Messages in this thread | | | Date | Tue, 16 Jun 2015 12:17:25 -0400 | From | Steven Rostedt <> | Subject | Re: perf,ftrace: fuzzer triggers warning in trace_events_filter code |
| |
On Mon, 15 Jun 2015 17:50:25 -0400 Steven Rostedt <rostedt@goodmis.org> wrote:
> On Fri, 12 Jun 2015 21:15:10 -0400 (EDT) > Vince Weaver <vincent.weaver@maine.edu> wrote: > > > On Fri, 12 Jun 2015, Steven Rostedt wrote: > > > > > On Fri, 12 Jun 2015 17:18:22 -0400 (EDT) > > > Vince Weaver <vincent.weaver@maine.edu> wrote: > > > > > > > > > > > So I've modified my fuzzer to try to exercise the > > > > PERF_EVENT_IOC_SET_FILTER ioctl() and it is starting to turn up some > > > > warnings. > > > > > > Is there any way to know what the filter string you used that generated > > > this? > > > > Various seem to trigger it. One example is > > > > ext4:ext4_truncate_exit > > (((dev<=913)blocks==916)common_type&756) > > > > Does this patch fix your issue?
I got this patch all ready and set to push to Linus. But I was hoping to add a Tested-by: from you. I already have you as Reported-by.
I would like to get this in before 4.1 is released.
Thanks,
-- Steve
> > diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c > index 71511ebc70db..dae84db83d97 100644 > --- a/kernel/trace/trace_events_filter.c > +++ b/kernel/trace/trace_events_filter.c > @@ -1369,19 +1369,26 @@ static int check_preds(struct filter_parse_state *ps) > { > int n_normal_preds = 0, n_logical_preds = 0; > struct postfix_elt *elt; > + int cnt = 0; > > list_for_each_entry(elt, &ps->postfix, list) { > - if (elt->op == OP_NONE) > + if (elt->op == OP_NONE) { > + cnt++; > continue; > + } > > if (elt->op == OP_AND || elt->op == OP_OR) { > n_logical_preds++; > + cnt--; > continue; > } > + if (elt->op != OP_NOT) > + cnt--; > n_normal_preds++; > + WARN_ON_ONCE(cnt < 0); > } > > - if (!n_normal_preds || n_logical_preds >= n_normal_preds) { > + if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { > parse_error(ps, FILT_ERR_INVALID_FILTER, 0); > return -EINVAL; > }
| |