Re: [PATCH RFC 3/7] tracing: Stop modifying the input buffer in ftrace_set_clr_event()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Invalid free (causing kernel panic) and memory leak due to `strsep()` modifying a pointer managed by `__free(kfree)`.
--

--- Patch [3]: [PATCH RFC 3/7] tracing: Stop modifying the input buffer in ftrace_set_clr_event() ---
commit c968a27c39638474537de841b7e2191407463142
Author: Thomas Weißschuh <thomas.weissschuh@linutronix.de>

tracing: Stop modifying the input buffer in ftrace_set_clr_event()

This commit changes ftrace_set_clr_event() to copy its input buffer using
kstrdup() and manage it with __free(kfree). This removes the need to
restore the original buffer modifications before returning.

> diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
> index 6aa32c4922807..c75a7f5b55def 100644
> --- a/kernel/trace/trace_events.c
> +++ b/kernel/trace/trace_events.c
> @@ -1411,14 +1411,17 @@ static int __ftrace_set_clr_event(struct trace_array *tr, const char *match,
>  	return ret;
>  }
>  
> -int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set)
> +int ftrace_set_clr_event(struct trace_array *tr, const char *_buf, int set)
>  {
>  	char *event = NULL, *sub = NULL, *match, *mod;
>  
>  	if (!tr)
>  		return -ENOENT;
>  
> +	char *buf __free(kfree) = kstrdup(_buf, GFP_KERNEL);
> +	if (!buf)
> +		return -ENOMEM;
> +

[Severity: High]
Will this lead to an invalid free or memory leak when buf is later modified? 

Further down in ftrace_set_clr_event(), buf is passed to strsep(), which
modifies the pointer in place:

    match = strsep(&buf, ":");

If strsep() advances the pointer to the next token, the cleanup function
will call kfree() on an interior pointer, causing a slab corruption bug or
kernel panic upon scope exit. If buf is advanced to NULL (when no colon is
found), it will result in a memory leak of the duplicated string since
kfree(NULL) is a no-op.

Could a separate pointer be used to track the allocation for cleanup,
leaving buf free to be safely advanced by strsep()?

>  	/* Modules events can be appended with :mod:<module> */
>  	mod = strstr(buf, ":mod:");
>  	if (mod) {

[ ... ]

> @@ -1455,15 +1458,7 @@ int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set)
>  			match = NULL;
>  	}
>  
> -	ret = __ftrace_set_clr_event(tr, match, sub, event, set, mod);
> -
> -	/* Put back the colon to allow this to be called again */
> -	if (buf)
> -		*(buf - 1) = ':';
> -	if (mod)
> -		*(mod - 5) = ':';
> -
> -	return ret;
> +	return __ftrace_set_clr_event(tr, match, sub, event, set, mod);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813-tracing-cli-event-filter-v1-0-57c4e8029c86@linutronix.de?part=3