linux-kernel - Re: [PATCH] tracing: Add *iter check for NULL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160617142457.48a37b6c@gandalf.local.home>
Date:	Fri, 17 Jun 2016 14:24:57 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	zhengjun.xing@...el.com
Cc:	mingo@...hat.com, linux-kernel@...r.kernel.org,
	Namhyung Kim <namhyung@...nel.org>
Subject: Re: [PATCH] tracing: Add *iter check for NULL

On Fri, 17 Jun 2016 12:38:41 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Wed,  1 Jun 2016 16:31:10 +0800
> zhengjun.xing@...el.com wrote:
> 
> > From: xingzhen <zhengjun.xing@...el.com>
> > 
> > 3debb0a9ddb adding a "__used" to the variable in the
> > __trace_printk_fmt section. Sometimes it will cause
> > *iter to be NULL, then strcmp in lookup_format and
> > strcpy in hold_module_trace_bprintk_format will panic.
> 
> Could you show an example of this happening?

Ha! While adding a trace_printk() test module (to test someone else's
change) I triggered this bug.

> 
> > 
> > Signed-off-by: xingzhen <zhengjun.xing@...el.com>
> > ---
> >  kernel/trace/trace_printk.c | 3 +++
> >  1 file changed, 3 insertions(+)
> > 
> > diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
> > index f96f038..82ecfb5 100644
> > --- a/kernel/trace/trace_printk.c
> > +++ b/kernel/trace/trace_printk.c
> > @@ -55,6 +55,8 @@ void hold_module_trace_bprintk_format(const char **start, const char **end)
> >  
> >  	mutex_lock(&btrace_mutex);
> >  	for (iter = start; iter < end; iter++) {
> > +		if (!*iter)
> > +			goto err;
> >  		struct trace_bprintk_fmt *tb_fmt = lookup_format(*iter);
> 
> First, you can't place logic before a declaration. Not all compilers
> will allow that.
> 
> Also, do we really want to error on this or just skip it? Because it
> will miss out on all other trace_printks in the module.

I tried your patch and it works until you remove the module and try
reading the trace again. As I said, you left out later processing. This
should not exit on error. Below is a patch I wrote, and it works well.

I'll add you as reported by.

Thanks!

-- Steve


> 
> 
> >  		if (tb_fmt) {
> >  			*iter = tb_fmt->fmt;
> > @@ -75,6 +77,7 @@ void hold_module_trace_bprintk_format(const char **start, const char **end)
> >  		*iter = fmt;
> >  
> >  	}
> > +err:
> >  	mutex_unlock(&btrace_mutex);
> >  }
> >  
> 

diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
index f96f0383f6c6..ad1d6164e946 100644
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -36,6 +36,10 @@ struct trace_bprintk_fmt {
 static inline struct trace_bprintk_fmt *lookup_format(const char *fmt)
 {
 	struct trace_bprintk_fmt *pos;
+
+	if (!fmt)
+		return ERR_PTR(-EINVAL);
+
 	list_for_each_entry(pos, &trace_bprintk_fmt_list, list) {
 		if (!strcmp(pos->fmt, fmt))
 			return pos;
@@ -57,7 +61,8 @@ void hold_module_trace_bprintk_format(const char **start, const char **end)
 	for (iter = start; iter < end; iter++) {
 		struct trace_bprintk_fmt *tb_fmt = lookup_format(*iter);
 		if (tb_fmt) {
-			*iter = tb_fmt->fmt;
+			if (!IS_ERR(tb_fmt))
+				*iter = tb_fmt->fmt;
 			continue;
 		}