Go to file
Steven Rostedt (Google) cee5151c54 ring-buffer: Do not attempt to read past "commit"
[ Upstream commit 95a404bd60af6c4d9d8db01ad14fe8957ece31ca ]

When iterating over the ring buffer while the ring buffer is active, the
writer can corrupt the reader. There's barriers to help detect this and
handle it, but that code missed the case where the last event was at the
very end of the page and has only 4 bytes left.

The checks to detect the corruption by the writer to reads needs to see the
length of the event. If the length in the first 4 bytes is zero then the
length is stored in the second 4 bytes. But if the writer is in the process
of updating that code, there's a small window where the length in the first
4 bytes could be zero even though the length is only 4 bytes. That will
cause rb_event_length() to read the next 4 bytes which could happen to be off the
allocated page.

To protect against this, fail immediately if the next event pointer is
less than 8 bytes from the end of the commit (last byte of data), as all
events must be a minimum of 8 bytes anyway.

Link: https://lore.kernel.org/all/20230905141245.26470-1-Tze-nan.Wu@mediatek.com/
Link: https://lore.kernel.org/linux-trace-kernel/20230907122820.0899019c@gandalf.local.home

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Reported-by: Tze-nan Wu <Tze-nan.Wu@mediatek.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-10-10 21:53:32 +02:00
arch parisc: irq: Make irq_stack_union static to avoid sparse warning 2023-10-10 21:53:32 +02:00
block block/partition: fix signedness issue for Amiga partitions 2023-07-27 08:44:18 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:13:17 +02:00
crypto crypto: lrw,xts - Replace strlcpy with strscpy 2023-09-23 11:01:05 +02:00
Documentation perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09 2023-09-23 11:01:05 +02:00
drivers scsi: qedf: Add synchronization between I/O completions and abort 2023-10-10 21:53:32 +02:00
fs btrfs: reset destination buffer when read_extent_buffer() gets invalid range 2023-10-10 21:53:30 +02:00
include ata: libata: Rename link flag ATA_LFLAG_NO_DB_DELAY 2023-10-10 21:53:30 +02:00
init x86/mm: Initialize text poking earlier 2023-08-08 19:57:39 +02:00
io_uring io_uring: break iopolling on signal 2023-09-19 12:20:24 +02:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:24:00 +01:00
kernel ring-buffer: Do not attempt to read past "commit" 2023-10-10 21:53:32 +02:00
lib kobject: Add sanity check for kset->kobj.ktype in kset_register() 2023-09-23 11:01:08 +02:00
LICENSES LICENSES/deprecated: add Zlib license text 2020-09-16 14:33:49 +02:00
mm mm/filemap: fix infinite loop in generic_file_buffered_read() 2023-09-23 11:01:10 +02:00
net netfilter: nft_exthdr: Fix non-linear header modification 2023-10-10 21:53:30 +02:00
samples samples/hw_breakpoint: fix building without module unloading 2023-09-23 11:01:09 +02:00
scripts kconfig: fix possible buffer overflow 2023-09-19 12:20:25 +02:00
security smackfs: Prevent underflow in smk_set_cipso() 2023-09-19 12:20:13 +02:00
sound ASoC: imx-audmix: Fix return error with devm_clk_get() 2023-10-10 21:53:27 +02:00
tools selftests: fix dependency checker script 2023-10-10 21:53:32 +02:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:25:48 +01:00
virt KVM: fix memoryleak in kvm_init() 2023-04-05 11:23:43 +02:00
.clang-format RDMA 5.10 pull request 2020-10-17 11:18:18 -07:00
.cocciconfig
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore kbuild: generate Module.symvers only when vmlinux exists 2021-05-19 10:12:59 +02:00
.mailmap mailmap: add two more addresses of Uwe Kleine-König 2020-12-06 10:19:07 -08:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Jason Cooper to CREDITS 2020-11-30 10:20:34 +01:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS Remove DECnet support from kernel 2023-06-21 15:45:38 +02:00
Makefile Linux 5.10.197 2023-09-23 11:01:11 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.