Messages in this thread | | | Date | Wed, 6 Nov 2013 14:46:12 -0500 (EST) | From | Vince Weaver <> | Subject | Re: [GIT PULL][PATCH] perf/ftrace: Fix paranoid level for enabling function tracer |
| |
I've run this patch on top of 3.12 and it seems pretty solid. I've run my perf_fuzzer for hours (which wasn't possible w/o quickly crashing on a stock kernel).
Tested-by: Vince Weaver <vincent.weaver@maine.edu>
On Tue, 5 Nov 2013, Steven Rostedt wrote:
> > Linus, > > Please pull the latest ftrace/urgent tree, which can be found at: > > > git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git > ftrace/urgent > > Head SHA1: d1356abac98cce8e7765186f8093da1442d74d1d > > > Steven Rostedt (1): > perf/ftrace: Fix paranoid level for enabling function tracer > > ---- > kernel/trace/trace_event_perf.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > --------------------------- > commit d1356abac98cce8e7765186f8093da1442d74d1d > Author: Steven Rostedt <rostedt@goodmis.org> > Date: Tue Nov 5 12:51:11 2013 -0500 > > perf/ftrace: Fix paranoid level for enabling function tracer > > The current default perf paranoid level is "1" which has > "perf_paranoid_kernel()" return false, and giving any operations that > use it, access to normal users. Unfortunately, this includes function > tracing and normal users should not be allowed to enable function > tracing by default. > > The proper level is defined at "-1" (full perf access), which > "perf_paranoid_tracepoint_raw()" will only give access to. Use that > check instead for enabling function tracing. > > Reported-by: Dave Jones <davej@redhat.com> > Reported-by: Vince Weaver <vincent.weaver@maine.edu> > Cc: Peter Zijlstra <peterz@infradead.org> > Cc: Ingo Molnar <mingo@kernel.org> > Cc: Jiri Olsa <jolsa@redhat.com> > Cc: Frederic Weisbecker <fweisbec@gmail.com> > Cc: stable@vger.kernel.org # 3.4+ > CVE: CVE-2013-2930 > Fixes: ced39002f5ea ("ftrace, perf: Add support to use function tracepoint in perf") > Signed-off-by: Steven Rostedt <rostedt@goodmis.org> > > diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c > index 80c36bc..78e27e3 100644 > --- a/kernel/trace/trace_event_perf.c > +++ b/kernel/trace/trace_event_perf.c > @@ -26,7 +26,7 @@ static int perf_trace_event_perm(struct ftrace_event_call *tp_event, > { > /* The ftrace function trace is allowed only for root. */ > if (ftrace_event_is_function(tp_event) && > - perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN)) > + perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN)) > return -EPERM; > > /* No tracing, just counting, so no obvious leak */ >
Vince Weaver vincent.weaver@maine.edu http://www.eece.maine.edu/~vweaver/
| |