kybaaz/linux-xiaomi-chiron
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
linux-xiaomi-chiron/kernel/trace
History
Steven Rostedt (VMware) 5acce0bff2 tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name 
The following commands:

 # echo 'read_max u64 size;' > synthetic_events
 # echo 'hist:keys=common_pid:count=count:onmax($count).trace(read_max,count)' > events/syscalls/sys_enter_read/trigger

Causes:

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] PREEMPT SMP
 CPU: 4 PID: 1763 Comm: bash Not tainted 5.14.0-rc2-test+ #155
 Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01
v03.03 07/14/2016
 RIP: 0010:strcmp+0xc/0x20
 Code: 75 f7 31 c0 0f b6 0c 06 88 0c 02 48 83 c0 01 84 c9 75 f1 4c 89 c0
c3 0f 1f 80 00 00 00 00 31 c0 eb 08 48 83 c0 01 84 d2 74 0f <0f> b6 14 07
3a 14 06 74 ef 19 c0 83 c8 01 c3 31 c0 c3 66 90 48 89
 RSP: 0018:ffffb5fdc0963ca8 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: ffffffffb3a4e040 RCX: 0000000000000000
 RDX: 0000000000000000 RSI: ffff9714c0d0b640 RDI: 0000000000000000
 RBP: 0000000000000000 R08: 00000022986b7cde R09: ffffffffb3a4dff8
 R10: 0000000000000000 R11: 0000000000000000 R12: ffff9714c50603c8
 R13: 0000000000000000 R14: ffff97143fdf9e48 R15: ffff9714c01a2210
 FS:  00007f1fa6785740(0000) GS:ffff9714da400000(0000)
knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000000 CR3: 000000002d863004 CR4: 00000000001706e0
 Call Trace:
  __find_event_file+0x4e/0x80
  action_create+0x6b7/0xeb0
  ? kstrdup+0x44/0x60
  event_hist_trigger_func+0x1a07/0x2130
  trigger_process_regex+0xbd/0x110
  event_trigger_write+0x71/0xd0
  vfs_write+0xe9/0x310
  ksys_write+0x68/0xe0
  do_syscall_64+0x3b/0x90
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f1fa6879e87

The problem was the "trace(read_max,count)" where the "count" should be
"$count" as "onmax()" only handles variables (although it really should be
able to figure out that "count" is a field of sys_enter_read). But there's
a path that does not find the variable and ends up passing a NULL for the
event, which ends up getting passed to "strcmp()".

Add a check for NULL to return and error on the command with:

 # cat error_log
  hist:syscalls:sys_enter_read: error: Couldn't create or find variable
  Command: hist:keys=common_pid:count=count:onmax($count).trace(read_max,count)
                                ^
Link: https://lkml.kernel.org/r/20210808003011.4037f8d0@oasis.local.home

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 50450603ec tracing: Add 'onmax' hist trigger action support
Reviewed-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-08-12 13:35:57 -04:00
..
blktrace.c block-5.12-2021-02-27 2021-02-28 11:23:38 -08:00
bpf_trace.c Tracing updates for 5.14: 2021-07-03 11:13:22 -07:00
bpf_trace.h bpf: Use dedicated bpf_trace_printk event instead of trace_printk() 2020-07-13 16:55:49 -07:00
error_report-traces.c tracing: add error_report_end trace point 2021-02-26 09:41:02 -08:00
fgraph.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
ftrace.c ftrace: Remove redundant initialization of variable ret 2021-07-23 08:46:02 -04:00
ftrace_internal.h x86/ftrace: Have ftrace trampolines turn read-only at the end of system boot up 2020-05-12 18:24:34 -04:00
Kconfig tracing: define needed config DYNAMIC_FTRACE_WITH_ARGS 2021-08-12 13:35:57 -04:00
kprobe_event_gen_test.c tracing: Add kprobe event command generation test module 2020-01-30 09:46:28 -05:00
Makefile trace: Add osnoise tracer 2021-06-25 19:57:01 -04:00
power-traces.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
preemptirq_delay_test.c kernel: trace: preemptirq_delay_test: add cpu affinity 2021-02-02 17:02:07 -05:00
ring_buffer.c tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. 2021-07-22 11:52:33 -04:00
ring_buffer_benchmark.c sched,tracing: Convert to sched_set_fifo() 2020-07-29 11:43:53 +02:00
rpm-traces.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
synth_event_gen_test.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace.c tracing: Fix NULL pointer dereference in start_creating 2021-07-30 18:45:11 -04:00
trace.h Tracing updates for 5.14: 2021-07-03 11:13:22 -07:00
trace_benchmark.c tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00
trace_benchmark.h tracing: Fix SPDX format headers to use C++ style comments 2018-08-16 19:08:06 -04:00
trace_boot.c tracing/boot: Add per-group/all events enablement 2021-06-10 11:16:20 -04:00
trace_branch.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_clock.c tracing: Do no increment trace_clock_global() by one 2021-06-18 09:10:00 -04:00
trace_dynevent.c tracing/dynevent: Fix a memory leak in an error handling path 2021-04-13 12:29:48 -04:00
trace_dynevent.h tracing/dynevent: Delegate parsing to create function 2021-02-09 12:52:15 -05:00
trace_entries.h trace: Add timerlat tracer 2021-06-25 19:57:24 -04:00
trace_event_perf.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_events.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_events_filter.c tracing: Update create_system_filter() kernel-doc comment 2021-03-25 16:04:35 -04:00
trace_events_filter_test.h tracing: Fix SPDX format headers to use C++ style comments 2018-08-16 19:08:06 -04:00
trace_events_hist.c tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name 2021-08-12 13:35:57 -04:00
trace_events_inject.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_events_synth.c tracing: Clean up alloc_synth_event() 2021-07-23 08:45:30 -04:00
trace_events_trigger.c tracing: Fix set_named_trigger_data() kernel-doc comment 2021-06-10 11:16:20 -04:00
trace_export.c tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00
trace_functions.c tracing: Add "func_no_repeats" option for function tracing 2021-04-15 14:50:02 -04:00
trace_functions_graph.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_hwlat.c tracing: Quiet smp_processor_id() use in preemptable warning in hwlat 2021-08-05 09:27:31 -04:00
trace_irqsoff.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_kdb.c tracing: Rename trace_buffer to array_buffer 2020-01-13 13:19:38 -05:00
trace_kprobe.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_kprobe_selftest.c selftest/ftrace: Move kprobe selftest function to separate compile unit 2018-07-30 18:41:04 -04:00
trace_kprobe_selftest.h tracing: Fix SPDX format headers to use C++ style comments 2018-08-16 19:08:06 -04:00
trace_mmiotrace.c tracing: Remove definition of DEBUG in trace_mmiotrace.c 2021-02-02 17:02:07 -05:00
trace_nop.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
trace_osnoise.c trace/osnoise: Print a stop tracing message 2021-08-12 13:35:56 -04:00
trace_output.c trace: Add timerlat tracer 2021-06-25 19:57:24 -04:00
trace_output.h ftrace: Add recording of functions that caused recursion 2020-11-06 08:42:26 -05:00
trace_preemptirq.c lockdep: fix order in trace_hardirqs_off_caller() 2020-09-14 10:08:07 +02:00
trace_printk.c tracing: Add a verifier to check string pointers for trace events 2021-03-18 12:58:27 -04:00
trace_probe.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_probe.h tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_probe_tmpl.h tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_recursion_record.c ftrace: Add recording of functions that caused recursion 2020-11-06 08:42:26 -05:00
trace_sched_switch.c tracing: Fix sched switch start/stop refcount racy updates 2020-01-30 09:46:10 -05:00
trace_sched_wakeup.c tracing: Change variable type as bool for clean-up 2021-06-30 09:19:14 -04:00
trace_selftest.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_selftest_dynamic.c ftrace: Mark function tracer test functions noinline/noclone 2018-01-23 15:57:29 -05:00
trace_seq.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_stack.c ftrace: Have the callbacks receive a struct ftrace_regs instead of pt_regs 2020-11-13 12:14:55 -05:00
trace_stat.c tracing: make tracing_init_dentry() returns an integer instead of a d_entry pointer 2020-09-18 22:17:14 -04:00
trace_stat.h tracing: Use generic type for comparator function 2019-11-14 13:15:11 -05:00
trace_synth.h tracing: Synthetic event field_pos is an index not a boolean 2021-07-23 08:43:04 -04:00
trace_syscalls.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_uprobe.c tracing/dynevent: Delegate parsing to create function 2021-02-09 12:52:15 -05:00
tracing_map.c tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00
tracing_map.h tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00