This is a note to let you know that I've just added the patch titled
tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails
to the 6.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
tracing-probes-fix-to-record-0-length-data_loc-in-fetch_store_string-if-fails.patch
and it can be found in the queue-6.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 797311bce5c2ac90b8d65e357603cfd410d36ebb Mon Sep 17 00:00:00 2001
From: "Masami Hiramatsu (Google)" <mhiramat@xxxxxxxxxx>
Date: Tue, 11 Jul 2023 23:16:07 +0900
Subject: tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails
From: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
commit 797311bce5c2ac90b8d65e357603cfd410d36ebb upstream.
Fix to record 0-length data to data_loc in fetch_store_string*() if it fails
to get the string data.
Currently those expect that the data_loc is updated by store_trace_args() if
it returns the error code. However, that does not work correctly if the
argument is an array of strings. In that case, store_trace_args() only clears
the first entry of the array (which may have no error) and leaves other
entries. So it should be cleared by fetch_store_string*() itself.
Also, 'dyndata' and 'maxlen' in store_trace_args() should be updated
only if it is used (ret > 0 and argument is a dynamic data.)
Link: https://lore.kernel.org/all/168908496683.123124.4761206188794205601.stgit@devnote2/
Fixes: 40b53b771806 ("tracing: probeevent: Add array type support")
Cc: stable@xxxxxxxxxxxxxxx
Reviewed-by: Steven Rostedt (Google) <rostedt@xxxxxxxxxxx>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
kernel/trace/trace_probe_kernel.h | 13 +++++++++----
kernel/trace/trace_probe_tmpl.h | 10 +++-------
kernel/trace/trace_uprobe.c | 3 ++-
3 files changed, 14 insertions(+), 12 deletions(-)
--- a/kernel/trace/trace_probe_kernel.h
+++ b/kernel/trace/trace_probe_kernel.h
@@ -37,6 +37,13 @@ fetch_store_strlen(unsigned long addr)
return (ret < 0) ? ret : len;
}
+static nokprobe_inline void set_data_loc(int ret, void *dest, void *__dest, void *base)
+{
+ if (ret < 0)
+ ret = 0;
+ *(u32 *)dest = make_data_loc(ret, __dest - base);
+}
+
/*
* Fetch a null-terminated string from user. Caller MUST set *(u32 *)buf
* with max length and relative data location.
@@ -55,8 +62,7 @@ fetch_store_string_user(unsigned long ad
__dest = get_loc_data(dest, base);
ret = strncpy_from_user_nofault(__dest, uaddr, maxlen);
- if (ret >= 0)
- *(u32 *)dest = make_data_loc(ret, __dest - base);
+ set_data_loc(ret, dest, __dest, base);
return ret;
}
@@ -87,8 +93,7 @@ fetch_store_string(unsigned long addr, v
* probing.
*/
ret = strncpy_from_kernel_nofault(__dest, (void *)addr, maxlen);
- if (ret >= 0)
- *(u32 *)dest = make_data_loc(ret, __dest - base);
+ set_data_loc(ret, dest, __dest, base);
return ret;
}
--- a/kernel/trace/trace_probe_tmpl.h
+++ b/kernel/trace/trace_probe_tmpl.h
@@ -267,13 +267,9 @@ store_trace_args(void *data, struct trac
if (unlikely(arg->dynamic))
*dl = make_data_loc(maxlen, dyndata - base);
ret = process_fetch_insn(arg->code, rec, dl, base);
- if (arg->dynamic) {
- if (unlikely(ret < 0)) {
- *dl = make_data_loc(0, dyndata - base);
- } else {
- dyndata += ret;
- maxlen -= ret;
- }
+ if (arg->dynamic && likely(ret > 0)) {
+ dyndata += ret;
+ maxlen -= ret;
}
}
}
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -170,7 +170,8 @@ fetch_store_string(unsigned long addr, v
*/
ret++;
*(u32 *)dest = make_data_loc(ret, (void *)dst - base);
- }
+ } else
+ *(u32 *)dest = make_data_loc(0, (void *)dst - base);
return ret;
}
Patches currently in stable-queue which might be from mhiramat@xxxxxxxxxx are
queue-6.4/tracing-probes-fix-to-avoid-double-count-of-the-string-length-on-the-array.patch
queue-6.4/fprobe-release-rethook-after-the-ftrace_ops-is-unregistered.patch
queue-6.4/revert-tracing-add-fault-name-injection-to-kernel-probes.patch
queue-6.4/tracing-probes-fix-to-update-dynamic-data-counter-if-fetcharg-uses-it.patch
queue-6.4/fprobe-ensure-running-fprobe_exit_handler-finished-before-calling-rethook_free.patch
queue-6.4/tracing-probes-fix-to-record-0-length-data_loc-in-fetch_store_string-if-fails.patch
queue-6.4/tracing-fix-null-pointer-dereference-in-tracing_err_log_open.patch
queue-6.4/fprobe-add-unlock-to-match-a-succeeded-ftrace_test_r.patch
queue-6.4/kernel-trace-fix-cleanup-logic-of-enable_trace_eprob.patch
queue-6.4/tracing-probes-fix-not-to-count-error-code-to-total-length.patch
