linux-kernel - Re: User stacktrace garbage when USER_STACKTRACE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 31 Mar 2021 22:51:15 +0200
From:   Vasily Gorbik <gor@...ux.ibm.com>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Josef Bacik <jbacik@...com>, linux-kernel@...r.kernel.org
Subject: Re: User stacktrace garbage when USER_STACKTRACE_SUPPORT is not
 enabled

On Wed, Mar 31, 2021 at 10:37:49AM -0400, Steven Rostedt wrote:
> But after writing all of the above, I think I found a bug! It's this:
> 
> 	size = nr_entries * sizeof(unsigned long);
> 	event = __trace_buffer_lock_reserve(buffer, TRACE_STACK,
> 					    sizeof(*entry) + size, trace_ctx);
> 
> 
> I said the above commit did not play a role in output, but it does play a
> role in creating the struct stack_trace entry. And by making it a fixed
> array (even though it's not used) it added 8 more entries to the stack!
> 
> This should fix the problem:
> 
> -- Steve
> 
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index 3c605957bb5c..507a30bf26e4 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -2985,7 +2985,8 @@ static void __ftrace_trace_stack(struct trace_buffer *buffer,
>  
>  	size = nr_entries * sizeof(unsigned long);
>  	event = __trace_buffer_lock_reserve(buffer, TRACE_STACK,
> -					    sizeof(*entry) + size, trace_ctx);
> +				    (sizeof(*entry) - sizeof(entry->caller)) + size,
> +				    trace_ctx);
>  	if (!event)
>  		goto out;
>  	entry = ring_buffer_event_data(event);

It does! Thanks for the explanation and for the fix. I wonder why nobody
noticed and complained about that since v5.6.

Acked-by: Vasily Gorbik <gor@...ux.ibm.com>