Re: [PATCH 0/2] tracing: Fix NULL pointer bug in hist key expressions

[Tom Zanussi <zanussi@kernel.org>]

Hi Steve,

On Thu, 2018-11-08 at 13:45 -0500, Steven Rostedt wrote:
> On Thu,  8 Nov 2018 08:41:47 -0600
> Tom Zanussi <zanussi@kernel.org> wrote:
> 
> > From: Tom Zanussi <tom.zanussi@linux.intel.com>
> > 
> > Hi Steve,
> > 
> > This is a fix for a user-reported bug in the hist triggers, where
> > if a
> > variable reference is used in an expression in a histogram key, it
> > results in a NULL pointer dereference and subsequent Oops.
> 
> How does one add a variable reference as an expression in a
> histogram key?
> 
> Can you show an example?
> 

Sure, here's the example that showed the problem, and which the patch
fixes:

echo 'r:fib_table_lookup_ret fib_table_lookup $retval' > /sys/kernel/debug/tracing/kprobe_events

echo 'hist:keys=cpu:ts0=common_timestamp' > /sys/kernel/debug/tracing/events/fib/fib_table_lookup/trigger
echo 'hist:keys=cpu,common_timestamp-$ts0' > /sys/kernel/debug/tracing/events/kprobes/fib_table_lookup_ret/trigger

The following is also a variable reference in an expression, but in
this case the expression is the variable reference alone, which the
existing code handles properly and returns -EINVAL.

echo 'hist:keys=cpu,$ts0' > /sys/kernel/debug/tracing/events/kprobes/fib_table_lookup_ret/trigger

Tom

> -- Steve
> 
> > 
> > I separated the fix into two small patches, the first preventing
> > the
> > immediate problem bu disallowing a var_ref from ever accessing a
> > NULL
> > element, and the second disallowing a user from ever constructing
> > such
> > a key.
> > 
> > Thanks,
> > 
> > Tom
> > 
> > The following changes since commit
> > ee474b81fe5aa5dc0faae920bf66240fbf55f891:
> > 
> >   tracing/kprobes: Fix strpbrk() argument order (2018-11-05
> > 09:47:14 -0500)
> > 
> > are available in the git repository at:
> > 
> >   git://git.kernel.org/pub/scm/linux/kernel/git/zanussi/linux-
> > trace.git ftrace/key-ref-fix
> > 
> > Tom Zanussi (2):
> >   tracing: Prevent hist_field_var_ref() from accessing NULL
> >     tracing_map_elts
> >   tracing: Check keys for variable references in expressions too
> > 
> >  kernel/trace/trace_events_hist.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> > 
> 
>