Message-ID: <20241218013828.733621977@goodmis.org>
Date: Tue, 17 Dec 2024 20:38:28 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: linux-kernel@...r.kernel.org
Cc: Masami Hiramatsu <mhiramat@...nel.org>,
 Mark Rutland <mark.rutland@....com>,
 Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 Andrew Morton <akpm@...ux-foundation.org>
Subject: [for-linus][PATCH 0/4] tracing: Fixes for v6.13

tracing fixes for v6.13:

- Replace trace_check_vprintf() with test_event_printk() and ignore_event()

  The function test_event_printk() checks on boot up if the trace event
  printf() formats dereference any pointers, and if they do, it then looks
  at the arguments to make sure that the pointers they dereference will
  exist in the event on the ring buffer. If they do not, it issues a
  WARN_ON() as it is a likely bug.

  But this isn't the case for the strings that can be dereferenced with
  "%s", as some trace events (notably RCU and some IPI events) save
  a pointer to a static string in the ring buffer. As the string it
  points to lives as long as the kernel is running, it is not a bug
  to reference it, as it is guaranteed to be there when the event is read.
  But it is also possible (and a common bug) to point to some allocated
  string that could be freed before the trace event is read and the
  dereference is to bad memory. This case requires a run time check.

  The previous way to handle this was with trace_check_vprintf() that would
  process the printf format piece by piece and send what it didn't care
  about to vsnprintf() to handle arguments that were not strings. This
  kept it from having to reimplement vsnprintf(). But it relied on va_list
  implementation and for architectures that copied the va_list and did
  not pass it by reference, it wasn't even possible to do this check and
  it would be skipped. As 64bit x86 passed va_list by reference, most
  events were tested and this kept out bugs where strings would have been
  dereferenced after being freed.

  Instead of relying on the implementation of va_list, extend the boot up
  test_event_printk() function to validate all the "%s" strings that
  can be validated at boot, and for the few events that point to strings
  outside the ring buffer, flag both the event and the field that is
  dereferenced as "needs_test". Then before the event is printed, a call
  to ignore_event() is made, and if the event has the flag set, it iterates
  all its fields and for every field that is to be tested, it will read
  the pointer directly from the event in the ring buffer and make sure
  that it is valid. If the pointer is not valid, it will print a WARN_ON(),
  print out to the trace that the event has unsafe memory and ignore
  the print format.

  With this new update, the trace_check_vprintf() can be safely removed
  and now all events can be verified regardless of architecture.

Steven Rostedt (4):
      tracing: Fix test_event_printk() to process entire print argument
      tracing: Add missing helper functions in event pointer dereference check
      tracing: Add "%s" check in test_event_printk()
      tracing: Check "%s" dereference via the field and not the TP_printk format

----
 include/linux/trace_events.h |   6 +-
 kernel/trace/trace.c         | 255 +++++++++----------------------------------
 kernel/trace/trace.h         |   6 +-
 kernel/trace/trace_events.c  | 225 +++++++++++++++++++++++++++++---------
 kernel/trace/trace_output.c  |   6 +-
 5 files changed, 242 insertions(+), 256 deletions(-)

Powered by blists - more mailing lists