linux-kernel - [GIT PULL] tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200415214033.47e3f95f@oasis.local.home>
Date:   Wed, 15 Apr 2020 21:40:33 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Xiao Yang <yangx.jy@...fujitsu.com>
Subject: [GIT PULL] tracing: Fix the race between registering 'snapshot'
 event trigger and triggering 'snapshot' operation


Linus,

This fixes a small race between allocating a snapshot buffer and setting the
snapshot trigger. On a slow machine, the trigger can occur before the
snapshot is allocated causing a warning to be displayed in the ring buffer,
and no snapshot triggering. Reversing the allocation and the enabling of the
trigger fixes the problem.


Please pull the latest trace-v5.7-rc1 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
trace-v5.7-rc1

Tag SHA1: c27f0128144b8ec3d133d39c81ccdbb53ce811e8
Head SHA1: 0bbe7f719985efd9adb3454679ecef0984cb6800


Xiao Yang (1):
      tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation

----
 kernel/trace/trace_events_trigger.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)
---------------------------
commit 0bbe7f719985efd9adb3454679ecef0984cb6800
Author: Xiao Yang <yangx.jy@...fujitsu.com>
Date:   Tue Apr 14 09:51:45 2020 +0800

    tracing: Fix the race between registering 'snapshot' event trigger and triggering 'snapshot' operation
    
    Traced event can trigger 'snapshot' operation(i.e. calls snapshot_trigger()
    or snapshot_count_trigger()) when register_snapshot_trigger() has completed
    registration but doesn't allocate buffer for 'snapshot' event trigger.  In
    the rare case, 'snapshot' operation always detects the lack of allocated
    buffer so make register_snapshot_trigger() allocate buffer first.
    
    trigger-snapshot.tc in kselftest reproduces the issue on slow vm:
    -----------------------------------------------------------
    cat trace
    ...
    ftracetest-3028  [002] ....   236.784290: sched_process_fork: comm=ftracetest pid=3028 child_comm=ftracetest child_pid=3036
         <...>-2875  [003] ....   240.460335: tracing_snapshot_instance_cond: *** SNAPSHOT NOT ALLOCATED ***
         <...>-2875  [003] ....   240.460338: tracing_snapshot_instance_cond: *** stopping trace here!   ***
    -----------------------------------------------------------
    
    Link: http://lkml.kernel.org/r/20200414015145.66236-1-yangx.jy@cn.fujitsu.com
    
    Cc: stable@...r.kernel.org
    Fixes: 93e31ffbf417a ("tracing: Add 'snapshot' event trigger command")
    Signed-off-by: Xiao Yang <yangx.jy@...fujitsu.com>
    Signed-off-by: Steven Rostedt (VMware) <rostedt@...dmis.org>

diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index dd34a1b46a86..3a74736da363 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1088,14 +1088,10 @@ register_snapshot_trigger(char *glob, struct event_trigger_ops *ops,
 			  struct event_trigger_data *data,
 			  struct trace_event_file *file)
 {
-	int ret = register_trigger(glob, ops, data, file);
-
-	if (ret > 0 && tracing_alloc_snapshot_instance(file->tr) != 0) {
-		unregister_trigger(glob, ops, data, file);
-		ret = 0;
-	}
+	if (tracing_alloc_snapshot_instance(file->tr) != 0)
+		return 0;
 
-	return ret;
+	return register_trigger(glob, ops, data, file);
 }
 
 static int