linux-kernel - [GIT PULL] ring-buffer: Fixes for v6.13

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241219093357.133640ef@gandalf.local.home>
Date: Thu, 19 Dec 2024 09:33:57 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: LKML <linux-kernel@...r.kernel.org>, Masami Hiramatsu
 <mhiramat@...nel.org>, Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 Edward Adam Davis <eadavis@...com>
Subject: [GIT PULL] ring-buffer: Fixes for v6.13


Linus,

ring-buffer fixes for v6.13:

- Fix possible overflow of mmapped ring buffer with bad offset

  If the mmap() to the ring buffer passes in a start address that
  is passed the end of the mmapped file, it is not caught and
  a slab-out-of-bounds is triggered.

  Add a check to make sure the start address is within the bounds

- Do not use TP_printk() to boot mapped ring buffers

  As a boot mapped ring buffer's data may have pointers that map to
  the previous boot's memory map, it is unsafe to allow the TP_printk()
  to be used to read the boot mapped buffer's events. If a TP_printk()
  points to a static string from within the kernel it will not match
  the current kernel mapping if KASLR is active, and it can fault.

  Have it simply print out the raw fields.


Please pull the latest trace-ringbuffer-v6.13-rc3 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-ringbuffer-v6.13-rc3

Tag SHA1: 3c38c1e8650faf82139b4c3e263f654673d28b50
Head SHA1: 8cd63406d08110c8098e1efda8aef7ddab4db348


Edward Adam Davis (1):
      ring-buffer: Fix overflow in __rb_map_vma

Steven Rostedt (1):
      trace/ring-buffer: Do not use TP_printk() formatting for boot mapped buffers

----
 kernel/trace/ring_buffer.c | 6 +++++-
 kernel/trace/trace.c       | 9 +++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)
---------------------------
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 7e257e855dd1..60210fb5b211 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7019,7 +7019,11 @@ static int __rb_map_vma(struct ring_buffer_per_cpu *cpu_buffer,
 	lockdep_assert_held(&cpu_buffer->mapping_lock);
 
 	nr_subbufs = cpu_buffer->nr_pages + 1; /* + reader-subbuf */
-	nr_pages = ((nr_subbufs + 1) << subbuf_order) - pgoff; /* + meta-page */
+	nr_pages = ((nr_subbufs + 1) << subbuf_order); /* + meta-page */
+	if (nr_pages <= pgoff)
+		return -EINVAL;
+
+	nr_pages -= pgoff;
 
 	nr_vma_pages = vma_pages(vma);
 	if (!nr_vma_pages || nr_vma_pages > nr_pages)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index be62f0ea1814..6581cb2bc67f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4353,6 +4353,15 @@ static enum print_line_t print_trace_fmt(struct trace_iterator *iter)
 	if (event) {
 		if (tr->trace_flags & TRACE_ITER_FIELDS)
 			return print_event_fields(iter, event);
+		/*
+		 * For TRACE_EVENT() events, the print_fmt is not
+		 * safe to use if the array has delta offsets
+		 * Force printing via the fields.
+		 */
+		if ((tr->text_delta || tr->data_delta) &&
+		    event->type > __TRACE_LAST_TYPE)
+			return print_event_fields(iter, event);
+
 		return event->funcs->trace(iter, sym_flags, event);
 	}