[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <e3c22d00-1a0c-45e0-bc76-955d367ab4d1@huawei.com>
Date: Wed, 3 Sep 2025 12:15:16 +0800
From: Pu Lehui <pulehui@...wei.com>
To: <rostedt@...dmis.org>
CC: <mhiramat@...nel.org>, <mathieu.desnoyers@...icios.com>, Pu Lehui
<pulehui@...weicloud.com>, <linux-kernel@...r.kernel.org>,
<linux-trace-kernel@...r.kernel.org>
Subject: Re: [PATCH] tracing: Fix missing errno when zero parser->idx in
trace_pid_write
On 2025/8/21 15:17, Pu Lehui wrote:
> From: Pu Lehui <pulehui@...wei.com>
>
> When trace_get_user in trace_pid_write parses an only space, the
> !trace_parser_loaded branch will break with no errno, causing
> tr->filtered_pids to still be assigned with pid_list, which may trigger
> potential problems.
Hi Steven,
Sorry, this patch will break the cleanup functionality of
"set_ftrace_pid" as indicated in [0]. Pls ignore this patch.
Link: https://lore.kernel.org/all/202509022339.ae20a8bb-lkp@intel.com [0]
>
> This patch will also silence the fault injection syzkaller warning in
> tracepoint_add_func [0]. We can reproduce the warning by following the
> steps below:
> 1. echo 8 >> set_event_notrace_pid. Let tr->filtered_pids owns one pid
> and register sched_switch tracepoint.
> 2. echo ' ' >> set_event_pid, and perform fault injection during chunk
> allocation of trace_pid_list_alloc. Let pid_list with no pid and
> assign to tr->filtered_pids.
> 3. echo ' ' >> set_event_pid. Let pid_list is NULL and assign to
> tr->filtered_pids.
> 4. echo 9 >> set_event_pid, will trigger the double register
> sched_switch tracepoint warning.
As for this fault injection syzkaller issue, shall we need to silence
it? How about the below fix?
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index e6b50b416e63..c17c031e7917 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -834,7 +834,11 @@ int trace_pid_write(struct trace_pid_list
*filtered_pids,
/* copy the current bits to the new max */
ret = trace_pid_list_first(filtered_pids, &pid);
while (!ret) {
- trace_pid_list_set(pid_list, pid);
+ ret = trace_pid_list_set(pid_list, pid);
+ if (ret) {
+ trace_parser_put(&parser);
+ return ret;
+ }
ret = trace_pid_list_next(filtered_pids, pid +
1, &pid);
nr_pids++;
}
>
> Link: https://lore.kernel.org/all/67cb890e.050a0220.d8275.022e.GAE@google.com [0]
> Fixes: b27f266f74fb ("tracing: Fix return value of trace_pid_write()")
> Signed-off-by: Pu Lehui <pulehui@...wei.com>
> ---
> kernel/trace/trace.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index 8d8935ed416d..feeb7eb71318 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -853,10 +853,10 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
> ubuf += ret;
> cnt -= ret;
>
> + ret = -EINVAL;
> if (!trace_parser_loaded(&parser))
> break;
>
> - ret = -EINVAL;
> if (kstrtoul(parser.buffer, 0, &val))
> break;
>
Powered by blists - more mailing lists