Skip to content

Commit 83b6268

Browse files
committed
workqueue/tracing: Copy workqueue name to buffer in trace event
The trace event "workqueue_queue_work" references an unsafe string in dereferencing the name of the workqueue. As the name is allocated, it could later be freed, and the pointer to that string could stay on the tracing buffer. If the trace buffer is read after the string is freed, it will reference an unsafe pointer. I added a new verifier to make sure that all strings referenced in the output of the trace buffer is safe to read and this triggered on the workqueue_queue_work trace event: workqueue_queue_work: work struct=00000000b2b235c7 function=gc_worker workqueue=(0xffff888100051160:events_power_efficient)[UNSAFE-MEMORY] req_cpu=256 cpu=1 workqueue_queue_work: work struct=00000000c344caec function=flush_to_ldisc workqueue=(0xffff888100054d60:events_unbound)[UNSAFE-MEMORY] req_cpu=256 cpu=4294967295 workqueue_queue_work: work struct=00000000b2b235c7 function=gc_worker workqueue=(0xffff888100051160:events_power_efficient)[UNSAFE-MEMORY] req_cpu=256 cpu=1 workqueue_queue_work: work struct=000000000b238b3f function=vmstat_update workqueue=(0xffff8881000c3760:mm_percpu_wq)[UNSAFE-MEMORY] req_cpu=1 cpu=1 Also, if this event is read via a user space application like perf or trace-cmd, the name would only be an address and useless information: workqueue_queue_work: work struct=0xffff953f80b4b918 function=disk_events_workfn workqueue=ffff953f8005d378 req_cpu=8192 cpu=5 Cc: Zqiang <qiang.zhang@windriver.com> Cc: Tejun Heo <tj@kernel.org> Fixes: 7bf9c4a ("workqueue: tracing the name of the workqueue instead of it's address") Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
1 parent 1e28eed commit 83b6268

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

include/trace/events/workqueue.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,21 +30,21 @@ TRACE_EVENT(workqueue_queue_work,
3030
TP_STRUCT__entry(
3131
__field( void *, work )
3232
__field( void *, function)
33-
__field( const char *, workqueue)
33+
__string( workqueue, pwq->wq->name)
3434
__field( unsigned int, req_cpu )
3535
__field( unsigned int, cpu )
3636
),
3737

3838
TP_fast_assign(
3939
__entry->work = work;
4040
__entry->function = work->func;
41-
__entry->workqueue = pwq->wq->name;
41+
__assign_str(workqueue, pwq->wq->name);
4242
__entry->req_cpu = req_cpu;
4343
__entry->cpu = pwq->pool->cpu;
4444
),
4545

4646
TP_printk("work struct=%p function=%ps workqueue=%s req_cpu=%u cpu=%u",
47-
__entry->work, __entry->function, __entry->workqueue,
47+
__entry->work, __entry->function, __get_str(workqueue),
4848
__entry->req_cpu, __entry->cpu)
4949
);
5050

0 commit comments

Comments
 (0)