Oleg Nesterov 2ded0980a6 uprobes: Fix the memory out of bound overwrite in copy_insn() ... 1. copy_insn() doesn't look very nice, all calculations are confusing and it is not immediately clear why do we read the 2nd page first. 2. The usage of inode->i_size is wrong on 32-bit machines. 3. "Instruction at end of binary" logic is simply wrong, it doesn't handle the case when uprobe->offset > inode->i_size. In this case "bytes" overflows, and __copy_insn() writes to the memory outside of uprobe->arch.insn. Yes, uprobe_register() checks i_size_read(), but this file can be truncated after that. All i_size checks are racy, we do this only to catch the obvious mistakes. Change copy_insn() to call __copy_insn() in a loop, simplify and fix the bytes/nbytes calculations. Note: we do not care if we read extra bytes after inode->i_size if we got the valid page. This is fine because the task gets the same page after page-fault, and arch_uprobe_analyze_insn() can't know how many bytes were actually read anyway. Signed-off-by: Oleg Nesterov <oleg@redhat.com>		2013-11-09 17:05:43 +01:00
..
callchain.c	perf: Roll back callchain buffer refcount under the callchain mutex	2013-08-16 17:55:50 +02:00
core.c	perf: Factor out strncpy() in perf_event_mmap_event()	2013-11-06 12:34:28 +01:00
hw_breakpoint.c	hw_breakpoint: Introduce "struct bp_cpuinfo"	2013-06-20 17:58:57 +02:00
internal.h	perf: Fix arch_perf_out_copy_user default	2013-11-06 12:34:25 +01:00
Makefile	uprobes: Move to kernel/events/	2012-02-22 11:08:00 +01:00
ring_buffer.c	perf: Update a stale comment	2013-11-06 12:34:23 +01:00
uprobes.c	uprobes: Fix the memory out of bound overwrite in copy_insn()	2013-11-09 17:05:43 +01:00