",
    "time": "Wed Oct 09 22:23:23 2013 -0400"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Wed Nov 20 10:43:19 2013 -0800"
  },
  "message": "tracing: Fix potential out-of-bounds in trace_get_user()\n\ncommit 057db8488b53d5e4faa0cedb2f39d4ae75dfbdbb upstream.\n\nAndrey reported the following report:\n\nERROR: AddressSanitizer: heap-buffer-overflow on address ffff8800359c99f3\nffff8800359c99f3 is located 0 bytes to the right of 243-byte region [ffff8800359c9900, ffff8800359c99f3)\nAccessed by thread T13003:\n  #0 ffffffff810dd2da (asan_report_error+0x32a/0x440)\n  #1 ffffffff810dc6b0 (asan_check_region+0x30/0x40)\n  #2 ffffffff810dd4d3 (__tsan_write1+0x13/0x20)\n  #3 ffffffff811cd19e (ftrace_regex_release+0x1be/0x260)\n  #4 ffffffff812a1065 (__fput+0x155/0x360)\n  #5 ffffffff812a12de (____fput+0x1e/0x30)\n  #6 ffffffff8111708d (task_work_run+0x10d/0x140)\n  #7 ffffffff810ea043 (do_exit+0x433/0x11f0)\n  #8 ffffffff810eaee4 (do_group_exit+0x84/0x130)\n  #9 ffffffff810eafb1 (SyS_exit_group+0x21/0x30)\n  #10 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nAllocated by thread T5167:\n  #0 ffffffff810dc778 (asan_slab_alloc+0x48/0xc0)\n  #1 ffffffff8128337c (__kmalloc+0xbc/0x500)\n  #2 ffffffff811d9d54 (trace_parser_get_init+0x34/0x90)\n  #3 ffffffff811cd7b3 (ftrace_regex_open+0x83/0x2e0)\n  #4 ffffffff811cda7d (ftrace_filter_open+0x2d/0x40)\n  #5 ffffffff8129b4ff (do_dentry_open+0x32f/0x430)\n  #6 ffffffff8129b668 (finish_open+0x68/0xa0)\n  #7 ffffffff812b66ac (do_last+0xb8c/0x1710)\n  #8 ffffffff812b7350 (path_openat+0x120/0xb50)\n  #9 ffffffff812b8884 (do_filp_open+0x54/0xb0)\n  #10 ffffffff8129d36c (do_sys_open+0x1ac/0x2c0)\n  #11 ffffffff8129d4b7 (SyS_open+0x37/0x50)\n  #12 ffffffff81928782 (system_call_fastpath+0x16/0x1b)\n\nShadow bytes around the buggy address:\n  ffff8800359c9700: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd\n  ffff8800359c9780: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa\n  ffff8800359c9800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n\u003d\u003effff8800359c9980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00[03]fb\n  ffff8800359c9a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9a80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n  ffff8800359c9b00: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00\n  ffff8800359c9b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ffff8800359c9c00: 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa\nShadow byte legend (one shadow byte represents 8 application bytes):\n  Addressable:           00\n  Partially addressable: 01 02 03 04 05 06 07\n  Heap redzone:          fa\n  Heap kmalloc redzone:  fb\n  Freed heap region:     fd\n  Shadow gap:            fe\n\nThe out-of-bounds access happens on \u0027parser-\u003ebuffer[parser-\u003eidx] \u003d 0;\u0027\n\nAlthough the crash happened in ftrace_regex_open() the real bug\noccurred in trace_get_user() where there\u0027s an incrementation to\nparser-\u003eidx without a check against the size. The way it is triggered\nis if userspace sends in 128 characters (EVENT_BUF_SIZE + 1), the loop\nthat reads the last character stores it and then breaks out because\nthere is no more characters. Then the last character is read to determine\nwhat to do next, and the index is incremented without checking size.\n\nThen the caller of trace_get_user() usually nulls out the last character\nwith a zero, but since the index is equal to the size, it writes a nul\ncharacter after the allocated space, which can corrupt memory.\n\nLuckily, only root user has write access to this file.\n\nLink: http://lkml.kernel.org/r/20131009222323.04fd1a0d@gandalf.local.home\n\nReported-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5dd9626634b0fc922c8a94bd000365bfadb1b560",
      "old_mode": 33188,
      "old_path": "kernel/trace/trace.c",
      "new_id": "022940f097b800ac804021ed28be87c703a0b979",
      "new_mode": 33188,
      "new_path": "kernel/trace/trace.c"
    }
  ]
}