-
Bug
-
Resolution: Done-Errata
-
Normal
-
rhel-9.4
-
None
-
systemtap-5.0-4.el9
-
None
-
Moderate
-
rhel-sst-pt-perf-debug
-
ssg_platform_tools
-
15
-
16
-
1
-
False
-
-
No
-
None
-
-
All
-
None
Need to back port following upstream commit to RHEL
commit b84a5e8c2c5a857c0790a71df7824259a95131cf
Author: William Cohen <wcohen@redhat.com>
Date: Mon Dec 4 11:28:10 2023 -0500
PR31074: Ensure that the set_kernel_string* functions limit their writes
Both the set_kernel_string and set_kernel_string_n function use the
underlying stp_store_deref_string function to write strings. There
were two issues with the this function:
1) wrote MAXSTRINGLEN bytes even if string was shorter
2) null write at end could spill past end of buffer
The first issue was addressed by stopping to write once a null
character is encountered. The second issue is a side effect of C
implicit promotion of character constants to ints and was addressed by
explicitlying casting the character constants as a char.
The pr31074.exp test was added to verify that the write length are
limited to string length and the null write does not go beyond the end
of the buffer.
What were you trying to do that didn't work?
Run the testsuite/systemtap.base/set_kernel.exp test.
Please provide the package NVR for which bug is seen:
systemtap-5.0-1.el9
How reproducible:
Every time on aarch64
Steps to reproduce
- sudo dnf install systemtap-testsuite
- sudo stap-prep
- cd /usr/share/systemtap/testsuite; sudo make installcheck RUNTESTFLAGS="--debug systemtap.base/set_kernel.exp"
Expected results
All 3 tests run and pass.
Actual results:
The tracepoint_table is corrupted and end up with a fault similar to this one on f39 machine:
Running /usr/share/systemtap/testsuite/systemtap.base/set_kernel.exp ...
[43171.227321] Unable to handle kernel access to user memory outside uaccess ro0
[43171.238099] Mem abort info:
[43171.240913] ESR = 0x0000000096000004
[43171.244684] EC = 0x25: DABT (current EL), IL = 32 bits
[43171.250028] SET = 0, FnV = 0
[43171.253110] EA = 0, S1PTW = 0
[43171.256259] FSC = 0x04: level 0 translation fault
[43171.261148] Data abort info:
[43171.264039] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[43171.269537] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[43171.274615] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[43171.279949] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000098db9000
[43171.286413] [0000000000000030] pgd=0000000000000000, p4d=0000000000000000
[43171.293223] Internal error: Oops: 0000000096000004 1 SMP
[43171.298794] Modules linked in: stap_29b8f4e5f7c434a681a830a8bcf977a_237884(Od
[43171.299045] snd_pcm cpufreq_dt tegra_aconnect tegra_xudc at24 binfmt_misc ue
[43171.389128] Unloaded tainted modules: stap_64e5b22ed88e7799df9ff6107e81de_231
[43171.429814] stap_395290ca16c034e0cd4811e0682e51c_230709(OE):1 stap_38dc75ad1
[43171.519221] stap_11c0de26bdfbd87feaac6570c5097d8_223606(OE):1 stap_a9f6f50a1
[43171.607148] stap_f562c339658654a00b8b14041a6ab6c_217161(OE):1 stap_780132161
[43171.695077] stap_627dd64a2b13d6d68f1133ba79556e_210062(OE):1 stap_eaee426011
[43171.782311] stap_4790c789d5cf6db4bfa7a455c9eddd1_203190(OE):1 stap_bfaedcb71
[43171.868937] stap_74fb5b7737e309822f4b14aba18c76_190493(OE):1 stap_74fb5b7731
[43171.957392] PROCFS_BUFFER6(OE):1 PROCFS_BUFFER5(OE):1 PROCFS_BUFFER4(OE):1 1
[43172.046537] stap_9020d1dd2f6a6499532a9c32e045ca_176688(OE):1 stap_5e03d2c661
[43172.132636] stap_bec61a43fa07be420d1840df6b2af9_167809(OE):1 stap_e2b7fe5f91
[43172.219344] stap_bc15e7e30fcb74a3727ffb598ed6a8_161679(OE):1 stap_1d83b993a1
[43172.306569] stap_74aa77ab113b97630a82a23a289b43f_156077(OE):1 stap_1fbce0251
[43172.393880] stap_1338d05a59842cb789de131048d31d_148514(OE):1 stap_5ec6767371
[43172.481280] stap_49a01a93cd840e4712341377f452f5_135166(OE):1 stap_8ba9cf7a71
[43172.568598] stap_7bef8e4b3eaac294583b7f3e032961_128437(OE):1 stap_bfe41b0a91
[43172.657117] stap_c97c7a07406b2d8a68aebb3e7f6176_120965(OE):1 stap_5301703361
[43172.743896] stap_1518f5695704b46e44758675a0d52a_115190(OE):1 stap_b85c28d951
[43172.830413] stap_c44472511e2767e606b0f8c19996c0_109014(OE):1 stap_8192367291
[43172.916930] stap_641872e51bff129c305b312dfa15a8_102107(OE):1 stap_2d4375b661
[43173.003793] stap_7df78ad187143f1cc2c89b71be2eec8_91178(OE):1 stap_27a203c1a1
[43173.091610] stap_8a944ad7cf1b072b8469d3f8ce56139_79399(OE):1 stap_1fd32e7201
[43173.178480] stap_b687f47c20934a1f1b2a38db3dd84ce_69744(OE):1 stap_fab0cffab1
[43173.266040] stap_2368d4513b78ee04d0d6a5d70e38ac4_61843(OE):1 stap_4cba2ba011
[43173.352646] stap_8ab5f407b006dd2de7d2da6020b838e_55685(OE):1 stap_24df90d1c1
[43173.439436] stap_1fb4471d62062a8fb01d72f627ee287_50391(OE):1 stap_4ce06b48f1
[43173.525952] stap_d2e2758c1191b6397586b3376592ea3_43268(OE):1 stap_cbd3ef396]
[43173.632288] CPU: 2 PID: 237884 Comm: stapio Tainted: G WC OE 6.51
[43173.641244] Hardware name: nvidia p3450-0000/p3450-0000, BIOS 2020.10 10/06/0
[43173.648630] pstate: 00400005 (nzcv daif +PAN UAO -TCO -DIT -SSBS BTYPE=-)
[43173.655587] pc : __pi_strcmp+0xbc/0x140
[43173.659450] lr : get_tracepoint+0x5c/0x80 [stap_29b8f4e5f7c434a681a830a8bcf9]
[43173.667491] sp : ffff800086a6bab0
[43173.670802] x29: ffff800086a6bab0 x28: ffff800082baf850 x27: ffff80007c3b7dc0
[43173.677935] x26: ffff000010af1ec0 x25: dead000000000122 x24: dead000000000100
[43173.685071] x23: 000000000000000b x22: ffff80007c3b7380 x21: ffff000081d6e840
[43173.692202] x20: ffff80007bd73610 x19: 0000000000000001 x18: 0000000000000000
[43173.699334] x17: 000000040044ffff x16: 00500074b5503510 x15: 0000000000000000
[43173.706467] x14: ffff00008035a200 x13: ffff80007c2fb000 x12: ffff800082baf6d8
[43173.713607] x11: 0000000000000001 x10: 00007fff8428ca21 x9 : fffffffffffffe78
[43173.720738] x8 : 0101010101010101 x7 : 000000002ad85bff x6 : 0000000000000000
[43173.727870] x5 : 676461675f627375 x4 : 0000000000000000 x3 : 0000000000000000
[43173.735000] x2 : 00000000000000ea x1 : 0000000000000030 x0 : ffff80007bd73610
[43173.742135] Call trace:
[43173.744585] __pi_strcmp+0xbc/0x140
[43173.748092] stp_tracepoint_notify+0x7c/0x248 [stap_29b8f4e5f7c434a681a830a8]
[43173.756485] unregister_tracepoint_module_notifier+0x6c/0xa8
[43173.762159] stp_tracepoint_exit+0x40/0xc8 [stap_29b8f4e5f7c434a681a830a8bcf]
[43173.770281] systemtap_module_exit+0x1c4/0x2f8 [stap_29b8f4e5f7c434a681a830a]
[43173.778740] _stp_cleanup_and_exit.part.0+0xe8/0x128 [stap_29b8f4e5f7c434a68]
[43173.787727] _stp_ctl_write_cmd+0x184/0x4e8 [stap_29b8f4e5f7c434a681a830a8bc]
[43173.795927] proc_reg_write+0xa4/0x100
[43173.799692] vfs_write+0xd0/0x318
[43173.803013] ksys_write+0x7c/0x120
[43173.806419] __arm64_sys_write+0x24/0x38
[43173.810345] invoke_syscall+0x78/0x100
[43173.814103] el0_svc_common.constprop.0+0x4c/0xf8
[43173.818806] do_el0_svc+0x34/0x50
[43173.822125] el0_svc+0x34/0x108
[43173.825275] el0t_64_sync_handler+0x120/0x130
[43173.829628] el0t_64_sync+0x194/0x198
[43173.833299] Code: f240081f 54ffff41 cb010fe9 927df021 (f8408427)
[43173.839391] --[ end trace 0000000000000000 ]--
- links to
-
RHBA-2023:123795 systemtap bug fix and enhancement update
- mentioned on