From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Each trace event or subsystem only holds a single filter, and
append_filter_err() / tracing_log_err() caret placement assumes a
single-line filter string. However, apply_event_filter() and
apply_subsystem_event_filter() only called strstrip(), which strips
trailing newlines but leaves embedded newlines intact.
An embedded newline in a filter string (for example inside 'CPUS{0\n"}')
causes cpulist_parse() / bitmap_parselist() to treat '\n' as the end of
the cpulist and ignore trailing characters before '}', desynchronizing
quote tracking between calc_stack() and parse_pred() and misaligning
error_log caret reporting.
Introduce an internal function filter_check_newline() to convert the
first newline to NUL and check that the rest of the input contains no
non-whitespace characters. If any non-whitespace character follows the
newline, report it as an invalid input error (-EINVAL) without modifying
the input string in-place.
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
Changes in v4:
- Verify all characters following the newline are whitespace before
writing '\0' in filter_check_newline(), preventing in-place truncation
on error, as pointed out by Sashiko.
Changes in v3:
- Introduce filter_check_newline() to convert the first newline to
NUL and reject any non-whitespace characters after the newline with
an invalid input error (-EINVAL).
---
kernel/trace/trace_events_filter.c | 36 ++++++++++++++++++++++++++++++++++++
1 file changed, 36 insertions(+)
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 40efcef94e02..0a362ccb14ad 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -2439,6 +2439,30 @@ static int process_system_preds(struct trace_subsystem_dir *dir,
return ret;
}
+/*
+ * Check that the rest of the input after the first newline contains no
+ * non-whitespace characters, and convert the newline to '\0'.
+ */
+static int filter_check_newline(char *str)
+{
+ char *nl, *p;
+
+ if (!str)
+ return 0;
+
+ nl = strchr(str, '\n');
+ if (!nl)
+ return 0;
+
+ for (p = nl + 1; *p; p++) {
+ if (!isspace(*p))
+ return -EINVAL;
+ }
+
+ *nl = '\0';
+ return 0;
+}
+
static int create_filter_start(char *filter_string, bool set_str,
struct filter_parse_error **pse,
struct event_filter **filterp)@@ -2450,6 +2474,10 @@ static int create_filter_start(char *filter_string, bool set_str,
if (WARN_ON_ONCE(*pse || *filterp))
return -EINVAL;
+ err = filter_check_newline(filter_string);
+ if (err)
+ return err;
+
filter = kzalloc_obj(*filter);
if (filter && set_str) {
filter->filter_string = kstrdup(filter_string, GFP_KERNEL);@@ -2568,6 +2596,10 @@ int apply_event_filter(struct trace_event_file *file, char *filter_string)
if (file->flags & EVENT_FILE_FL_FREED)
return -ENODEV;
+ err = filter_check_newline(filter_string);
+ if (err)
+ return err;
+
if (!strcmp(strstrip(filter_string), "0")) {
filter_disable(file);
filter = event_filter(file);@@ -2622,6 +2654,10 @@ int apply_subsystem_event_filter(struct trace_subsystem_dir *dir,
if (!dir->nr_events)
return -ENODEV;
+ err = filter_check_newline(filter_string);
+ if (err)
+ return err;
+
if (!strcmp(strstrip(filter_string), "0")) {
filter_free_subsystem_preds(dir, tr);
remove_filter_string(system->filter);