mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-27 22:13:55 -04:00
Code Issues Packages Projects Releases Wiki Activity

tracing: Warn when an event dereferences a pointer in TP_printk()

Browse Source 
Currently on boot up and when modules are loaded, the trace event
infrastructure will examine the TP_printk's of every event looking to see
if it dereferences pointers on the ring buffer via printk formats like
"%pB" and such. What it doesn't do is check if the arguments themselves
do a dereference from a pointer.

This was brought with a fix[1] to the fsl_edma event that had in the
arguments of the TP_printk(): "__entry->edma->membase"

The __entry->edma is a pointer saved in the ring buffer. The dereference
from TP_printk() happens when the user reads the "trace" file which can be
seconds, minutes, hours, days, weeks, or even months later! There is no
guarantee that the __entry->edma pointer will still be pointing to what it
was when it was recorded, and could crash the kernel when a user reads the
event.

Add logic to the test_event_printk() that also checks for this case and
warn if the event dereferences a pointer from the ring buffer.

[1] https://lore.kernel.org/all/20260630200022.1826420-1-martin@kaiser.cx/

Link: https://patch.msgid.link/20260630184836.74d477b6@gandalf.local.home
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Reviewed-by: Martin Kaiser <martin@kaiser.cx>
Reviewed-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
This commit is contained in:
Steven Rostedt
2026-06-30 18:48:36 -04:00
parent ac00ffdbbc
commit b5cc230af5
1 changed files with 29 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
kernel/trace/trace_events.c
View File

@@ -401,6 +401,31 @@ static bool process_string(const char *fmt, int len, struct trace_event_call *ca
return true;
}
static void test_double_dereference(const char *str, int len,
struct trace_event_call *call)
{
const char *ptr;
const char *end = str + len;
ptr = strstr(str, "REC->");
while (ptr && ptr < end) {
ptr += 5;
for (; ptr < end; ptr++) {
if (ptr[0] == '-' && ptr[1] == '>') {
WARN_ONCE(1, "Event %s has double dereference in TP_printk: %.*s\n",
trace_event_name(call), len, str);
return;
}
if (!isalnum(*ptr) && *ptr != '_')
break;
}
ptr = strstr(ptr, "REC->");
}
}
static void handle_dereference_arg(const char *arg_str, u64 string_flags, int len,
u64 *dereference_flags, int arg,
struct trace_event_call *call)
@@ -460,12 +485,6 @@ static void test_event_printk(struct trace_event_call *call)
if (in_quote) {
arg = 0;
first = false;
/*
* If there was no %p* uses
* the fmt is OK.
*/
if (!dereference_flags)
return;
}
}
if (in_quote) {
@@ -577,6 +596,8 @@ static void test_event_printk(struct trace_event_call *call)
continue;
}
test_double_dereference(fmt + start_arg, e - start_arg, call);
if (dereference_flags & (1ULL << arg)) {
handle_dereference_arg(fmt + start_arg, string_flags,
e - start_arg,
@@ -590,6 +611,8 @@ static void test_event_printk(struct trace_event_call *call)
}
}
test_double_dereference(fmt + start_arg, i - start_arg, call);
if (dereference_flags & (1ULL << arg)) {
handle_dereference_arg(fmt + start_arg, string_flags,
i - start_arg,