mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 11:19:37 +00:00
83b62687a0
The trace event "workqueue_queue_work" references an unsafe string in
dereferencing the name of the workqueue. As the name is allocated, it
could later be freed, and the pointer to that string could stay on the
tracing buffer. If the trace buffer is read after the string is freed, it
will reference an unsafe pointer.
I added a new verifier to make sure that all strings referenced in the
output of the trace buffer is safe to read and this triggered on the
workqueue_queue_work trace event:
workqueue_queue_work: work struct=00000000b2b235c7 function=gc_worker workqueue=(0xffff888100051160:events_power_efficient)[UNSAFE-MEMORY] req_cpu=256 cpu=1
workqueue_queue_work: work struct=00000000c344caec function=flush_to_ldisc workqueue=(0xffff888100054d60:events_unbound)[UNSAFE-MEMORY] req_cpu=256 cpu=4294967295
workqueue_queue_work: work struct=00000000b2b235c7 function=gc_worker workqueue=(0xffff888100051160:events_power_efficient)[UNSAFE-MEMORY] req_cpu=256 cpu=1
workqueue_queue_work: work struct=000000000b238b3f function=vmstat_update workqueue=(0xffff8881000c3760:mm_percpu_wq)[UNSAFE-MEMORY] req_cpu=1 cpu=1
Also, if this event is read via a user space application like perf or
trace-cmd, the name would only be an address and useless information:
workqueue_queue_work: work struct=0xffff953f80b4b918 function=disk_events_workfn workqueue=ffff953f8005d378 req_cpu=8192 cpu=5
Cc: Zqiang <qiang.zhang@windriver.com>
Cc: Tejun Heo <tj@kernel.org>
Fixes: 7bf9c4a88e ("workqueue: tracing the name of the workqueue instead of it's address")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
130 lines
2.9 KiB
C
130 lines
2.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#undef TRACE_SYSTEM
|
|
#define TRACE_SYSTEM workqueue
|
|
|
|
#if !defined(_TRACE_WORKQUEUE_H) || defined(TRACE_HEADER_MULTI_READ)
|
|
#define _TRACE_WORKQUEUE_H
|
|
|
|
#include <linux/tracepoint.h>
|
|
#include <linux/workqueue.h>
|
|
|
|
struct pool_workqueue;
|
|
|
|
/**
|
|
* workqueue_queue_work - called when a work gets queued
|
|
* @req_cpu: the requested cpu
|
|
* @pwq: pointer to struct pool_workqueue
|
|
* @work: pointer to struct work_struct
|
|
*
|
|
* This event occurs when a work is queued immediately or once a
|
|
* delayed work is actually queued on a workqueue (ie: once the delay
|
|
* has been reached).
|
|
*/
|
|
TRACE_EVENT(workqueue_queue_work,
|
|
|
|
TP_PROTO(unsigned int req_cpu, struct pool_workqueue *pwq,
|
|
struct work_struct *work),
|
|
|
|
TP_ARGS(req_cpu, pwq, work),
|
|
|
|
TP_STRUCT__entry(
|
|
__field( void *, work )
|
|
__field( void *, function)
|
|
__string( workqueue, pwq->wq->name)
|
|
__field( unsigned int, req_cpu )
|
|
__field( unsigned int, cpu )
|
|
),
|
|
|
|
TP_fast_assign(
|
|
__entry->work = work;
|
|
__entry->function = work->func;
|
|
__assign_str(workqueue, pwq->wq->name);
|
|
__entry->req_cpu = req_cpu;
|
|
__entry->cpu = pwq->pool->cpu;
|
|
),
|
|
|
|
TP_printk("work struct=%p function=%ps workqueue=%s req_cpu=%u cpu=%u",
|
|
__entry->work, __entry->function, __get_str(workqueue),
|
|
__entry->req_cpu, __entry->cpu)
|
|
);
|
|
|
|
/**
|
|
* workqueue_activate_work - called when a work gets activated
|
|
* @work: pointer to struct work_struct
|
|
*
|
|
* This event occurs when a queued work is put on the active queue,
|
|
* which happens immediately after queueing unless @max_active limit
|
|
* is reached.
|
|
*/
|
|
TRACE_EVENT(workqueue_activate_work,
|
|
|
|
TP_PROTO(struct work_struct *work),
|
|
|
|
TP_ARGS(work),
|
|
|
|
TP_STRUCT__entry(
|
|
__field( void *, work )
|
|
),
|
|
|
|
TP_fast_assign(
|
|
__entry->work = work;
|
|
),
|
|
|
|
TP_printk("work struct %p", __entry->work)
|
|
);
|
|
|
|
/**
|
|
* workqueue_execute_start - called immediately before the workqueue callback
|
|
* @work: pointer to struct work_struct
|
|
*
|
|
* Allows to track workqueue execution.
|
|
*/
|
|
TRACE_EVENT(workqueue_execute_start,
|
|
|
|
TP_PROTO(struct work_struct *work),
|
|
|
|
TP_ARGS(work),
|
|
|
|
TP_STRUCT__entry(
|
|
__field( void *, work )
|
|
__field( void *, function)
|
|
),
|
|
|
|
TP_fast_assign(
|
|
__entry->work = work;
|
|
__entry->function = work->func;
|
|
),
|
|
|
|
TP_printk("work struct %p: function %ps", __entry->work, __entry->function)
|
|
);
|
|
|
|
/**
|
|
* workqueue_execute_end - called immediately after the workqueue callback
|
|
* @work: pointer to struct work_struct
|
|
* @function: pointer to worker function
|
|
*
|
|
* Allows to track workqueue execution.
|
|
*/
|
|
TRACE_EVENT(workqueue_execute_end,
|
|
|
|
TP_PROTO(struct work_struct *work, work_func_t function),
|
|
|
|
TP_ARGS(work, function),
|
|
|
|
TP_STRUCT__entry(
|
|
__field( void *, work )
|
|
__field( void *, function)
|
|
),
|
|
|
|
TP_fast_assign(
|
|
__entry->work = work;
|
|
__entry->function = function;
|
|
),
|
|
|
|
TP_printk("work struct %p: function %ps", __entry->work, __entry->function)
|
|
);
|
|
|
|
#endif /* _TRACE_WORKQUEUE_H */
|
|
|
|
/* This part must be outside protection */
|
|
#include <trace/define_trace.h>
|