From: Masami Hiramatsu (Google) <[email protected]>
regex_match_end() calculates string length as "len - 1", assuming @len
is the string length including trailing '\0'. For dynamic strings
(filter_pred_strloc) and pointer strings (filter_pchar), this assumption
holds and allows O(1) constant-time suffix matching.
However, for fixed-size string fields (FILTER_STATIC_STRING) and "comm"
(FILTER_COMM), the callers pass the buffer capacity rather than the
actual string length (field->size for filter_pred_string, and
TASK_COMM_LEN for filter_pred_comm). Because these buffers hold
null-terminated strings (e.g. prev_comm in sched_switch holding "bash"
in a 16-byte buffer), regex_match_end() tests against the tail of the
buffer capacity (typically trailing '\0' padding at offset 13) rather
than the actual string end. Consequently, suffix matching like
comm ~ "*sh" or prev_comm ~ "*sh" fails for all strings shorter than
the buffer capacity.
Furthermore, for trace events like ftrace/print (trace_marker), the
"buf" field is defined with size 0, denoting an unbounded NUL-terminated
string. regex_match_end() and regex_match_end_str() return 0 when len
is 0, causing suffix matching to fail on ftrace/print events as well.
To fix this without penalizing dynamic and pointer strings with an
unnecessary scan on every event:
- Introduce regex_match_end_str() using strnlen(str, len) for fixed-size
buffers (FILTER_COMM and FILTER_STATIC_STRING with field->size > 0).
- Introduce regex_match_end_dynstr() using strlen(str) for unbounded
strings (FILTER_STATIC_STRING with field->size == 0).
Assign these match callbacks in parse_pred() when MATCH_END_ONLY is
requested.
Fixes: a3291c14ecf0 ("tracing/filters: Fix MATCH_END_ONLY filter matching")
Fixes: 10f20e9f9da9 ("tracing: Have zero size length in filter logic be full
string")
Cc: [email protected]
Signed-off-by: Masami Hiramatsu (Google) <[email protected]>
---
Changes in v4:
- Drop the separate zero-length string fix patch as redundant per
review from Sashiko.
- Introduce regex_match_end_dynstr() for FILTER_STATIC_STRING fields
with size == 0 (e.g. ftrace/print buf) as suggested by Sashiko.
Changes in v3:
- Split from zero-length string fix into a dedicated patch.
- Introduce regex_match_end_str() for fixed-size buffers and assign
it in parse_pred() for FILTER_COMM and FILTER_STATIC_STRING, avoiding
strnlen() overhead for dynamic and pointer strings in regex_match_end().
---
kernel/trace/trace_events_filter.c | 32 ++++++++++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/kernel/trace/trace_events_filter.c
b/kernel/trace/trace_events_filter.c
index 5e74d2dae40a..28977d10e60b 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1083,6 +1083,30 @@ static int regex_match_end(char *str, struct regex *r,
int len)
return 0;
}
+static int regex_match_end_str(char *str, struct regex *r, int len)
+{
+ int slen;
+
+ if (len < r->len)
+ return 0;
+
+ slen = strnlen(str, len);
+ if (slen >= r->len &&
+ memcmp(str + slen - r->len, r->pattern, r->len) == 0)
+ return 1;
+ return 0;
+}
+
+static int regex_match_end_dynstr(char *str, struct regex *r, int len)
+{
+ int slen = strlen(str);
+
+ if (slen >= r->len &&
+ memcmp(str + slen - r->len, r->pattern, r->len) == 0)
+ return 1;
+ return 0;
+}
+
static int regex_match_glob(char *str, struct regex *r, int len)
{
return glob_match_len(r->pattern, str, len) ? 1 : 0;
@@ -2022,10 +2046,18 @@ static int parse_pred(const char *str, void *data,
if (field->filter_type == FILTER_COMM) {
pred->fn_num = FILTER_PRED_FN_COMM;
+ if (pred->regex->match == regex_match_end)
+ pred->regex->match = regex_match_end_str;
} else if (field->filter_type == FILTER_STATIC_STRING) {
pred->fn_num = FILTER_PRED_FN_STRING;
pred->regex->field_len = field->size;
+ if (pred->regex->match == regex_match_end) {
+ if (!field->size)
+ pred->regex->match =
regex_match_end_dynstr;
+ else
+ pred->regex->match =
regex_match_end_str;
+ }
} else if (field->filter_type == FILTER_DYN_STRING) {
pred->fn_num = FILTER_PRED_FN_STRLOC;
