lkml.org 
[lkml]   [2015]   [Jun]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: perf,ftrace: fuzzer triggers warning in trace_events_filter code
On Mon, 15 Jun 2015 17:50:25 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Fri, 12 Jun 2015 21:15:10 -0400 (EDT)
> Vince Weaver <vincent.weaver@maine.edu> wrote:
>
> > On Fri, 12 Jun 2015, Steven Rostedt wrote:
> >
> > > On Fri, 12 Jun 2015 17:18:22 -0400 (EDT)
> > > Vince Weaver <vincent.weaver@maine.edu> wrote:
> > >
> > > >
> > > > So I've modified my fuzzer to try to exercise the
> > > > PERF_EVENT_IOC_SET_FILTER ioctl() and it is starting to turn up some
> > > > warnings.
> > >
> > > Is there any way to know what the filter string you used that generated
> > > this?
> >
> > Various seem to trigger it. One example is
> >
> > ext4:ext4_truncate_exit
> > (((dev<=913)blocks==916)common_type&756)
> >
>
> Does this patch fix your issue?

I got this patch all ready and set to push to Linus. But I was hoping
to add a Tested-by: from you. I already have you as Reported-by.

I would like to get this in before 4.1 is released.

Thanks,

-- Steve

>
> diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
> index 71511ebc70db..dae84db83d97 100644
> --- a/kernel/trace/trace_events_filter.c
> +++ b/kernel/trace/trace_events_filter.c
> @@ -1369,19 +1369,26 @@ static int check_preds(struct filter_parse_state *ps)
> {
> int n_normal_preds = 0, n_logical_preds = 0;
> struct postfix_elt *elt;
> + int cnt = 0;
>
> list_for_each_entry(elt, &ps->postfix, list) {
> - if (elt->op == OP_NONE)
> + if (elt->op == OP_NONE) {
> + cnt++;
> continue;
> + }
>
> if (elt->op == OP_AND || elt->op == OP_OR) {
> n_logical_preds++;
> + cnt--;
> continue;
> }
> + if (elt->op != OP_NOT)
> + cnt--;
> n_normal_preds++;
> + WARN_ON_ONCE(cnt < 0);
> }
>
> - if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
> + if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
> parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
> return -EINVAL;
> }



\
 
 \ /
  Last update: 2015-06-16 18:41    [W:0.044 / U:0.904 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site