From: Steven Rostedt <rostedt@goodmis.org>
To: linux-kernel@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Tom Zanussi <zanussi@kernel.org>
Subject: [PATCH v2 0/3] tracing: Fix synthetic event bug
Date: Wed, 12 Oct 2022 06:40:55 -0400 [thread overview]
Message-ID: <20221012104055.421393330@goodmis.org> (raw)
The follow commands caused a crash:
# cd /sys/kernel/tracing
# echo 's:open char file[]' > dynamic_events
# echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger'
# echo 1 > events/synthetic/open/enable
BOOM!
The problem is that the synthetic event field "char file[]" will read
the value given to it as a string without any memory checks to make sure
the address is valid. The above example will pass in the user space
address and the sythetic event code will happily call strlen() on it
and then strscpy() where either one will cause an oops when accessing
user space addresses.
Changes since v1: https://lore.kernel.org/all/20221011212501.773319898@goodmis.org/
- Handle "(fault)" printing when there's a fault
Steven Rostedt (Google) (3):
tracing: Move duplicate code of trace_kprobe/eprobe.c into header
tracing: Add "(fault)" name injection to kernel probes
tracing: Fix reading strings from synthetic events
----
kernel/trace/trace_eprobe.c | 60 ++------------------
kernel/trace/trace_events_synth.c | 23 ++++++--
kernel/trace/trace_kprobe.c | 60 ++------------------
kernel/trace/trace_probe_kernel.h | 115 ++++++++++++++++++++++++++++++++++++++
4 files changed, 142 insertions(+), 116 deletions(-)
create mode 100644 kernel/trace/trace_probe_kernel.h
next reply other threads:[~2022-10-12 10:45 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-12 10:40 Steven Rostedt [this message]
2022-10-12 10:40 ` [PATCH v2 1/3] tracing: Move duplicate code of trace_kprobe/eprobe.c into header Steven Rostedt
2022-10-12 10:40 ` [PATCH v2 2/3] tracing: Add "(fault)" name injection to kernel probes Steven Rostedt
2022-10-12 12:34 ` David Laight
2022-10-12 12:42 ` Steven Rostedt
2022-10-12 10:40 ` [PATCH v2 3/3] tracing: Fix reading strings from synthetic events Steven Rostedt
2022-10-12 12:46 ` [PATCH v2 0/3] tracing: Fix synthetic event bug Masami Hiramatsu
2022-10-12 15:06 ` Tom Zanussi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221012104055.421393330@goodmis.org \
--to=rostedt@goodmis.org \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mhiramat@kernel.org \
--cc=zanussi@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.