Commit f5178c41 authored by Jeongjun Park's avatar Jeongjun Park Committed by Steven Rostedt (Google)
Browse files

tracing: Fix oob write in trace_seq_to_buffer() 

syzbot reported this bug:
==================================================================
BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]
BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822
Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260

CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
 __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106
 trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]
 tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822
 ....
==================================================================

It has been reported that trace_seq_to_buffer() tries to copy more data
than PAGE_SIZE to buf. Therefore, to prevent this, we should use the
smaller of trace_seq_used(&iter->seq) and PAGE_SIZE as an argument.

Link: https://lore.kernel.org/20250422113026.13308-1-aha310510@gmail.com


Reported-by: default avatar <syzbot+c8cd2d2c412b868263fb@syzkaller.appspotmail.com>
Fixes: 3c56819b ("tracing: splice support for tracing_pipe")
Suggested-by: default avatarSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: default avatarJeongjun Park <aha310510@gmail.com>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
parent b4432656

kernel/trace/trace.c

+3 −2
Original line number Diff line number Diff line
@@ -6821,13 +6821,14 @@ static ssize_t tracing_splice_read_pipe(struct file *filp, 
		/* Copy the data into the page, so we can start over. */

		ret = trace_seq_to_buffer(&iter->seq,

					  page_address(spd.pages[i]),

					  trace_seq_used(&iter->seq));

					  min((size_t)trace_seq_used(&iter->seq),

						  PAGE_SIZE));

		if (ret < 0) {

			__free_page(spd.pages[i]);

			break;

		}

		spd.partial[i].offset = 0;

		spd.partial[i].len = trace_seq_used(&iter->seq);

		spd.partial[i].len = ret;



		trace_seq_init(&iter->seq);

	}