I've run this patch on top of 3.12 and it seems pretty solid. I've run my perf_fuzzer for hours (which wasn't possible w/o quickly crashing on a stock kernel).
Tested-by: Vince Weaver <[email protected]> On Tue, 5 Nov 2013, Steven Rostedt wrote: > > Linus, > > Please pull the latest ftrace/urgent tree, which can be found at: > > > git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git > ftrace/urgent > > Head SHA1: d1356abac98cce8e7765186f8093da1442d74d1d > > > Steven Rostedt (1): > perf/ftrace: Fix paranoid level for enabling function tracer > > ---- > kernel/trace/trace_event_perf.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > --------------------------- > commit d1356abac98cce8e7765186f8093da1442d74d1d > Author: Steven Rostedt <[email protected]> > Date: Tue Nov 5 12:51:11 2013 -0500 > > perf/ftrace: Fix paranoid level for enabling function tracer > > The current default perf paranoid level is "1" which has > "perf_paranoid_kernel()" return false, and giving any operations that > use it, access to normal users. Unfortunately, this includes function > tracing and normal users should not be allowed to enable function > tracing by default. > > The proper level is defined at "-1" (full perf access), which > "perf_paranoid_tracepoint_raw()" will only give access to. Use that > check instead for enabling function tracing. > > Reported-by: Dave Jones <[email protected]> > Reported-by: Vince Weaver <[email protected]> > Cc: Peter Zijlstra <[email protected]> > Cc: Ingo Molnar <[email protected]> > Cc: Jiri Olsa <[email protected]> > Cc: Frederic Weisbecker <[email protected]> > Cc: [email protected] # 3.4+ > CVE: CVE-2013-2930 > Fixes: ced39002f5ea ("ftrace, perf: Add support to use function > tracepoint in perf") > Signed-off-by: Steven Rostedt <[email protected]> > > diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c > index 80c36bc..78e27e3 100644 > --- a/kernel/trace/trace_event_perf.c > +++ b/kernel/trace/trace_event_perf.c > @@ -26,7 +26,7 @@ static int perf_trace_event_perm(struct ftrace_event_call > *tp_event, > { > /* The ftrace function trace is allowed only for root. */ > if (ftrace_event_is_function(tp_event) && > - perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN)) > + perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN)) > return -EPERM; > > /* No tracing, just counting, so no obvious leak */ > Vince Weaver [email protected] http://www.eece.maine.edu/~vweaver/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
