Skip to content

Commit

Permalink
tracing/syscalls: Ignore numbers outside NR_syscalls' range
Browse files Browse the repository at this point in the history
ARM has some private syscalls (for example, set_tls(2)) which lie
outside the range of NR_syscalls.  If any of these are called while
syscall tracing is being performed, out-of-bounds array access will
occur in the ftrace and perf sys_{enter,exit} handlers.

 # trace-cmd record -e raw_syscalls:* true && trace-cmd report
 ...
 true-653   [000]   384.675777: sys_enter:            NR 192 (0, 1000, 3, 4000022, ffffffff, 0)
 true-653   [000]   384.675812: sys_exit:             NR 192 = 1995915264
 true-653   [000]   384.675971: sys_enter:            NR 983045 (76f74480, 76f74000, 76f74b28, 76f74480, 76f76f74, 1)
 true-653   [000]   384.675988: sys_exit:             NR 983045 = 0
 ...

 # trace-cmd record -e syscalls:* true
 [   17.289329] Unable to handle kernel paging request at virtual address aaaaaace
 [   17.289590] pgd = 9e71c000
 [   17.289696] [aaaaaace] *pgd=00000000
 [   17.289985] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
 [   17.290169] Modules linked in:
 [   17.290391] CPU: 0 PID: 704 Comm: true Not tainted 3.18.0-rc2+ torvalds#21
 [   17.290585] task: 9f4dab00 ti: 9e710000 task.ti: 9e710000
 [   17.290747] PC is at ftrace_syscall_enter+0x48/0x1f8
 [   17.290866] LR is at syscall_trace_enter+0x124/0x184

Fix this by ignoring out-of-NR_syscalls-bounds syscall numbers.

Commit cd0980f "tracing: Check invalid syscall nr while tracing syscalls"
added the check for less than zero, but it should have also checked
for greater than NR_syscalls.

Link: http://lkml.kernel.org/p/[email protected]

Fixes: cd0980f "tracing: Check invalid syscall nr while tracing syscalls"
Cc: [email protected] # 2.6.33+
Signed-off-by: Rabin Vincent <[email protected]>
Signed-off-by: Steven Rostedt <[email protected]>

Conflicts:
	kernel/trace/trace_syscalls.c

Change-Id: I512142f8f1e1b2a8dc063209666dbce9737377e7
  • Loading branch information
vitkyrka authored and marado committed Aug 7, 2015
1 parent cb6d7dc commit 9d0224e
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions kernel/trace/trace_syscalls.c
Original file line number Diff line number Diff line change
Expand Up @@ -307,7 +307,7 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs *regs, long id)
int syscall_nr;

syscall_nr = syscall_get_nr(current, regs);
if (syscall_nr < 0)
if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
return;
if (!test_bit(syscall_nr, enabled_enter_syscalls))
return;
Expand Down Expand Up @@ -341,7 +341,7 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
int syscall_nr;

syscall_nr = syscall_get_nr(current, regs);
if (syscall_nr < 0)
if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
return;
if (!test_bit(syscall_nr, enabled_exit_syscalls))
return;
Expand Down Expand Up @@ -506,7 +506,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
int size;

syscall_nr = syscall_get_nr(current, regs);
if (syscall_nr < 0)
if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
return;
if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
return;
Expand Down Expand Up @@ -582,7 +582,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
int size;

syscall_nr = syscall_get_nr(current, regs);
if (syscall_nr < 0)
if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
return;
if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
return;
Expand Down

0 comments on commit 9d0224e

Please sign in to comment.