From: Masami Hiramatsu (Google) <[email protected]>
In parse_pred(), after matching the operator and skipping whitespace,
the filter string may terminate (str[i] == '\0') if the operand is
missing (e.g. "ip ==" or "common_pid ==").
For function events, the loop 'for (i++; str[i]; i++)' unconditionally
increments 'i' past the NUL terminator, causing an out-of-bounds read.
For other event types, allocating a predicate only to fail later during
value parsing is wasteful.
Check if 'str[i]' is NUL immediately after skipping whitespace after
the operator, and report FILT_ERR_INVALID_FILTER.
Fixes: 80765597bc58 ("tracing: Rewrite filter logic to be simpler and faster")
Cc: [email protected]
Signed-off-by: Masami Hiramatsu (Google) <[email protected]>
---
Changes in v3:
- Split from the monolithic function event parsing patch.
- Check if str[i] is NUL immediately after skipping whitespace after
the operator in parse_pred() across all event types, as suggested
by Steven Rostedt.
---
kernel/trace/trace_events_filter.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/trace/trace_events_filter.c
b/kernel/trace/trace_events_filter.c
index b8d765ca9f1a..a7a89e0f9b87 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1762,6 +1762,11 @@ static int parse_pred(const char *str, void *data,
while (isspace(str[i]))
i++;
+ if (!str[i]) {
+ parse_error(pe, FILT_ERR_INVALID_FILTER, pos + i);
+ goto err_free;
+ }
+
s = i;
pred = kzalloc_obj(*pred);
