From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_2 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 647EEC4743C for ; Sat, 5 Jun 2021 02:45:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4601F613F1 for ; Sat, 5 Jun 2021 02:45:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231438AbhFECre (ORCPT ); Fri, 4 Jun 2021 22:47:34 -0400 Received: from mail.kernel.org ([198.145.29.99]:50244 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230169AbhFECre (ORCPT ); Fri, 4 Jun 2021 22:47:34 -0400 Received: from rorschach.local.home (cpe-66-24-58-225.stny.res.rr.com [66.24.58.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 64762613EA; Sat, 5 Jun 2021 02:45:46 +0000 (UTC) Date: Fri, 4 Jun 2021 22:45:44 -0400 From: Steven Rostedt To: Sean Christopherson Cc: linux-kernel@vger.kernel.org, Ingo Molnar , Andrew Morton , Masami Hiramatsu , Linus Torvalds , Jacob Wen , Paolo Bonzini Subject: Re: [PATCH 2/2] tracing: Add a verifier to check string pointers for trace events Message-ID: <20210604224544.134c652f@rorschach.local.home> In-Reply-To: <20210604222830.2505d67a@rorschach.local.home> References: <20210226185909.100032746@goodmis.org> <20210226190705.871102407@goodmis.org> <20210604222830.2505d67a@rorschach.local.home> X-Mailer: Claws Mail 3.17.8 (GTK+ 2.24.33; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 4 Jun 2021 22:28:30 -0400 Steven Rostedt wrote: > What you described to me does not sound like a false positive, and > converting to __string() is not a workaround but an actual fix, and > would also need to be backported to stable. If the event you are talking about is kvm_nested_vmenter_failed, which records a pointer to the message, then, yes, that is unsafe and buggy. If that event is defined by the kvm module, and used in kvm_intel. If you have this: # echo 1 > /sys/kernel/tracing/events/kvm/kvm_nested_vmenter_failed # do_whatever_causes_that_to_trigger # rmmod kvm_intel # cat trace Then that pointer to the string will point to some random memory. Before this patch, it could even possibly crash the kernel! There's two fixes you can do with this. One is to covert that to use __string, the other is to do what RCU does, and use the tracepoint_string() functionality. RCU has: #define TPS(x) tracepoint_string(x) And wrap all strings with that TPS(), like in nested_vmx_reflect_vmexit(): if (unlikely(vmx->fail)) { trace_kvm_nested_vmenter_failed( - "hardware VM-instruction error: ", + TPS("hardware VM-instruction error: "), vmcs_read32(VM_INSTRUCTION_ERROR)); exit_intr_info = 0; exit_qual = 0; goto reflect_vmexit; } What the tracepoint_string does is to save the string into core kernel memory (there's logic to use the same string if it is already available), and it wont free it when the module is unloaded. This makes the string safe to use by the trace event directly. Not only is the TPS safe, it also allows userspace tools to know what the string is, as it is exported in printk_formats. Otherwise trace-cmd and perf will only display a pointer hex value as it has no idea what its pointing to (both TPS and __string fixes this). -- Steve