From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755798AbbFPQRh (ORCPT ); Tue, 16 Jun 2015 12:17:37 -0400 Received: from smtprelay0248.hostedemail.com ([216.40.44.248]:56515 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750707AbbFPQR2 (ORCPT ); Tue, 16 Jun 2015 12:17:28 -0400 X-Session-Marker: 726F737465647440676F6F646D69732E6F7267 X-Spam-Summary: 2,0,0,,d41d8cd98f00b204,rostedt@goodmis.org,:::::::::,RULES_HIT:41:355:379:541:599:800:960:973:988:989:1260:1277:1311:1313:1314:1345:1359:1437:1515:1516:1518:1534:1542:1593:1594:1711:1730:1747:1777:1792:2393:2553:2559:2562:2898:3138:3139:3140:3141:3142:3354:3622:3865:3867:3868:3870:3871:3872:3873:3874:4321:4362:5007:6119:6261:7875:7903:9010:10004:10400:10848:10967:11026:11232:11473:11658:11914:12043:12296:12438:12517:12519:12555:12740:14096:14097:21080,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fn,MSBL:0,DNSBL:none,Custom_rules:0:0:0 X-HE-Tag: duck89_40ff5f7140136 X-Filterd-Recvd-Size: 3150 Date: Tue, 16 Jun 2015 12:17:25 -0400 From: Steven Rostedt To: Vince Weaver Cc: linux-kernel@vger.kernel.org, Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo Subject: Re: perf,ftrace: fuzzer triggers warning in trace_events_filter code Message-ID: <20150616121725.6a6c7e42@gandalf.local.home> In-Reply-To: <20150615175025.7e809215@gandalf.local.home> References: <20150612174045.1e9b0ca0@gandalf.local.home> <20150615175025.7e809215@gandalf.local.home> X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.25; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 15 Jun 2015 17:50:25 -0400 Steven Rostedt wrote: > On Fri, 12 Jun 2015 21:15:10 -0400 (EDT) > Vince Weaver wrote: > > > On Fri, 12 Jun 2015, Steven Rostedt wrote: > > > > > On Fri, 12 Jun 2015 17:18:22 -0400 (EDT) > > > Vince Weaver wrote: > > > > > > > > > > > So I've modified my fuzzer to try to exercise the > > > > PERF_EVENT_IOC_SET_FILTER ioctl() and it is starting to turn up some > > > > warnings. > > > > > > Is there any way to know what the filter string you used that generated > > > this? > > > > Various seem to trigger it. One example is > > > > ext4:ext4_truncate_exit > > (((dev<=913)blocks==916)common_type&756) > > > > Does this patch fix your issue? I got this patch all ready and set to push to Linus. But I was hoping to add a Tested-by: from you. I already have you as Reported-by. I would like to get this in before 4.1 is released. Thanks, -- Steve > > diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c > index 71511ebc70db..dae84db83d97 100644 > --- a/kernel/trace/trace_events_filter.c > +++ b/kernel/trace/trace_events_filter.c > @@ -1369,19 +1369,26 @@ static int check_preds(struct filter_parse_state *ps) > { > int n_normal_preds = 0, n_logical_preds = 0; > struct postfix_elt *elt; > + int cnt = 0; > > list_for_each_entry(elt, &ps->postfix, list) { > - if (elt->op == OP_NONE) > + if (elt->op == OP_NONE) { > + cnt++; > continue; > + } > > if (elt->op == OP_AND || elt->op == OP_OR) { > n_logical_preds++; > + cnt--; > continue; > } > + if (elt->op != OP_NOT) > + cnt--; > n_normal_preds++; > + WARN_ON_ONCE(cnt < 0); > } > > - if (!n_normal_preds || n_logical_preds >= n_normal_preds) { > + if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { > parse_error(ps, FILT_ERR_INVALID_FILTER, 0); > return -EINVAL; > }