Skip to contentSkip to conversation

tracing/osnoise: Replace kmalloc + copy_from_user with memdup_user

PATCH Superseded Thorsten Blum 2 participants 6 messages Sep 25, 2025 – Oct 1, 2025

Subsystems (2)
Tracing Tracing OS noise / latency tracers

v2 of 3 Superseded Latest is v3 →

lore
Share & tools
lore

Thorsten Blum

author
#0 lore raw

PATCH v2 1/1 tracing/osnoise: Replace kmalloc + copy_from_user with memdup_user

Replace kmalloc() followed by copy_from_user() with memdup_user() to simplify and improve osnoise_cpus_write().

No functional changes intended.

Signed-off-by Thorsten Blum <[email protected]>

---
Changes in v2:
- Rebase to apply to master and linux-next
- Explicitly include linux/string.h
- Link to v1: https://lore.kernel.org/lkml/[email protected]/

---
 kernel/trace/trace_osnoise.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)
kernel/trace/trace_osnoise.c +4 -6
index 337bc0eb5d71..ab0575a94be1 100644
@@ -24,6 +24,7 @@
 #include <linux/sched/clock.h>
 #include <uapi/linux/sched/types.h>
 #include <linux/sched.h>
+#include <linux/string.h>
 #include "trace.h"
 
 #ifdef CONFIG_X86_LOCAL_APIC

@@ -2325,12 +2326,9 @@ osnoise_cpus_write(struct file *filp, const char __user *ubuf, size_t count,
 	if (count < 1)
 		return 0;
 
-	buf = kmalloc(count, GFP_KERNEL);
-	if (!buf)
-		return -ENOMEM;
-
-	if (copy_from_user(buf, ubuf, count))
-		return -EFAULT;
+	buf = memdup_user(ubuf, count);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
 
 	if (!zalloc_cpumask_var(&osnoise_cpumask_new, GFP_KERNEL))
 		return -ENOMEM;
Signature · 1 line
2.51.0
maintainer
#1 lore raw
Quoted 4 lines · On Thu, 25 Sep 2025 23:17:36 +0200 Thorsten Blum <[email protected]>…

#ifdef CONFIG_X86_LOCAL_APIC

kernel/trace/trace_osnoise.c +0 -0
@@ -2325,12 +2326,9 @@ osnoise_cpus_write(struct file *filp, const char __user *ubuf, size_t count,
 	if (count < 1)
 		return 0;

kernel/trace/trace_osnoise.c osnoise_cpus_write(struct file *filp, const char __user *ubuf, size_t count, · line 2331

Quoted 10 lines
kernel/trace/trace_osnoise.c +3 -6
 
-	buf = kmalloc(count, GFP_KERNEL);
-	if (!buf)
-		return -ENOMEM;
-
-	if (copy_from_user(buf, ubuf, count))
-		return -EFAULT;
+	buf = memdup_user(ubuf, count);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);

After adding this to my for-next branch, it failed to merge with upstream. That's because a bug was found that if user space did not have a '\0' terminator, reading this as a string could cause the read to go off the allocated buffer and crash the machine.

kernel/trace/trace_osnoise.c osnoise_cpus_write(struct file *filp, const char __user *ubuf, size_t count, · line 2334

Quoted 3 lines
kernel/trace/trace_osnoise.c +0 -0
 	if (!zalloc_cpumask_var(&osnoise_cpumask_new, GFP_KERNEL))
 		return -ENOMEM;

The above was changed to this:

	if (count < 1)
		return 0;

	buf = kmalloc(count + 1, GFP_KERNEL);
	if (!buf)
		return -ENOMEM;

	if (copy_from_user(buf, ubuf, count))
		return -EFAULT;
	buf[count] = '\0';

Which makes your change not quite compatible.

I'm going to rebase and remove your change for now.

-- Steve

author
#2 lore raw
Quoted 3 lines · Steven Rostedt

Which makes your change not quite compatible.

I'm going to rebase and remove your change for now.

No worries, I'll send a v3 tomorrow using memdup_user_nul() instead.

Thanks,
Thorsten

maintainer
#3 lore raw
Quoted 6 lines · On Wed, 1 Oct 2025 01:03:29 +0200 Thorsten Blum <[email protected]> wrote:
Quoted 3 lines · Steven Rostedt

Which makes your change not quite compatible.

I'm going to rebase and remove your change for now.

No worries, I'll send a v3 tomorrow using memdup_user_nul() instead.

Thanks, you can base it off of my for-next branch.

-- Steve

maintainer
#5 lore raw
Quoted 11 lines · On Wed, 1 Oct 2025 11:11:16 +0200 Thorsten Blum <[email protected]> wrote:
Quoted 1 line · Steven Rostedt

Thanks, you can base it off of my for-next branch.

I think your for-next branch[1] doesn't include the fix a2501032de0d ("tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()") yet, does it? My patch would need to be applied on top of that.

Thanks,
Thorsten

[1] https://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git/log/?h=for-next

Interesting, because it failed to merge when I ran my script to merge all my "for-next" branches. :-/

Anyway, apply it on top v6.17.

Thanks,

-- Steve