Count-only perf tracepoint events can be opened without tracepoint
permission because they do not sample raw event data. Their SET_FILTER
ioctl still parses .function predicates. Numeric operands call
kallsyms_lookup_size_offset(), making ioctl success an oracle for
recovering the randomized kernel text base. Symbolic operands resolve
hidden symbol addresses and can also match user-controlled event fields
against those addresses.
Pass the perf origin through filter parsing and require
perf_allow_tracepoint() before resolving either form of .function
operand. Ordinary perf count filters and tracefs event filters retain
their existing behavior.
Fixes: e6745a4da964 ("tracing: Add a way to filter function addresses to
function names")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Zhengchuan Liang <[email protected]>
---
kernel/trace/trace_events_filter.c | 39 ++++++++++++++++++++++--------
1 file changed, 29 insertions(+), 10 deletions(-)
diff --git a/kernel/trace/trace_events_filter.c
b/kernel/trace/trace_events_filter.c
index 2b46ca536045..f99b0f1e32d8 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1625,12 +1625,18 @@ static int filter_pred_fn_call(struct filter_pred
*pred, void *event)
}
}
+struct event_filter_parse_data {
+ struct trace_event_call *call;
+ bool from_perf;
+};
+
/* Called when a predicate is encountered by predicate_parse() */
static int parse_pred(const char *str, void *data,
int pos, struct filter_parse_error *pe,
struct filter_pred **pred_ptr)
{
- struct trace_event_call *call = data;
+ struct event_filter_parse_data *parse_data = data;
+ struct trace_event_call *call = parse_data->call;
struct ftrace_event_field *field;
struct filter_pred *pred = NULL;
unsigned long offset;
@@ -1686,6 +1692,12 @@ static int parse_pred(const char *str, void *data,
function = true;
i += len;
}
+ if (function && parse_data->from_perf) {
+ /* Both numeric and symbolic operands resolve kernel addresses.
*/
+ ret = perf_allow_tracepoint();
+ if (ret)
+ return ret;
+ }
while (isspace(str[i]))
i++;
@@ -2205,8 +2217,13 @@ static int calc_stack(const char *str, int *parens, int
*preds, int *err)
static int process_preds(struct trace_event_call *call,
const char *filter_string,
struct event_filter *filter,
- struct filter_parse_error *pe)
+ struct filter_parse_error *pe,
+ bool from_perf)
{
+ struct event_filter_parse_data data = {
+ .call = call,
+ .from_perf = from_perf,
+ };
struct prog_entry *prog;
int nr_parens;
int nr_preds;
@@ -2232,7 +2249,7 @@ static int process_preds(struct trace_event_call *call,
return -EINVAL;
prog = predicate_parse(filter_string, nr_parens, nr_preds,
- parse_pred, call, pe);
+ parse_pred, &data, pe);
if (IS_ERR(prog))
return PTR_ERR(prog);
@@ -2281,7 +2298,8 @@ static int process_system_preds(struct
trace_subsystem_dir *dir,
if (!filter->filter_string)
goto fail_mem;
- err = process_preds(file->event_call, filter_string, filter,
pe);
+ err = process_preds(file->event_call, filter_string, filter, pe,
+ false);
if (err) {
filter_disable(file);
parse_error(pe, FILT_ERR_BAD_SUBSYS_FILTER, 0);
@@ -2377,6 +2395,7 @@ static void create_filter_finish(struct
filter_parse_error *pe)
* @call: trace_event_call to create a filter for
* @filter_string: filter string
* @set_str: remember @filter_str and enable detailed error in filter
+ * @from_perf: require tracepoint permission for function predicates
* @filterp: out param for created filter (always updated on return)
* Must be a pointer that references a NULL pointer.
*
@@ -2391,7 +2410,7 @@ static void create_filter_finish(struct
filter_parse_error *pe)
*/
static int create_filter(struct trace_array *tr,
struct trace_event_call *call,
- char *filter_string, bool set_str,
+ char *filter_string, bool set_str, bool from_perf,
struct event_filter **filterp)
{
struct filter_parse_error *pe = NULL;
@@ -2405,7 +2424,7 @@ static int create_filter(struct trace_array *tr,
if (err)
return err;
- err = process_preds(call, filter_string, *filterp, pe);
+ err = process_preds(call, filter_string, *filterp, pe, from_perf);
if (err && set_str)
append_filter_err(tr, pe, *filterp);
create_filter_finish(pe);
@@ -2418,7 +2437,7 @@ int create_event_filter(struct trace_array *tr,
char *filter_str, bool set_str,
struct event_filter **filterp)
{
- return create_filter(tr, call, filter_str, set_str, filterp);
+ return create_filter(tr, call, filter_str, set_str, false, filterp);
}
/**
@@ -2476,7 +2495,7 @@ int apply_event_filter(struct trace_event_file *file,
char *filter_string)
return 0;
}
- err = create_filter(file->tr, call, filter_string, true, &filter);
+ err = create_filter(file->tr, call, filter_string, true, false,
&filter);
/*
* Always swap the call filter with the new filter
@@ -2721,7 +2740,7 @@ int ftrace_profile_set_filter(struct perf_event *event,
int event_id,
if (event->filter)
return -EEXIST;
- err = create_filter(NULL, call, filter_str, false, &filter);
+ err = create_filter(NULL, call, filter_str, false, true, &filter);
if (err)
goto free_filter;
@@ -2868,7 +2887,7 @@ static __init int ftrace_test_event_filter(void)
int err;
err = create_filter(NULL, &event_ftrace_test_filter,
- d->filter, false, &filter);
+ d->filter, false, false, &filter);
if (err) {
printk(KERN_INFO
"Failed to get filter for '%s', err %d\n",
--
2.34.1
