From: Steven Rostedt <rostedt@goodmis.org>
To: Christian Schoenebeck <linux_oss@crudebyte.com>
Cc: JP Kobryn <inwardvessel@gmail.com>,
asmadeus@codewreck.org, ericvh@kernel.org, lucho@ionkov.net,
mhiramat@kernel.org, mathieu.desnoyers@efficios.com,
v9fs@lists.linux.dev, linux-trace-kernel@vger.kernel.org,
bpf@vger.kernel.org, kernel-team@meta.com
Subject: Re: [PATCH] 9p: prevent read overrun in protocol dump tracepoint
Date: Sat, 2 Dec 2023 20:14:09 -0500 [thread overview]
Message-ID: <20231202201409.10223677@rorschach.local.home> (raw)
In-Reply-To: <1881630.VfuOzHrogK@silver>
On Sat, 02 Dec 2023 14:05:24 +0100
Christian Schoenebeck <linux_oss@crudebyte.com> wrote:
> > > --- a/include/trace/events/9p.h
> > > +++ b/include/trace/events/9p.h
> > > @@ -185,7 +185,8 @@ TRACE_EVENT(9p_protocol_dump,
> > > __entry->clnt = clnt;
> > > __entry->type = pdu->id;
> > > __entry->tag = pdu->tag;
> > > - memcpy(__entry->line, pdu->sdata, P9_PROTO_DUMP_SZ);
> > > + memcpy(__entry->line, pdu->sdata,
> > > + min(pdu->capacity, P9_PROTO_DUMP_SZ));
> > > ),
> > > TP_printk("clnt %lu %s(tag = %d)\n%.3x: %16ph\n%.3x: %16ph\n",
> > > (unsigned long)__entry->clnt, show_9p_op(__entry->type),
>
> AFAICS __entry is a local variable on stack, and array __entry->line not
> intialized with zeros, i.e. the dump would contain trash at the end. Maybe
> prepending memset() before memcpy()?
__entry is a macro that points into the ring buffer that gets allocated
before this is called. TRACE_EVENT() has a __dynamic_array() field that
can handle variable length arrays. What you can do is turn this into
something like:
TRACE_EVENT(9p_protocol_dump,
TP_PROTO(struct p9_client *clnt, struct p9_fcall *pdu),
TP_ARGS(clnt, pdu),
TP_STRUCT__entry(
__field( void *, clnt )
__field( __u8, type )
__field( __u16, tag )
__dynamic_array(unsigned char, line, min(pdu->capacity, P9_PROTO_DUMP_SZ) )
),
TP_fast_assign(
__entry->clnt = clnt;
__entry->type = pdu->id;
__entry->tag = pdu->tag;
memcpy(__get_dynamic_array(line), pdu->sdata,
min(pdu->capacity, P9_PROTO_DUMP_SZ));
),
TP_printk("clnt %lu %s(tag = %d)\n%.3x: %16ph\n%.3x: %16ph\n",
(unsigned long)__entry->clnt, show_9p_op(__entry->type),
__entry->tag, 0, __get_dynamic_array(line), 16,
__get_dynamic_array(line) + 16)
);
-- Steve
next prev parent reply other threads:[~2023-12-03 1:14 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-02 3:04 [PATCH] 9p: prevent read overrun in protocol dump tracepoint JP Kobryn
2023-12-02 4:35 ` asmadeus
2023-12-02 7:19 ` asmadeus
2023-12-02 13:05 ` Christian Schoenebeck
2023-12-03 1:14 ` Steven Rostedt [this message]
2023-12-03 1:33 ` Dominique Martinet
2023-12-03 4:15 ` Steven Rostedt
2023-12-03 5:32 ` Dominique Martinet
2023-12-04 16:20 ` JP Kobryn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231202201409.10223677@rorschach.local.home \
--to=rostedt@goodmis.org \
--cc=asmadeus@codewreck.org \
--cc=bpf@vger.kernel.org \
--cc=ericvh@kernel.org \
--cc=inwardvessel@gmail.com \
--cc=kernel-team@meta.com \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=linux_oss@crudebyte.com \
--cc=lucho@ionkov.net \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhiramat@kernel.org \
--cc=v9fs@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox