Patch "tracing/user_events: Fix non-spaced field matching" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tracing/user_events: Fix non-spaced field matching

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tracing-user_events-fix-non-spaced-field-matching.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d3611c0716c22e8f110b9fc02c8470774172bf76
Author: Beau Belgrave <beaub@xxxxxxxxxxxxxxxxxxx>
Date:   Tue Apr 23 16:23:37 2024 +0000

    tracing/user_events: Fix non-spaced field matching
    
    [ Upstream commit bd125a084091396f3e796bb3dc009940d9771811 ]
    
    When the ABI was updated to prevent same name w/different args, it
    missed an important corner case when fields don't end with a space.
    Typically, space is used for fields to help separate them, like
    "u8 field1; u8 field2". If no spaces are used, like
    "u8 field1;u8 field2", then the parsing works for the first time.
    However, the match check fails on a subsequent register, leading to
    confusion.
    
    This is because the match check uses argv_split() and assumes that all
    fields will be split upon the space. When spaces are used, we get back
    { "u8", "field1;" }, without spaces we get back { "u8", "field1;u8" }.
    This causes a mismatch, and the user program gets back -EADDRINUSE.
    
    Add a method to detect this case before calling argv_split(). If found
    force a space after the field separator character ';'. This ensures all
    cases work properly for matching.
    
    With this fix, the following are all treated as matching:
    u8 field1;u8 field2
    u8 field1; u8 field2
    u8 field1;\tu8 field2
    u8 field1;\nu8 field2
    
    Link: https://lore.kernel.org/linux-trace-kernel/20240423162338.292-2-beaub@xxxxxxxxxxxxxxxxxxx
    
    Fixes: ba470eebc2f6 ("tracing/user_events: Prevent same name but different args event")
    Signed-off-by: Beau Belgrave <beaub@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Steven Rostedt (Google) <rostedt@xxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c
index dda58681247e1..2461786b1e4d2 100644
--- a/kernel/trace/trace_events_user.c
+++ b/kernel/trace/trace_events_user.c
@@ -1923,6 +1923,80 @@ static int user_event_trace_register(struct user_event *user)
 	return ret;
 }
 
+/*
+ * Counts how many ';' without a trailing space are in the args.
+ */
+static int count_semis_no_space(char *args)
+{
+	int count = 0;
+
+	while ((args = strchr(args, ';'))) {
+		args++;
+
+		if (!isspace(*args))
+			count++;
+	}
+
+	return count;
+}
+
+/*
+ * Copies the arguments while ensuring all ';' have a trailing space.
+ */
+static char *insert_space_after_semis(char *args, int count)
+{
+	char *fixed, *pos;
+	int len;
+
+	len = strlen(args) + count;
+	fixed = kmalloc(len + 1, GFP_KERNEL);
+
+	if (!fixed)
+		return NULL;
+
+	pos = fixed;
+
+	/* Insert a space after ';' if there is no trailing space. */
+	while (*args) {
+		*pos = *args++;
+
+		if (*pos++ == ';' && !isspace(*args))
+			*pos++ = ' ';
+	}
+
+	*pos = '\0';
+
+	return fixed;
+}
+
+static char **user_event_argv_split(char *args, int *argc)
+{
+	char **split;
+	char *fixed;
+	int count;
+
+	/* Count how many ';' without a trailing space */
+	count = count_semis_no_space(args);
+
+	/* No fixup is required */
+	if (!count)
+		return argv_split(GFP_KERNEL, args, argc);
+
+	/* We must fixup 'field;field' to 'field; field' */
+	fixed = insert_space_after_semis(args, count);
+
+	if (!fixed)
+		return NULL;
+
+	/* We do a normal split afterwards */
+	split = argv_split(GFP_KERNEL, fixed, argc);
+
+	/* We can free since argv_split makes a copy */
+	kfree(fixed);
+
+	return split;
+}
+
 /*
  * Parses the event name, arguments and flags then registers if successful.
  * The name buffer lifetime is owned by this method for success cases only.
@@ -1946,7 +2020,7 @@ static int user_event_parse(struct user_event_group *group, char *name,
 		return -EPERM;
 
 	if (args) {
-		argv = argv_split(GFP_KERNEL, args, &argc);
+		argv = user_event_argv_split(args, &argc);
 
 		if (!argv)
 			return -ENOMEM;