Jack Pham
f123c9aada
trace: ipc_logging: Avoid buffer overflow in ipc_log_string()
...
In ipc_log_string() the return value from vsnprintf(), data_size,
is used to increment ectxt.offset. However, this length could
actually be much larger than that of ectxt.buff itself. This is a
typical mistake of [v]snprintf() usage [1], in that it returns
not the number of characters written but how many characters
*would* have been written regardless of whether it was truncated.
The result is that even though ectxt.buff itself is not overrun,
the incorrect size in ectxt.offset will be later used as the length
parameter when memcpy()'ing to the ipc_log_page's data, overflowing
that memory and beyond. The write_page's write_offset would also
indicate an out-of-bounds (greater than PAGE_SIZE) length.
The fix is simple: use vscnprintf() instead of vsnprintf().
[1] https://lwn.net/Articles/69419/
Change-Id: I2e9d44e74f5f30a009732e31a554d82e31946999
Signed-off-by: Jack Pham <jackp@codeaurora.org>
2017-04-04 10:19:24 -07:00
..
blktrace.c
bpf_trace.c
bpf: add BPF_CALL_x macros for declaring helpers
2016-09-09 19:36:04 -07:00
ftrace.c
ftrace: Add more checks for FTRACE_FL_DISABLED in processing ip records
2016-11-14 16:31:49 -05:00
gpu-traces.c
ANDROID: trace/events: add gpu trace events
2017-01-27 13:51:39 -08:00
ipc_logging.c
trace: ipc_logging: Avoid buffer overflow in ipc_log_string()
2017-04-04 10:19:24 -07:00
ipc_logging_debug.c
trace: Add snapshot of ipc_logging driver
2016-11-10 10:49:25 -08:00
ipc_logging_private.h
trace: Add snapshot of ipc_logging driver
2016-11-10 10:49:25 -08:00
Kconfig
trace: cpu_freq_switch: Add profiler for CPU frequency switch times
2017-03-20 12:16:04 -07:00
Makefile
trace: cpu_freq_switch: Add profiler for CPU frequency switch times
2017-03-20 12:16:04 -07:00
msm_rtb.c
power-traces.c
ring_buffer.c
ring_buffer_benchmark.c
rpm-traces.c
trace.c
Merge remote-tracking branch '4.9/tmp-47c0adf' into 4.9
2017-03-15 13:38:21 -07:00
trace.h
ANDROID: trace: Add an option to show tgids in trace output
2017-01-27 13:51:40 -08:00
trace_benchmark.c
trace_benchmark.h
trace_branch.c
trace_clock.c
trace_cpu_freq_switch.c
trace: cpu_freq_switch: Add profiler for CPU frequency switch times
2017-03-20 12:16:04 -07:00
trace_entries.h
tracing: Add NMI tracing in hwlat detector
2016-09-02 12:47:55 -04:00
trace_event_perf.c
trace_events.c
coresight: enable stm logging for trace events, marker and printk
2016-10-03 17:35:08 -07:00
trace_events_filter.c
trace_events_filter_test.h
trace_events_hist.c
trace_events_trigger.c
tracing: Call traceoff trigger after event is recorded
2016-09-23 09:47:59 -04:00
trace_export.c
trace_functions.c
trace_functions_graph.c
This is the 4.9.6 stable release
2017-01-31 13:55:27 -08:00
trace_hwlat.c
tracing: Fix hwlat kthread migration
2017-02-09 08:08:28 +01:00
trace_irqsoff.c
trace_kdb.c
trace_kprobe.c
ftrace: kprobe: uprobe: Add x8/x16/x32/x64 for hexadecimal types
2016-08-23 15:38:09 -03:00
trace_mmiotrace.c
trace_nop.c
trace_output.c
ANDROID: trace: fix compilation for 4.1
2017-01-27 13:51:42 -08:00
trace_output.h
trace_printk.c
trace_probe.c
ftrace: kprobe: uprobe: Show u8/u16/u32/u64 types in decimal
2016-08-23 17:06:38 -03:00
trace_probe.h
ftrace: kprobe: uprobe: Show u8/u16/u32/u64 types in decimal
2016-08-23 17:06:38 -03:00
trace_sched_switch.c
trace_sched_wakeup.c
trace_selftest.c
trace_selftest_dynamic.c
trace_seq.c
trace_stack.c
trace_stat.c
trace_stat.h
trace_syscalls.c
Merge remote-tracking branch '4.4/tmp-730d8a5' into 4.8
2016-10-31 15:09:53 -07:00
trace_uprobe.c
Merge remote-tracking branch '4.4/tmp-730d8a5' into 4.8
2016-10-31 15:09:53 -07:00
tracing_map.c
tracing_map.h