linux-kernel - Re: [PATCH v2 0/2] printk_ringbuffer: don't needlessly wrap data blocks around

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fece29ff-070e-4074-85be-4093a3000e5d@yandex-team.ru>
Date: Sun, 14 Sep 2025 12:56:49 +0300
From: Daniil Tatianin <d-tatianin@...dex-team.ru>
To: John Ogness <john.ogness@...utronix.de>, Petr Mladek <pmladek@...e.com>
Cc: linux-kernel@...r.kernel.org, Steven Rostedt <rostedt@...dmis.org>,
 Sergey Senozhatsky <senozhatsky@...omium.org>
Subject: Re: [PATCH v2 0/2] printk_ringbuffer: don't needlessly wrap data
 blocks around

On 9/14/25 12:23 PM, John Ogness wrote:

> On 2025-09-13, Daniil Tatianin <d-tatianin@...dex-team.ru> wrote:
>>> The problem comes from the function data_make_reusable(). The job of
>>> this function is to push the data_ring tail forward, one data block at a
>>> time, while setting the related descriptors to reusable.
>>>
>>> After pushing the tail forward, if it still has not pushed it far enough
>>> for new requested reservation, it must push it further. For this it
>>> _assumes the current position of the tail is a descriptor ID for the
>>> next data block_. But what if the tail was pushed all the way to the
>>> head? Then there is no next data block and it will read in garbage,
>>> thinking it is the next descriptor ID to set reusable. And from there it
>>> just goes crazy because it is reading garbage to determine how big the
>>> data block is so that it can continue pushing the tail (beyond the
>>> head!).
>>>
>>> Example: Assume the 96 byte ringbuffer has a single message of 64
>>> bytes. Then we try to reserve space for a 72-byte
>>> message. data_make_reusable() will first set the descriptor of the
>>> 64-byte message to reusable and push the tail forward to index 64. But
>>> the new message needs 72 bytes, so data_make_reusable() will keep going
>>> and read the descriptor ID at index 64, but there is only random garbage
>>> at that position. 64 is the head and there is nothing valid after it.
>> Good catch, although I'm not sure i understand why this produces the
>> error Petr is seeing.
>>
>> Why would it see garbage in a zeroed .bss buffer? Is this because of
>> the previous test runs dirtying the same data ring or something?
> Correct. The explosions don't start happening until after about 5-6
> wraps. So the data ring is full of somewhat random data that will then
> be randomly interpretted once it attempts to push the tail beyond the
> head.

Ah ok, yeah that makes sense.

>
>> Either way, I guess after your patch is accepted i'm going to resend
>> mine to only strip the trailing id, but the records must still be less
>> than half of the data ring size so that data_make_reusable never
>> invalidates past the current head.
> After applying your patch, can you provide an example where a maximum
> size of exactly half causes the tail to be pushed beyond the head? Keep
> in mind that data_check_size() accounts for the meta-data. It only
> doesn't account for the extra ID on wrapping data blocks.

Sorry, I think exactly half is fine, basically we can keep it half, but 
only remove the tailing id check with my patch.

>
> John