linux-kernel - Re: [PATCH v2 0/2] printk_ringbuffer: don't needlessly wrap data blocks around

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <84348pqtej.fsf@jogness.linutronix.de>
Date: Sun, 14 Sep 2025 11:29:48 +0206
From: John Ogness <john.ogness@...utronix.de>
To: Daniil Tatianin <d-tatianin@...dex-team.ru>, Petr Mladek <pmladek@...e.com>
Cc: linux-kernel@...r.kernel.org, Steven Rostedt <rostedt@...dmis.org>,
 Sergey Senozhatsky <senozhatsky@...omium.org>
Subject: Re: [PATCH v2 0/2] printk_ringbuffer: don't needlessly wrap data
 blocks around

On 2025-09-13, Daniil Tatianin <d-tatianin@...dex-team.ru> wrote:
>> The problem comes from the function data_make_reusable(). The job of
>> this function is to push the data_ring tail forward, one data block at a
>> time, while setting the related descriptors to reusable.
>>
>> After pushing the tail forward, if it still has not pushed it far enough
>> for new requested reservation, it must push it further. For this it
>> _assumes the current position of the tail is a descriptor ID for the
>> next data block_. But what if the tail was pushed all the way to the
>> head? Then there is no next data block and it will read in garbage,
>> thinking it is the next descriptor ID to set reusable. And from there it
>> just goes crazy because it is reading garbage to determine how big the
>> data block is so that it can continue pushing the tail (beyond the
>> head!).
>>
>> Example: Assume the 96 byte ringbuffer has a single message of 64
>> bytes. Then we try to reserve space for a 72-byte
>> message. data_make_reusable() will first set the descriptor of the
>> 64-byte message to reusable and push the tail forward to index 64. But
>> the new message needs 72 bytes, so data_make_reusable() will keep going
>> and read the descriptor ID at index 64, but there is only random garbage
>> at that position. 64 is the head and there is nothing valid after it.
>
> Good catch, although I'm not sure i understand why this produces the 
> error Petr is seeing.
>
> Why would it see garbage in a zeroed .bss buffer? Is this because of
> the previous test runs dirtying the same data ring or something?

Correct. The explosions don't start happening until after about 5-6
wraps. So the data ring is full of somewhat random data that will then
be randomly interpretted once it attempts to push the tail beyond the
head.

> Either way, I guess after your patch is accepted i'm going to resend
> mine to only strip the trailing id, but the records must still be less
> than half of the data ring size so that data_make_reusable never
> invalidates past the current head.

After applying your patch, can you provide an example where a maximum
size of exactly half causes the tail to be pushed beyond the head? Keep
in mind that data_check_size() accounts for the meta-data. It only
doesn't account for the extra ID on wrapping data blocks.

John