diff mbox series

[v4,4/4] tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails

Message ID 168904151104.2908673.8401909922292791503.stgit@mhiramat.roam.corp.google.com (mailing list archive)
State Superseded
Headers show
Series tracing/probes: Fix bugs in process_fetch_insn | expand

Commit Message

Masami Hiramatsu (Google) July 11, 2023, 2:11 a.m. UTC 
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Fix to record 0-length data to data_loc in fetch_store_string*() if it fails
to get the string data.
Currently those expect that the data_loc is updated by store_trace_args() if
it returns the error code. However, that does not work correctly if the
argument is an array of strings. In that case, store_trace_args() only clears
the first entry of the array (which may have no error) and leaves other
entries. So it should be cleared by fetch_store_string*() itself.
Also, 'dyndata' and 'maxlen' in store_trace_args() should be updated
only if it is used (ret > 0 and argument is a dynamic data.)

Fixes: 40b53b771806 ("tracing: probeevent: Add array type support")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 Changes in v4:
  - Simplify the updating data_loc code with set_data_loc().
---
 kernel/trace/trace_probe_kernel.h |   13 +++++++++----
 kernel/trace/trace_probe_tmpl.h   |    4 +---
 kernel/trace/trace_uprobe.c       |    3 ++-
 3 files changed, 12 insertions(+), 8 deletions(-)

Comments

Steven Rostedt July 11, 2023, 3:34 a.m. UTC | #1 
On Tue, 11 Jul 2023 11:11:51 +0900
"Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:

> --- a/kernel/trace/trace_probe_tmpl.h
> +++ b/kernel/trace/trace_probe_tmpl.h
> @@ -267,9 +267,7 @@ store_trace_args(void *data, struct trace_probe *tp, void *rec,
>  		if (unlikely(arg->dynamic))
>  			*dl = make_data_loc(maxlen, dyndata - base);
>  		ret = process_fetch_insn(arg->code, rec, dl, base);
> -		if (unlikely(ret < 0 && arg->dynamic)) {
> -			*dl = make_data_loc(0, dyndata - base);
> -		} else {
> +		if (unlikely(ret > 0 && arg->dynamic)) {

To match the current code, that should be:

		if (likely(ret >= 0 || !arg->dynamic)) {

But I'm guessing that the original code was buggy, as the else block should
only have been processed if arg->dynamic was set? That is, it should have been:

	if (arg->dynamic) {
		if (unlikely(ret < 0)) {
			*dl = make_data_loc(0, dyndata - base);
		} else {
  			dyndata += ret;
  			maxlen -= ret;
  		}
	}


I guess you only want to update if arg->dynamic is true (even though that
wasn't the case before :-/) But in any case, I think you want likely() and
not unlikely().

		if (arg->dynamic && likely(ret > 0)) {

That is, if we only want to updated this if the arg is dynamic.

And I don't think that the arg->dynamic() should have likely/unlikely
around it, as that's determined by user space, and the kernel should not be
adding assumptions about what user space wants.

-- Steve

>  			dyndata += ret;
>  			maxlen -= ret;
>  		}
Masami Hiramatsu (Google) July 11, 2023, 4:56 a.m. UTC | #2 
On Mon, 10 Jul 2023 23:34:00 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Tue, 11 Jul 2023 11:11:51 +0900
> "Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:
> 
> > --- a/kernel/trace/trace_probe_tmpl.h
> > +++ b/kernel/trace/trace_probe_tmpl.h
> > @@ -267,9 +267,7 @@ store_trace_args(void *data, struct trace_probe *tp, void *rec,
> >  		if (unlikely(arg->dynamic))
> >  			*dl = make_data_loc(maxlen, dyndata - base);
> >  		ret = process_fetch_insn(arg->code, rec, dl, base);
> > -		if (unlikely(ret < 0 && arg->dynamic)) {
> > -			*dl = make_data_loc(0, dyndata - base);
> > -		} else {
> > +		if (unlikely(ret > 0 && arg->dynamic)) {
> 
> To match the current code, that should be:
> 
> 		if (likely(ret >= 0 || !arg->dynamic)) {
> 
> But I'm guessing that the original code was buggy, as the else block should
> only have been processed if arg->dynamic was set?

Good point, yes, that's right. Since dyndata and maxlen is only used when
arg->dynamic == true, we don't have to care about that.

> That is, it should have been:
> 
> 	if (arg->dynamic) {
> 		if (unlikely(ret < 0)) {
> 			*dl = make_data_loc(0, dyndata - base);
> 		} else {
>   			dyndata += ret;
>   			maxlen -= ret;
>   		}
> 	}
> 
> 
> I guess you only want to update if arg->dynamic is true (even though that
> wasn't the case before :-/) But in any case, I think you want likely() and
> not unlikely().
> 
> 		if (arg->dynamic && likely(ret > 0)) {
> 
> That is, if we only want to updated this if the arg is dynamic.

Indeed.

> 
> And I don't think that the arg->dynamic() should have likely/unlikely
> around it, as that's determined by user space, and the kernel should not be
> adding assumptions about what user space wants.

OK.

Let me fix that with a new patch because it is another bug.

Thanks,

> 
> -- Steve
> 
> >  			dyndata += ret;
> >  			maxlen -= ret;
> >  		}
diff mbox series

Patch

diff --git a/kernel/trace/trace_probe_kernel.h b/kernel/trace/trace_probe_kernel.h
index 6deae2ce34f8..bb723eefd7b7 100644
--- a/kernel/trace/trace_probe_kernel.h
+++ b/kernel/trace/trace_probe_kernel.h
@@ -37,6 +37,13 @@  fetch_store_strlen(unsigned long addr)
 	return (ret < 0) ? ret : len;
 }
 
+static nokprobe_inline void set_data_loc(int ret, void *dest, void *__dest, void *base)
+{
+	if (ret < 0)
+		ret = 0;
+	*(u32 *)dest = make_data_loc(ret, __dest - base);
+}
+
 /*
  * Fetch a null-terminated string from user. Caller MUST set *(u32 *)buf
  * with max length and relative data location.
@@ -55,8 +62,7 @@  fetch_store_string_user(unsigned long addr, void *dest, void *base)
 	__dest = get_loc_data(dest, base);
 
 	ret = strncpy_from_user_nofault(__dest, uaddr, maxlen);
-	if (ret >= 0)
-		*(u32 *)dest = make_data_loc(ret, __dest - base);
+	set_data_loc(ret, dest, __dest, base);
 
 	return ret;
 }
@@ -87,8 +93,7 @@  fetch_store_string(unsigned long addr, void *dest, void *base)
 	 * probing.
 	 */
 	ret = strncpy_from_kernel_nofault(__dest, (void *)addr, maxlen);
-	if (ret >= 0)
-		*(u32 *)dest = make_data_loc(ret, __dest - base);
+	set_data_loc(ret, dest, __dest, base);
 
 	return ret;
 }
diff --git a/kernel/trace/trace_probe_tmpl.h b/kernel/trace/trace_probe_tmpl.h
index ed9d57c6b041..bbad0503f166 100644
--- a/kernel/trace/trace_probe_tmpl.h
+++ b/kernel/trace/trace_probe_tmpl.h
@@ -267,9 +267,7 @@  store_trace_args(void *data, struct trace_probe *tp, void *rec,
 		if (unlikely(arg->dynamic))
 			*dl = make_data_loc(maxlen, dyndata - base);
 		ret = process_fetch_insn(arg->code, rec, dl, base);
-		if (unlikely(ret < 0 && arg->dynamic)) {
-			*dl = make_data_loc(0, dyndata - base);
-		} else {
+		if (unlikely(ret > 0 && arg->dynamic)) {
 			dyndata += ret;
 			maxlen -= ret;
 		}
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 8b92e34ff0c8..7b47e9a2c010 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -170,7 +170,8 @@  fetch_store_string(unsigned long addr, void *dest, void *base)
 			 */
 			ret++;
 		*(u32 *)dest = make_data_loc(ret, (void *)dst - base);
-	}
+	} else
+		*(u32 *)dest = make_data_loc(0, (void *)dst - base);
 
 	return ret;
 }