linux-kernel - Re: [PATCH] tracing: Fix missing errno when zero parser->idx in trace_pid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d759c163-9673-48e5-bd6b-49446511b7e0@huawei.com>
Date: Thu, 28 Aug 2025 10:02:54 +0800
From: Pu Lehui <pulehui@...wei.com>
To: Pu Lehui <pulehui@...weicloud.com>, <rostedt@...dmis.org>,
	<mhiramat@...nel.org>, <mathieu.desnoyers@...icios.com>
CC: <linux-kernel@...r.kernel.org>, <linux-trace-kernel@...r.kernel.org>
Subject: Re: [PATCH] tracing: Fix missing errno when zero parser->idx in
 trace_pid_write



On 2025/8/21 15:17, Pu Lehui wrote:
> From: Pu Lehui <pulehui@...wei.com>
> 
> When trace_get_user in trace_pid_write parses an only space, the
> !trace_parser_loaded branch will break with no errno, causing
> tr->filtered_pids to still be assigned with pid_list, which may trigger
> potential problems.

Gentle ping~

Hi all, Is this commit looks proper?

> 
> This patch will also silence the fault injection syzkaller warning in
> tracepoint_add_func [0]. We can reproduce the warning by following the
> steps below:
> 1. echo 8 >> set_event_notrace_pid. Let tr->filtered_pids owns one pid
>     and register sched_switch tracepoint.
> 2. echo ' ' >> set_event_pid, and perform fault injection during chunk
>     allocation of trace_pid_list_alloc. Let pid_list with no pid and
> assign to tr->filtered_pids.
> 3. echo ' ' >> set_event_pid. Let pid_list is NULL and assign to
>     tr->filtered_pids.
> 4. echo 9 >> set_event_pid, will trigger the double register
>     sched_switch tracepoint warning.
> 
> Link: https://lore.kernel.org/all/67cb890e.050a0220.d8275.022e.GAE@google.com [0]
> Fixes: b27f266f74fb ("tracing: Fix return value of trace_pid_write()")
> Signed-off-by: Pu Lehui <pulehui@...wei.com>
> ---
>   kernel/trace/trace.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index 8d8935ed416d..feeb7eb71318 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -853,10 +853,10 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
>   		ubuf += ret;
>   		cnt -= ret;
>   
> +		ret = -EINVAL;
>   		if (!trace_parser_loaded(&parser))
>   			break;
>   
> -		ret = -EINVAL;
>   		if (kstrtoul(parser.buffer, 0, &val))
>   			break;
>