linux-kernel - Re: [GIT PULL] tracing: Two event pid filtering bug fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 27 Nov 2021 16:41:20 -0500
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Ingo Molnar <mingo@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Tom Zanussi <zanussi@...nel.org>,
        Tzvetomir Stoyanov <tz.stoyanov@...il.com>
Subject: Re: [GIT PULL] tracing: Two event pid filtering bug fixes

On Sat, 27 Nov 2021 13:28:22 -0500
Steven Rostedt <rostedt@...dmis.org> wrote:

> +	struct trace_pid_list *no_pid_list;
> +	struct trace_pid_list *pid_list;
>  	struct trace_event_file *file;
> +	unsigned int first;
>  
>  	file = kmem_cache_alloc(file_cachep, GFP_TRACE);
>  	if (!file)
>  		return NULL;
>  
> +	pid_list = rcu_dereference_protected(tr->filtered_pids,
> +					     lockdep_is_held(&event_mutex));
> +	no_pid_list = rcu_dereference_protected(tr->filtered_no_pids,
> +					     lockdep_is_held(&event_mutex));
> +
> +	if (!trace_pid_list_first(pid_list, &first) ||
> +	    !trace_pid_list_first(pid_list, &first))
> +		file->flags |= EVENT_FILE_FL_PID_FILTER;

And of course since I only tested "trace only this pid" case, and not
the "trace everything but this pid" case, the above has a bug (which
the ktest bot just told me about), and my tests missed it.

That should have been:

	if (!trace_pid_list_first(pid_list, &first) ||
	    !trace_pid_list_first(no_pid_list, &first))

I'll fix it, run it through my tests, and post another pull request :-/.

/me needs to add that case to his tests, even though it's extremely
rare (I never use it). Which is exactly why I should have a test for it!

-- Steve