On Tue, 06 Feb 2018 17:43:39 -0500 Steven Rostedt <rostedt@xxxxxxxxxxx> wrote: > From: "Steven Rostedt (VMware)" <rostedt@xxxxxxxxxxx> > > __unregister_ftrace_function_probe() will incorrectly parse the glob filter > because it resets the search variable that was setup by filter_parse_regex(). > > Al Viro reported this: > > After that call of filter_parse_regex() we could have func_g.search not > equal to glob only if glob started with '!' or '*'. In the former case > we would've buggered off with -EINVAL (not = 1). In the latter we > would've set func_g.search equal to glob + 1, calculated the length of > that thing in func_g.len and proceeded to reset func_g.search back to > glob. > > Suppose the glob is e.g. *foo*. We end up with > func_g.type = MATCH_MIDDLE_ONLY; > func_g.len = 3; > func_g.search = "*foo"; > Feeding that to ftrace_match_record() will not do anything sane - we > will be looking for names containing "*foo" (->len is ignored for that > one). > > Link: http://lkml.kernel.org/r/20180127031706.GE13338@xxxxxxxxxxxxxxxxxx > > Cc: stable@xxxxxxxxxxxxxxx > Cc: Dmitry Safonov <0x7f454c46@xxxxxxxxx> > Fixes: 3ba009297149f ("ftrace: Introduce ftrace_glob structure") > Reported-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx> > Signed-off-by: Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx> Reviewed-by: Masami Hiramatsu <mhiramat@xxxxxxxxxx> Thank you! > --- > kernel/trace/ftrace.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c > index dabd9d167d42..eac9ce2c57a2 100644 > --- a/kernel/trace/ftrace.c > +++ b/kernel/trace/ftrace.c > @@ -4456,7 +4456,6 @@ unregister_ftrace_function_probe_func(char *glob, struct trace_array *tr, > func_g.type = filter_parse_regex(glob, strlen(glob), > &func_g.search, ¬); > func_g.len = strlen(func_g.search); > - func_g.search = glob; > > /* we do not support '!' for function probes */ > if (WARN_ON(not)) > -- > 2.15.1 > > -- Masami Hiramatsu <mhiramat@xxxxxxxxxx>