linux-kernel - Re: [PATCH v3 06/17] rv: Use strings in da monitors tracepoints

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250715141150.V4bWibVh@linutronix.de>
Date: Tue, 15 Jul 2025 16:11:50 +0200
From: Nam Cao <namcao@...utronix.de>
To: Gabriele Monaco <gmonaco@...hat.com>
Cc: linux-kernel@...r.kernel.org, Steven Rostedt <rostedt@...dmis.org>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	linux-trace-kernel@...r.kernel.org, Ingo Molnar <mingo@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Tomas Glozar <tglozar@...hat.com>, Juri Lelli <jlelli@...hat.com>,
	Clark Williams <williams@...hat.com>,
	John Kacur <jkacur@...hat.com>
Subject: Re: [PATCH v3 06/17] rv: Use strings in da monitors tracepoints

On Tue, Jul 15, 2025 at 09:14:23AM +0200, Gabriele Monaco wrote:
> Using DA monitors tracepoints with KASAN enabled triggers the following
> warning:
> 
>  BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0
>  Read of size 32 at addr ffffffffaada8980 by task ...
>  Call Trace:
>   <TASK>
>  [...]
>   do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0
>   ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10
>   ? trace_event_sncid+0x83/0x200
>   trace_event_sncid+0x163/0x200
>  [...]
>  The buggy address belongs to the variable:
>   automaton_snep+0x4e0/0x5e0
> 
> This is caused by the tracepoints reading 32 bits __array instead of
                                               ^
                                               bytes

> __string from the automata definition. Such strings are literals and
> reading 32 bytes ends up in out of bound memory accesses (e.g. the next
> automaton's data in this case).
> The error is harmless as, while printing the string, we stop at the null
> terminator, but it should still be fixed.

I'm not sure about the "harmless" part. What if this string is at the very
end of kernel image? Wouldn't unmapped memory be read?

> Use the __string facilities while defining the tracepoints to avoid
> reading out of bound memory.
> 
> Fixes: 792575348ff7 ("rv/include: Add deterministic automata monitor definition via C macros")
> Signed-off-by: Gabriele Monaco <gmonaco@...hat.com>

The change ifself looks good:

Reviewed-by: Nam Cao <namcao@...utronix.de>