All of lore.kernel.org
 help / color / mirror / Atom feed
From: Steven Rostedt <rostedt@goodmis.org>
To: linux-kernel@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>,
	Andrew Morton <akpm@linux-foundation.org>,
	Tom Zanussi <zanussi@kernel.org>
Subject: [PATCH v2 0/3] tracing: Fix synthetic event bug
Date: Wed, 12 Oct 2022 06:40:55 -0400	[thread overview]
Message-ID: <20221012104055.421393330@goodmis.org> (raw)


The follow commands caused a crash:

  # cd /sys/kernel/tracing
  # echo 's:open char file[]' > dynamic_events
  # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger'
  # echo 1 > events/synthetic/open/enable

BOOM!

The problem is that the synthetic event field "char file[]" will read
the value given to it as a string without any memory checks to make sure
the address is valid. The above example will pass in the user space
address and the sythetic event code will happily call strlen() on it
and then strscpy() where either one will cause an oops when accessing
user space addresses.

Changes since v1: https://lore.kernel.org/all/20221011212501.773319898@goodmis.org/

 - Handle "(fault)" printing when there's a fault

Steven Rostedt (Google) (3):
      tracing: Move duplicate code of trace_kprobe/eprobe.c into header
      tracing: Add "(fault)" name injection to kernel probes
      tracing: Fix reading strings from synthetic events

----
 kernel/trace/trace_eprobe.c       |  60 ++------------------
 kernel/trace/trace_events_synth.c |  23 ++++++--
 kernel/trace/trace_kprobe.c       |  60 ++------------------
 kernel/trace/trace_probe_kernel.h | 115 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 142 insertions(+), 116 deletions(-)
 create mode 100644 kernel/trace/trace_probe_kernel.h

             reply	other threads:[~2022-10-12 10:45 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-10-12 10:40 Steven Rostedt [this message]
2022-10-12 10:40 ` [PATCH v2 1/3] tracing: Move duplicate code of trace_kprobe/eprobe.c into header Steven Rostedt
2022-10-12 10:40 ` [PATCH v2 2/3] tracing: Add "(fault)" name injection to kernel probes Steven Rostedt
2022-10-12 12:34   ` David Laight
2022-10-12 12:42     ` Steven Rostedt
2022-10-12 10:40 ` [PATCH v2 3/3] tracing: Fix reading strings from synthetic events Steven Rostedt
2022-10-12 12:46 ` [PATCH v2 0/3] tracing: Fix synthetic event bug Masami Hiramatsu
2022-10-12 15:06 ` Tom Zanussi

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221012104055.421393330@goodmis.org \
    --to=rostedt@goodmis.org \
    --cc=akpm@linux-foundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mhiramat@kernel.org \
    --cc=zanussi@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.