From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2BEB222F01 for ; Wed, 29 Jul 2026 00:05:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785283529; cv=none; b=tL1btypDCedpkET33wKo/0oIgdQvQoA4bEoY9d9ZVPP7VZO5U5jH1+ZWOHi33XtamknJHVP+qcJhuk8CvW1E7pWXAroMfaMMGComlgvTdQV82H99f54UFqnfiXTTu88alGn6Cnw02lF2uw2TYyjnxcVf3NDPS8cTSRPmI1XHDV0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785283529; c=relaxed/simple; bh=zP8wePoZ6sYHmQtaEVC/0+ohnafML/10iCUF+5kAbWs=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=Tn1Q5BnQ8SkANDNcQZCrxFg4yBfGm1d6FytbVlow4iZqy2b0Sr9oIr+dwF7g7EOd8I+R5Ao7vUokGOrXxJjPcHY/Pz54/VzlvbPe2QijCjyn0Tc76iOJsil8NuuyeuM82c9NSDAELF39AsOGF0Z2ptem+K0q8YyxeeZGDy3k7/E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YOVA0v6g; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YOVA0v6g" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DDD121F00ACA; Wed, 29 Jul 2026 00:05:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785283522; bh=4Zg00WRGjxR89x84VNZOwXEwGuXSQ/skwZMv890S8v0=; h=Date:From:To:Cc:Subject:References; b=YOVA0v6gPa+t6+B2okpo7fEn9RX21BnNgd2ajAk6m1iYR8PRchndrKmGJ281u0hTr QgnRFxw7unBGcgE2hXmtXmdudWnM4wQOTsGFvbDRmR3cWejfFlx+l/Nr1PmwEuUXYL VJVvtPVKx7F7DOlKNvm0lB50tuFSnwSfrkS8NyO94n3rUFmvke9G+UqNnnwA3qah3q TCyuEXciYXy6laLGNw68kGkAT8OkpONKea92I9V3ix8z3+YUblKf9s3bh4uf7d2j2k 9jV2P5own20zWCDUfEg762Y2b1V4wLHD1XTGvfd63KQZkwPWjKIvCGS2CPuBvi+U/R 5IgY0tW7p1TpQ== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1woro5-00000006Ugg-21xA; Tue, 28 Jul 2026 20:05:57 -0400 Message-ID: <20260729000557.354446823@kernel.org> User-Agent: quilt/0.69 Date: Tue, 28 Jul 2026 20:05:37 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Martin Kaiser , Vinod Koul Subject: [for-next][PATCH 14/16] tracing: Warn when an event dereferences a pointer in TP_printk() References: <20260729000523.093060274@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 From: Steven Rostedt Currently on boot up and when modules are loaded, the trace event infrastructure will examine the TP_printk's of every event looking to see if it dereferences pointers on the ring buffer via printk formats like "%pB" and such. What it doesn't do is check if the arguments themselves do a dereference from a pointer. This was brought with a fix[1] to the fsl_edma event that had in the arguments of the TP_printk(): "__entry->edma->membase" The __entry->edma is a pointer saved in the ring buffer. The dereference from TP_printk() happens when the user reads the "trace" file which can be seconds, minutes, hours, days, weeks, or even months later! There is no guarantee that the __entry->edma pointer will still be pointing to what it was when it was recorded, and could crash the kernel when a user reads the event. Add logic to the test_event_printk() that also checks for this case and warn if the event dereferences a pointer from the ring buffer. [1] https://lore.kernel.org/all/20260630200022.1826420-1-martin@kaiser.cx/ Link: https://patch.msgid.link/20260630184836.74d477b6@gandalf.local.home Signed-off-by: Steven Rostedt Reviewed-by: Martin Kaiser Reviewed-by: Vinod Koul Signed-off-by: Steven Rostedt --- kernel/trace/trace_events.c | 35 +++++++++++++++++++++++++++++------ 1 file changed, 29 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index e0449e648871..714285e23a2e 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -401,6 +401,31 @@ static bool process_string(const char *fmt, int len, struct trace_event_call *ca return true; } +static void test_double_dereference(const char *str, int len, + struct trace_event_call *call) +{ + const char *ptr; + const char *end = str + len; + + ptr = strstr(str, "REC->"); + + while (ptr && ptr < end) { + + ptr += 5; + for (; ptr < end; ptr++) { + if (ptr[0] == '-' && ptr[1] == '>') { + WARN_ONCE(1, "Event %s has double dereference in TP_printk: %.*s\n", + trace_event_name(call), len, str); + return; + } + if (!isalnum(*ptr) && *ptr != '_') + break; + } + + ptr = strstr(ptr, "REC->"); + } +} + static void handle_dereference_arg(const char *arg_str, u64 string_flags, int len, u64 *dereference_flags, int arg, struct trace_event_call *call) @@ -460,12 +485,6 @@ static void test_event_printk(struct trace_event_call *call) if (in_quote) { arg = 0; first = false; - /* - * If there was no %p* uses - * the fmt is OK. - */ - if (!dereference_flags) - return; } } if (in_quote) { @@ -577,6 +596,8 @@ static void test_event_printk(struct trace_event_call *call) continue; } + test_double_dereference(fmt + start_arg, e - start_arg, call); + if (dereference_flags & (1ULL << arg)) { handle_dereference_arg(fmt + start_arg, string_flags, e - start_arg, @@ -590,6 +611,8 @@ static void test_event_printk(struct trace_event_call *call) } } + test_double_dereference(fmt + start_arg, i - start_arg, call); + if (dereference_flags & (1ULL << arg)) { handle_dereference_arg(fmt + start_arg, string_flags, i - start_arg, -- 2.53.0