Skip to content

Commit 9171104

Browse files
committed
tracing: Add missing helper functions in event pointer dereference check
The process_pointer() helper function looks to see if various trace event macros are used. These macros are for storing data in the event. This makes it safe to dereference as the dereference will then point into the event on the ring buffer where the content of the data stays with the event itself. A few helper functions were missing. Those were: __get_rel_dynamic_array() __get_dynamic_array_len() __get_rel_dynamic_array_len() __get_rel_sockaddr() Also add a helper function find_print_string() to not need to use a middle man variable to test if the string exists. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Al Viro <viro@ZenIV.linux.org.uk> Cc: Linus Torvalds <torvalds@linux-foundation.org> Link: https://lore.kernel.org/20241217024720.521836792@goodmis.org Fixes: 5013f45 ("tracing: Add check of trace event print fmts for dereferencing pointers") Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
1 parent a662962 commit 9171104

1 file changed

Lines changed: 19 additions & 2 deletions

File tree

kernel/trace/trace_events.c

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,15 @@ static bool test_field(const char *fmt, struct trace_event_call *call)
274274
return false;
275275
}
276276

277+
/* Look for a string within an argument */
278+
static bool find_print_string(const char *arg, const char *str, const char *end)
279+
{
280+
const char *r;
281+
282+
r = strstr(arg, str);
283+
return r && r < end;
284+
}
285+
277286
/* Return true if the argument pointer is safe */
278287
static bool process_pointer(const char *fmt, int len, struct trace_event_call *call)
279288
{
@@ -292,9 +301,17 @@ static bool process_pointer(const char *fmt, int len, struct trace_event_call *c
292301
a = strchr(fmt, '&');
293302
if ((a && (a < r)) || test_field(r, call))
294303
return true;
295-
} else if ((r = strstr(fmt, "__get_dynamic_array(")) && r < e) {
304+
} else if (find_print_string(fmt, "__get_dynamic_array(", e)) {
305+
return true;
306+
} else if (find_print_string(fmt, "__get_rel_dynamic_array(", e)) {
307+
return true;
308+
} else if (find_print_string(fmt, "__get_dynamic_array_len(", e)) {
309+
return true;
310+
} else if (find_print_string(fmt, "__get_rel_dynamic_array_len(", e)) {
311+
return true;
312+
} else if (find_print_string(fmt, "__get_sockaddr(", e)) {
296313
return true;
297-
} else if ((r = strstr(fmt, "__get_sockaddr(")) && r < e) {
314+
} else if (find_print_string(fmt, "__get_rel_sockaddr(", e)) {
298315
return true;
299316
}
300317
return false;

0 commit comments

Comments
 (0)