Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Alan Maguire <alan.maguire@oracle.com>
To:     rostedt@goodmis.org
Cc:     corbet@lwn.net, mingo@redhat.com, shuah@kernel.org,
        linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-kselftest@vger.kernel.org,
        Alan Maguire <alan.maguire@oracle.com>
Subject: [RFC tracing 1/4] tracing: predicate matching trigger crashes for > 8-byte arrays
Date:   Sun,  7 Aug 2022 23:21:20 +0100
Message-Id: <1659910883-18223-2-git-send-email-alan.maguire@oracle.com>
In-Reply-To: <1659910883-18223-1-git-send-email-alan.maguire@oracle.com>
References: <1659910883-18223-1-git-send-email-alan.maguire@oracle.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?e0Gj0tzHs5/Y6lVWWHkoe2wboqVrm3AFi+fYO0Fhpf5hjBwXOm5z/bscyejY?=
 =?us-ascii?Q?WuLSjdF/hKyWdO/WH3GXIY5EmcxhlSOcAjVlY92ZS3M4437adqBsfjUQiB6K?=
 =?us-ascii?Q?nV78Ed8hmCJFR9aw3+Nd0VTtse2ztlh9eDNEEgrjASJ27NYQbze4mnJ1YWrg?=
 =?us-ascii?Q?GqDRW3u+lsNb0vBxFR/z7+4M9DpxRsvxD5h+Snf04kQyhtWuxC5sC6VqnVmL?=
 =?us-ascii?Q?cXaD3piK6MxJifrbGUIKowyspmSmpGSuFkjA25fSVOySYPQEsaHtmGD/npRZ?=
 =?us-ascii?Q?Ko9axWWgtCN17/rrEhE0P2ZnmThnDPPnXRhYZS9bXGsLfNN2cMOXTgw715dl?=
 =?us-ascii?Q?UMONyOYAIY8E8WzbWRGNJskkzxwWLeyM9MK8jY7joTb20aaBFsyIrc2MSxMk?=
 =?us-ascii?Q?VUROlgjkqbeZYjhAr8gEhGJVlpWzMVpdsoYFUAOWV4FO+p4YG0MmHKM9YSTA?=
 =?us-ascii?Q?+W6SM++zdgTbz/40ZmXbLYp2zvmH4g5OLv/IiiAYct0nQULExlTLSrrmvnMd?=
 =?us-ascii?Q?s5DnM4HOTdYJKinPrzEbYlP42bDQvXzmb6ykCDAzrWYMCRcCpFpNKigkEZX3?=
 =?us-ascii?Q?NlDj72/GST6IEAkt3TX3yc0lg4p3NZt+Crm+ajKKgjHSmmQSJF7Jtu1D0DEu?=
 =?us-ascii?Q?SIsQ8IvoQ3xccevOjdH/S0Mo8RuSsRyKEjqjTMgH6vM9yUIb9qmevg4+37YB?=
 =?us-ascii?Q?xZFOD/QQj4iqgo/i8Xk5jStSAGUUoaSJQQakklWz3AAnQd0gzNATtTtc2s0+?=
 =?us-ascii?Q?lx4CiP2hywmtSNWT6/g80qRN9eEQ/BQOO14SLfwQCSLwD/skCD/Fqjg/J8Pf?=
 =?us-ascii?Q?eFpRVJywsYEY1E6SdWZEW+VFe+GWSXhZyVWf2Z9mU0ZNdIQ/pk5qi7uLXdZy?=
 =?us-ascii?Q?UH7RQqMgn+ZJIYh6oHcuqePd093FRZlbBu3Sj0vvsiYw/AXDOs1w1Q7phJMq?=
 =?us-ascii?Q?3PX956ou7s215JRgtZWbzD76FX2Iof7e3up7RtIIhP9GV9Cyrk5jguJ2Dl0C?=
 =?us-ascii?Q?ZFtWTwjfcBbrOlzlNrSUbmuCA4o/bj2p14brAkCLJxsjVWhwda0VSgDfTNGT?=
 =?us-ascii?Q?2jMuYOZay9/P7xyHAKss3aNB8r3GBfM1Ys9JQMQz19eTpW6vYnXPrjK+LFFQ?=
 =?us-ascii?Q?j6wZVcRTuCVOsVeAL9PfS9pmN2PB5KNWFdmb12TfsWYP19wim+kBvi6dNFvp?=
 =?us-ascii?Q?JDRmbgBVElHpkZ5HR9zUFk7Iyndy1KEPkarbPv+cJJwjkNPKZp/8hrOfcutW?=
 =?us-ascii?Q?hM+xZnuS/pJC0/2kHQatwh4kJH9lW14pBDpPNP1LJNpOJXvDd7I3OyjIu5wH?=
 =?us-ascii?Q?VzLpIGDKOaVcb39qdBEctsrzakmyp26O8HE6FeY3+yXGR6PVtg2VC/yhkUr3?=
 =?us-ascii?Q?lT5YT9lNTcREckkHwR1T+m1MB+QZ049Jn0tb5OU9yFN8WcPwAbif2Uhpb6Qi?=
 =?us-ascii?Q?XaQ3J+/rZh2+Fuf97HjmqkalgrfIJU8VlbLrUjN17mUQvUBH5fPfUNP5CyZi?=
 =?us-ascii?Q?FEfW1X9oHWEtIgq0sEELJVJA8WI9Xva1klYVX85camXDEAtysHco0muF/Pyj?=
 =?us-ascii?Q?i7aGl5lEgFV+G91oEPsGWDuiEyYzRyWeiUW3d8VG?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 927b604e-6fe5-467a-2fdb-08da78c33434
X-MS-Exchange-CrossTenant-AuthSource: BLAPR10MB5267.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Aug 2022 22:21:42.0034
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: OgsYxPHj86oM9s63s0wFNnz6KTIQ3TeDW2582J3ONqk2Q7prlFrpG+z5/CL+BIL81OhDh9E3a6fRBAT8FygNOQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1001MB2381
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-08-07_15,2022-08-05_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0
 malwarescore=0 mlxscore=0 adultscore=0 bulkscore=0 mlxlogscore=999
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2206140000 definitions=main-2208070119
X-Proofpoint-ORIG-GUID: qQu79qGieTzk9J0YXpICAxdrlkyuYRbo
X-Proofpoint-GUID: qQu79qGieTzk9J0YXpICAxdrlkyuYRbo
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The following (wrong) use of tracepoint filtering was enough to trigger
a null-pointer dereference crash:

	cd /sys/kernel/debug/tracing
	echo "saddr_v6 == 0x0100007f" > tcp/tcp_receive_reset/filter
	echo 1 > tcp/tcp_receive_reset/enable
	wget https://localhost

This works fine if saddr - a 4-byte array representing the source address -
is used instead.

Fix is to handle case where we encounter an unexpected size.

Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
---
 kernel/trace/trace_events_filter.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 4b1057ab9d96..65e01c8d48d9 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1490,6 +1490,11 @@ static int parse_pred(const char *str, void *data,
 		else {
 			pred->fn = select_comparison_fn(pred->op, field->size,
 							field->is_signed);
+			if (!pred->fn) {
+				parse_error(pe, FILT_ERR_ILLEGAL_FIELD_OP,
+					    pos + i);
+				goto err_free;
+			}
 			if (pred->op == OP_NE)
 				pred->not = 1;
 		}
-- 
2.31.1