2018-02-06 22:48:01

by Steven Rostedt

Subject: [RFC][PATCH 1/6] ftrace: Remove incorrect setting of glob search field

From: "Steven Rostedt (VMware)" <[email protected]>

__unregister_ftrace_function_probe() will incorrectly parse the glob filter
because it resets the search variable that was setup by filter_parse_regex().

Al Viro reported this:

After that call of filter_parse_regex() we could have func_g.search not
equal to glob only if glob started with '!' or '*'. In the former case
we would've buggered off with -EINVAL (not = 1). In the latter we
would've set func_g.search equal to glob + 1, calculated the length of
that thing in func_g.len and proceeded to reset func_g.search back to
glob.

Suppose the glob is e.g. *foo*. We end up with
func_g.type = MATCH_MIDDLE_ONLY;
func_g.len = 3;
func_g.search = "*foo";
Feeding that to ftrace_match_record() will not do anything sane - we
will be looking for names containing "*foo" (->len is ignored for that
one).

Link: http://lkml.kernel.org/r/[email protected]

Cc: [email protected]
Cc: Dmitry Safonov <[email protected]>
Fixes: 3ba009297149f ("ftrace: Introduce ftrace_glob structure")
Reported-by: Al Viro <[email protected]>
Signed-off-by: Steven Rostedt (VMware) <[email protected]>
---
kernel/trace/ftrace.c | 1 -
1 file changed, 1 deletion(-)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index dabd9d167d42..eac9ce2c57a2 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4456,7 +4456,6 @@ unregister_ftrace_function_probe_func(char *glob, struct trace_array *tr,
func_g.type = filter_parse_regex(glob, strlen(glob),
&func_g.search, &not);
func_g.len = strlen(func_g.search);
- func_g.search = glob;

/* we do not support '!' for function probes */
if (WARN_ON(not))
--
2.15.1

2018-02-07 14:37:09

by Dmitry Safonov

Subject: Re: [RFC][PATCH 1/6] ftrace: Remove incorrect setting of glob search field

2018-02-06 22:43 GMT+00:00 Steven Rostedt <[email protected]>:
> From: "Steven Rostedt (VMware)" <[email protected]>
>
> __unregister_ftrace_function_probe() will incorrectly parse the glob filter
> because it resets the search variable that was setup by filter_parse_regex().
>
> Al Viro reported this:
>
> After that call of filter_parse_regex() we could have func_g.search not
> equal to glob only if glob started with '!' or '*'. In the former case
> we would've buggered off with -EINVAL (not = 1). In the latter we
> would've set func_g.search equal to glob + 1, calculated the length of
> that thing in func_g.len and proceeded to reset func_g.search back to
> glob.
>
> Suppose the glob is e.g. *foo*. We end up with
> func_g.type = MATCH_MIDDLE_ONLY;
> func_g.len = 3;
> func_g.search = "*foo";
> Feeding that to ftrace_match_record() will not do anything sane - we
> will be looking for names containing "*foo" (->len is ignored for that
> one).
>
> Link: http://lkml.kernel.org/r/[email protected]
>
> Cc: [email protected]
> Cc: Dmitry Safonov <[email protected]>
> Fixes: 3ba009297149f ("ftrace: Introduce ftrace_glob structure")
> Reported-by: Al Viro <[email protected]>
> Signed-off-by: Steven Rostedt (VMware) <[email protected]>

Reviewed-by: Dmitry Safonov <[email protected]>
Thank you, Steven.

--
Dmitry

2018-02-08 14:02:38

by Masami Hiramatsu

Subject: Re: [RFC][PATCH 1/6] ftrace: Remove incorrect setting of glob search field

On Tue, 06 Feb 2018 17:43:39 -0500
Steven Rostedt <[email protected]> wrote:

> From: "Steven Rostedt (VMware)" <[email protected]>
>
> __unregister_ftrace_function_probe() will incorrectly parse the glob filter
> because it resets the search variable that was setup by filter_parse_regex().
>
> Al Viro reported this:
>
> After that call of filter_parse_regex() we could have func_g.search not
> equal to glob only if glob started with '!' or '*'. In the former case
> we would've buggered off with -EINVAL (not = 1). In the latter we
> would've set func_g.search equal to glob + 1, calculated the length of
> that thing in func_g.len and proceeded to reset func_g.search back to
> glob.
>
> Suppose the glob is e.g. *foo*. We end up with
> func_g.type = MATCH_MIDDLE_ONLY;
> func_g.len = 3;
> func_g.search = "*foo";
> Feeding that to ftrace_match_record() will not do anything sane - we
> will be looking for names containing "*foo" (->len is ignored for that
> one).
>
> Link: http://lkml.kernel.org/r/[email protected]
>
> Cc: [email protected]
> Cc: Dmitry Safonov <[email protected]>
> Fixes: 3ba009297149f ("ftrace: Introduce ftrace_glob structure")
> Reported-by: Al Viro <[email protected]>
> Signed-off-by: Steven Rostedt (VMware) <[email protected]>

Reviewed-by: Masami Hiramatsu <[email protected]>

Thank you!

> ---
> kernel/trace/ftrace.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
> index dabd9d167d42..eac9ce2c57a2 100644
> --- a/kernel/trace/ftrace.c
> +++ b/kernel/trace/ftrace.c
> @@ -4456,7 +4456,6 @@ unregister_ftrace_function_probe_func(char *glob, struct trace_array *tr,
> func_g.type = filter_parse_regex(glob, strlen(glob),
> &func_g.search, &not);
> func_g.len = strlen(func_g.search);
> - func_g.search = glob;
>
> /* we do not support '!' for function probes */
> if (WARN_ON(not))
> --
> 2.15.1
>
>


--
Masami Hiramatsu <[email protected]>