• Steven Rostedt (VMware)'s avatar
    tracing: Check return value of __create_val_fields() before using its result · 6d9bd139
    Steven Rostedt (VMware) authored
    After having a typo for writing a histogram trigger.
    
    Wrote:
      echo 'hist:key=pid:ts=common_timestamp.usec' > events/sched/sched_waking/trigger
    
    Instead of:
      echo 'hist:key=pid:ts=common_timestamp.usecs' > events/sched/sched_waking/trigger
    
    and the following crash happened:
    
     BUG: kernel NULL pointer dereference, address: 0000000000000008
     #PF: supervisor read access in kernel mode
     #PF: error_code(0x0000) - not-present page
     PGD 0 P4D 0
     Oops: 0000 [#1] PREEMPT SMP PTI
     CPU: 4 PID: 1641 Comm: sh Not tainted 5.9.0-rc5-test+ #549
     Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v03.03 07/14/2016
     RIP: 0010:event_hist_trigger_func+0x70b/0x1ee0
     Code: 24 08 89 d5 49 89 cc e9 8c 00 00 00 4c 89 f2 41 b9 00 10 00 00 4c 89 e1 44 89 ee 4c 89 ff e8 dc d3 ff ff 45 89 ea 4b 8b 14 d7 <f6> 42 08 04 74 17 41 8b 8f c0 00 00 00 8d 71 01 41 89 b7 c0 00 00
     RSP: 0018:ffff959213d53db0 EFLAGS: 00010202
     RAX: ffffffffffffffea RBX: 0000000000000000 RCX: 0000000000084c04
     RDX: 0000000000000000 RSI: df7326aefebd174c RDI: 0000000000031080
     RBP: 0000000000000002 R08: 0000000000000001 R09: 0000000000000001
     R10: 0000000000000001 R11: 0000000000000046 R12: ffff959211dcf690
     R13: 0000000000000001 R14: ffff95925a36e370 R15: ffff959251c89800
     FS:  00007fb9ea934740(0000) GS:ffff95925ab00000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 0000000000000008 CR3: 00000000c976c005 CR4: 00000000001706e0
     Call Trace:
      ? trigger_process_regex+0x78/0x110
      trigger_process_regex+0xc5/0x110
      event_trigger_write+0x71/0xd0
      vfs_write+0xca/0x210
      ksys_write+0x70/0xf0
      do_syscall_64+0x33/0x40
      entry_SYSCALL_64_after_hwframe+0x44/0xa9
     RIP: 0033:0x7fb9eaa29487
     Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
    
    This was caused by accessing the hlist_data fields after the call to
    __create_val_fields() without checking if the creation succeed.
    
    Link: https://lkml.kernel.org/r/20201013154852.3abd8702@gandalf.local.home
    
    Fixes: 63a1e5de ("tracing: Save normal string variables")
    Reviewed-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
    Reviewed-by: default avatarTom Zanussi <zanussi@kernel.org>
    Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
    6d9bd139
trace_events_hist.c 142 KB