Re: [PATCH] tracing: Fix missing errno when zero parser->idx in trace_pid_write

On 2025/8/21 15:17, Pu Lehui wrote:

From: Pu Lehui <pulehui@huawei.com>

When trace_get_user in trace_pid_write parses an only space, the
!trace_parser_loaded branch will break with no errno, causing
tr->filtered_pids to still be assigned with pid_list, which may trigger
potential problems.

Hi Steven,

Sorry, this patch will break the cleanup functionality of "set_ftrace_pid" as indicated in [0]. Pls ignore this patch.

Link: https://lore.kernel.org/all/202509022339.ae20a8bb-lkp@intel.com (local) [0]

This patch will also silence the fault injection syzkaller warning in
tracepoint_add_func [0]. We can reproduce the warning by following the
steps below:
1. echo 8 >> set_event_notrace_pid. Let tr->filtered_pids owns one pid
    and register sched_switch tracepoint.
2. echo ' ' >> set_event_pid, and perform fault injection during chunk
    allocation of trace_pid_list_alloc. Let pid_list with no pid and
assign to tr->filtered_pids.
3. echo ' ' >> set_event_pid. Let pid_list is NULL and assign to
    tr->filtered_pids.
4. echo 9 >> set_event_pid, will trigger the double register
    sched_switch tracepoint warning.

As for this fault injection syzkaller issue, shall we need to silence it? How about the below fix?

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index e6b50b416e63..c17c031e7917 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c

@@ -834,7 +834,11 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
                /* copy the current bits to the new max */
                ret = trace_pid_list_first(filtered_pids, &pid);
                while (!ret) {
-                       trace_pid_list_set(pid_list, pid);
+                       ret = trace_pid_list_set(pid_list, pid);
+                       if (ret) {
+                               trace_parser_put(&parser);
+                               return ret;
+                       }
                        ret = trace_pid_list_next(filtered_pids, pid + 1, &pid);
                        nr_pids++;
                }