8 files changed, 45 insertions, 26 deletions

diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index f1429675f252..1a40277b512c 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -128,7 +128,7 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, u64 *ts,
                     unsigned long *lost_events);
 
 struct ring_buffer_iter *
-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu);
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags);
 void ring_buffer_read_prepare_sync(void);
 void ring_buffer_read_start(struct ring_buffer_iter *iter);
 void ring_buffer_read_finish(struct ring_buffer_iter *iter);
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 9a91479bbbfe..41b6f96e5366 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4191,6 +4191,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
  * ring_buffer_read_prepare - Prepare for a non consuming read of the buffer
  * @buffer: The ring buffer to read from
  * @cpu: The cpu buffer to iterate over
+ * @flags: gfp flags to use for memory allocation
  *
  * This performs the initial preparations necessary to iterate
  * through the buffer.  Memory is allocated, buffer recording
@@ -4208,7 +4209,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
  * This overall must be paired with ring_buffer_read_finish.
  */
 struct ring_buffer_iter *
-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags)
 {
         struct ring_buffer_per_cpu *cpu_buffer;
         struct ring_buffer_iter *iter;
@@ -4216,7 +4217,7 @@ ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)
         if (!cpumask_test_cpu(cpu, buffer->cpumask))
                 return NULL;
 
-        iter = kmalloc(sizeof(*iter), GFP_KERNEL);
+        iter = kmalloc(sizeof(*iter), flags);
         if (!iter)
                 return NULL;
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 94ffc1c559d5..21153e64bf1c 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4079,7 +4079,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)
         if (iter->cpu_file == RING_BUFFER_ALL_CPUS) {
                 for_each_tracing_cpu(cpu) {
                         iter->buffer_iter[cpu] =
-                                ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu);
+                                ring_buffer_read_prepare(iter->trace_buffer->buffer,
+                                                         cpu, GFP_KERNEL);
                 }
                 ring_buffer_read_prepare_sync();
                 for_each_tracing_cpu(cpu) {
@@ -4089,7 +4090,8 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot)
         } else {
                 cpu = iter->cpu_file;
                 iter->buffer_iter[cpu] =
-                        ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu);
+                        ring_buffer_read_prepare(iter->trace_buffer->buffer,
+                                                 cpu, GFP_KERNEL);
                 ring_buffer_read_prepare_sync();
                 ring_buffer_read_start(iter->buffer_iter[cpu]);
                 tracing_iter_reset(iter, cpu);
diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
index d953c163a079..810d78a8d14c 100644
--- a/kernel/trace/trace_kdb.c
+++ b/kernel/trace/trace_kdb.c
@@ -51,14 +51,16 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file)
         if (cpu_file == RING_BUFFER_ALL_CPUS) {
                 for_each_tracing_cpu(cpu) {
                         iter.buffer_iter[cpu] =
-                        ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu);
+                        ring_buffer_read_prepare(iter.trace_buffer->buffer,
+                                                 cpu, GFP_ATOMIC);
                         ring_buffer_read_start(iter.buffer_iter[cpu]);
                         tracing_iter_reset(&iter, cpu);
                 }
         } else {
                 iter.cpu_file = cpu_file;
                 iter.buffer_iter[cpu_file] =
-                        ring_buffer_read_prepare(iter.trace_buffer->buffer, cpu_file);
+                        ring_buffer_read_prepare(iter.trace_buffer->buffer,
+                                                 cpu_file, GFP_ATOMIC);
                 ring_buffer_read_start(iter.buffer_iter[cpu_file]);
                 tracing_iter_reset(&iter, cpu_file);
         }
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 99592c27465e..5d5129b05df7 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -35,7 +35,7 @@ static struct dyn_event_operations trace_kprobe_ops = {
         .match = trace_kprobe_match,
 };
 
-/**
+/*
  * Kprobe event core functions
  */
 struct trace_kprobe {
@@ -221,7 +221,7 @@ static struct trace_kprobe *alloc_trace_kprobe(const char *group,
 
         tk->rp.maxactive = maxactive;
 
-        if (!event || !is_good_name(event)) {
+        if (!event || !group) {
                 ret = -EINVAL;
                 goto error;
         }
@@ -231,11 +231,6 @@ static struct trace_kprobe *alloc_trace_kprobe(const char *group,
         if (!tk->tp.call.name)
                 goto error;
 
-        if (!group || !is_good_name(group)) {
-                ret = -EINVAL;
-                goto error;
-        }
-
         tk->tp.class.system = kstrdup(group, GFP_KERNEL);
         if (!tk->tp.class.system)
                 goto error;
@@ -624,7 +619,11 @@ static int trace_kprobe_create(int argc, const char *argv[])
         if (event)
                 event++;
 
-        if (is_return && isdigit(argv[0][1])) {
+        if (isdigit(argv[0][1])) {
+                if (!is_return) {
+                        pr_info("Maxactive is not for kprobe");
+                        return -EINVAL;
+                }
                 if (event)
                         len = event - &argv[0][1] - 1;
                 else
@@ -634,8 +633,8 @@ static int trace_kprobe_create(int argc, const char *argv[])
                 memcpy(buf, &argv[0][1], len);
                 buf[len] = '\0';
                 ret = kstrtouint(buf, 0, &maxactive);
-                if (ret) {
-                        pr_info("Failed to parse maxactive.\n");
+                if (ret || !maxactive) {
+                        pr_info("Invalid maxactive number\n");
                         return ret;
                 }
                 /* kretprobes instances are iterated over via a list. The
@@ -694,9 +693,9 @@ static int trace_kprobe_create(int argc, const char *argv[])
         tk = alloc_trace_kprobe(group, event, addr, symbol, offset, maxactive,
                                argc, is_return);
         if (IS_ERR(tk)) {
-                pr_info("Failed to allocate trace_probe.(%d)\n",
-                        (int)PTR_ERR(tk));
                 ret = PTR_ERR(tk);
+                /* This must return -ENOMEM otherwise there is a bug */
+                WARN_ON_ONCE(ret != -ENOMEM);
                 goto out;
         }
 
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index 89da34b326e3..8f8411e7835f 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -13,7 +13,7 @@
 
 #include "trace_probe.h"
 
-const char *reserved_field_names[] = {
+static const char *reserved_field_names[] = {
         "common_type",
         "common_flags",
         "common_preempt_count",
@@ -159,6 +159,7 @@ int traceprobe_parse_event_name(const char **pevent, const char **pgroup,
                                 char *buf)
 {
         const char *slash, *event = *pevent;
+        int len;
 
         slash = strchr(event, '/');
         if (slash) {
@@ -171,12 +172,25 @@ int traceprobe_parse_event_name(const char **pevent, const char **pgroup,
                         return -E2BIG;
                 }
                 strlcpy(buf, event, slash - event + 1);
+                if (!is_good_name(buf)) {
+                        pr_info("Group name must follow the same rules as C identifiers\n");
+                        return -EINVAL;
+                }
                 *pgroup = buf;
                 *pevent = slash + 1;
+                event = *pevent;
         }
-        if (strlen(event) == 0) {
+        len = strlen(event);
+        if (len == 0) {
                 pr_info("Event name is not specified\n");
                 return -EINVAL;
+        } else if (len > MAX_EVENT_NAME_LEN) {
+                pr_info("Event name is too long\n");
+                return -E2BIG;
+        }
+        if (!is_good_name(event)) {
+                pr_info("Event name must follow the same rules as C identifiers\n");
+                return -EINVAL;
         }
         return 0;
 }
@@ -548,6 +562,8 @@ int traceprobe_parse_probe_arg(struct trace_probe *tp, int i, char *arg,
 
         body = strchr(arg, '=');
         if (body) {
+                if (body - arg > MAX_ARG_NAME_LEN || body == arg)
+                        return -EINVAL;
                 parg->name = kmemdup_nul(arg, body - arg, GFP_KERNEL);
                 body++;
         } else {
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 8a63f8bc01bc..2177c206de15 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -32,6 +32,7 @@
 #define MAX_TRACE_ARGS          128
 #define MAX_ARGSTR_LEN          63
 #define MAX_ARRAY_LEN           64
+#define MAX_ARG_NAME_LEN        32
 #define MAX_STRING_SIZE         PATH_MAX
 
 /* Reserved field names */
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 9bde07c06362..be78d99ee6bc 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -273,10 +273,7 @@ alloc_trace_uprobe(const char *group, const char *event, int nargs, bool is_ret)
 {
         struct trace_uprobe *tu;
 
-        if (!event || !is_good_name(event))
-                return ERR_PTR(-EINVAL);
-
-        if (!group || !is_good_name(group))
+        if (!event || !group)
                 return ERR_PTR(-EINVAL);
 
         tu = kzalloc(SIZEOF_TRACE_UPROBE(nargs), GFP_KERNEL);
@@ -524,8 +521,9 @@ static int trace_uprobe_create(int argc, const char **argv)
 
         tu = alloc_trace_uprobe(group, event, argc, is_return);
         if (IS_ERR(tu)) {
-                pr_info("Failed to allocate trace_uprobe.(%d)\n", (int)PTR_ERR(tu));
                 ret = PTR_ERR(tu);
+                /* This must return -ENOMEM otherwise there is a bug */
+                WARN_ON_ONCE(ret != -ENOMEM);
                 goto fail_address_parse;
         }
         tu->offset = offset;