Liangyan 43c32c2225 tracing: Correct the length check which causes memory corruption ... commit 3e08a9f9760f4a70d633c328a76408e62d6f80a3 upstream. We've suffered from severe kernel crashes due to memory corruption on our production environment, like, Call Trace: [1640542.554277] general protection fault: 0000 [#1] SMP PTI [1640542.554856] CPU: 17 PID: 26996 Comm: python Kdump: loaded Tainted:G [1640542.556629] RIP: 0010:kmem_cache_alloc+0x90/0x190 [1640542.559074] RSP: 0018:ffffb16faa597df8 EFLAGS: 00010286 [1640542.559587] RAX: 0000000000000000 RBX: 0000000000400200 RCX: 0000000006e931bf [1640542.560323] RDX: 0000000006e931be RSI: 0000000000400200 RDI: ffff9a45ff004300 [1640542.560996] RBP: 0000000000400200 R08: 0000000000023420 R09: 0000000000000000 [1640542.561670] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff9a20608d [1640542.562366] R13: ffff9a45ff004300 R14: ffff9a45ff004300 R15: 696c662f65636976 [1640542.563128] FS: 00007f45d7c6f740(0000) GS:ffff9a45ff840000(0000) knlGS:0000000000000000 [1640542.563937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1640542.564557] CR2: 00007f45d71311a0 CR3: 000000189d63e004 CR4: 00000000003606e0 [1640542.565279] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1640542.566069] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1640542.566742] Call Trace: [1640542.567009] anon_vma_clone+0x5d/0x170 [1640542.567417] __split_vma+0x91/0x1a0 [1640542.567777] do_munmap+0x2c6/0x320 [1640542.568128] vm_munmap+0x54/0x70 [1640542.569990] __x64_sys_munmap+0x22/0x30 [1640542.572005] do_syscall_64+0x5b/0x1b0 [1640542.573724] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [1640542.575642] RIP: 0033:0x7f45d6e61e27 James Wang has reproduced it stably on the latest 4.19 LTS. After some debugging, we finally proved that it's due to ftrace buffer out-of-bound access using a debug tool as follows: [ 86.775200] BUG: Out-of-bounds write at addr 0xffff88aefe8b7000 [ 86.780806] no_context+0xdf/0x3c0 [ 86.784327] __do_page_fault+0x252/0x470 [ 86.788367] do_page_fault+0x32/0x140 [ 86.792145] page_fault+0x1e/0x30 [ 86.795576] strncpy_from_unsafe+0x66/0xb0 [ 86.799789] fetch_memory_string+0x25/0x40 [ 86.804002] fetch_deref_string+0x51/0x60 [ 86.808134] kprobe_trace_func+0x32d/0x3a0 [ 86.812347] kprobe_dispatcher+0x45/0x50 [ 86.816385] kprobe_ftrace_handler+0x90/0xf0 [ 86.820779] ftrace_ops_assist_func+0xa1/0x140 [ 86.825340] 0xffffffffc00750bf [ 86.828603] do_sys_open+0x5/0x1f0 [ 86.832124] do_syscall_64+0x5b/0x1b0 [ 86.835900] entry_SYSCALL_64_after_hwframe+0x44/0xa9 commit b220c049d519 ("tracing: Check length before giving out the filter buffer") adds length check to protect trace data overflow introduced in 0fc1b09ff1, seems that this fix can't prevent overflow entirely, the length check should also take the sizeof entry->array[0] into account, since this array[0] is filled the length of trace data and occupy addtional space and risk overflow. Link: https://lkml.kernel.org/r/20210607125734.1770447-1-liangyan.peng@linux.alibaba.com Cc: stable@vger.kernel.org Cc: Ingo Molnar <mingo@redhat.com> Cc: Xunlei Pang <xlpang@linux.alibaba.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Fixes: b220c049d519 ("tracing: Check length before giving out the filter buffer") Reviewed-by: Xunlei Pang <xlpang@linux.alibaba.com> Reviewed-by: yinbinbin <yinbinbin@alibabacloud.com> Reviewed-by: Wetp Zhang <wetp.zy@linux.alibaba.com> Tested-by: James Wang <jnwang@linux.alibaba.com> Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-06-16 12:01:47 +02:00
..
blktrace.c	block: add a bdget_part helper	2020-10-05 10:38:33 -06:00
bpf_trace.c	bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks	2021-06-10 13:39:19 +02:00
bpf_trace.h	bpf: Use dedicated bpf_trace_printk event instead of trace_printk()	2020-07-13 16:55:49 -07:00
fgraph.c	fgraph: Initialize tracing_graph_pause at task creation	2021-02-10 09:29:16 +01:00
ftrace_internal.h	x86/ftrace: Have ftrace trampolines turn read-only at the end of system boot up	2020-05-12 18:24:34 -04:00
ftrace.c	ftrace: Do not blindly read the ip address in ftrace_bug()	2021-06-16 12:01:40 +02:00
Kconfig	tracing/kprobes: Do the notrace functions check without kprobes on ftrace	2021-01-19 18:27:19 +01:00
kprobe_event_gen_test.c	tracing: Add kprobe event command generation test module	2020-01-30 09:46:28 -05:00
Makefile	Kbuild updates for v5.9	2020-08-09 14:10:26 -07:00
power-traces.c
preemptirq_delay_test.c	tracing: Wait for preempt irq delay thread to execute	2020-05-11 17:00:34 -04:00
ring_buffer_benchmark.c	sched,tracing: Convert to sched_set_fifo()	2020-07-29 11:43:53 +02:00
ring_buffer.c	ring-buffer: Force before_stamp and write_stamp to be different on discard	2021-03-09 11:11:12 +01:00
rpm-traces.c
synth_event_gen_test.c	tracing: Add support for dynamic strings to synthetic events	2020-10-05 19:32:18 -04:00
trace_benchmark.c
trace_benchmark.h
trace_boot.c	tracing: Disable ftrace selftests when any tracer is running	2020-12-30 11:54:28 +01:00
trace_branch.c	tracing: Make struct ring_buffer less ambiguous	2020-01-13 13:19:38 -05:00
trace_clock.c	tracing: Restructure trace_clock_global() to never block	2021-05-11 14:47:40 +02:00
trace_dynevent.c	tracing: Delete repeated words in comments	2020-09-21 21:06:02 -04:00
trace_dynevent.h	tracing: Remove check_arg() callbacks from dynevent args	2020-02-01 13:09:23 -05:00
trace_entries.h	tracing: Make ftrace packed events have align of 1	2020-06-16 21:21:02 -04:00
trace_event_perf.c
trace_events_filter_test.h
trace_events_filter.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
trace_events_hist.c	tracing: Check return value of __create_val_fields() before using its result	2020-10-15 12:00:59 -04:00
trace_events_inject.c	tracing: Initialize val to zero in parse_entry of inject code	2020-01-02 19:04:57 -05:00
trace_events_synth.c	tracing: Make -ENOMEM the default error for parse_synth_field()	2020-11-02 15:58:32 -05:00
trace_events_trigger.c	tracing: Fix event trigger to accept redundant spaces	2020-06-23 21:51:40 -04:00
trace_events.c	tracing: Do not count ftrace events in top level enable output	2021-02-17 11:02:20 +01:00
trace_export.c	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
trace_functions_graph.c	tracing: make tracing_init_dentry() returns an integer instead of a d_entry pointer	2020-09-18 22:17:14 -04:00
trace_functions.c	tracing: Enable creating new instance early boot	2020-09-21 21:06:04 -04:00
trace_hwlat.c	tracing: Remove WARN_ON in start_thread()	2020-11-30 21:43:07 -05:00
trace_irqsoff.c	tracing: Use pause-on-trace with the latency tracers	2021-02-10 09:29:16 +01:00
trace_kdb.c	tracing: Rename trace_buffer to array_buffer	2020-01-13 13:19:38 -05:00
trace_kprobe_selftest.c
trace_kprobe_selftest.h
trace_kprobe.c	tracing/kprobe: Fix to support kretprobe events on unloaded modules	2021-02-10 09:29:16 +01:00
trace_mmiotrace.c	tracing: Make struct ring_buffer less ambiguous	2020-01-13 13:19:38 -05:00
trace_nop.c
trace_output.c	tracing: Make the space reserved for the pid wider	2020-09-18 12:42:11 -04:00
trace_output.h
trace_preemptirq.c	lockdep: fix order in trace_hardirqs_off_caller()	2020-09-14 10:08:07 +02:00
trace_printk.c	Updates for tracing and bootconfig:	2020-10-15 15:51:28 -07:00
trace_probe_tmpl.h
trace_probe.c	tracing/probe: Fix memleak in fetch_op_data operations	2020-06-16 21:21:02 -04:00
trace_probe.h	tracing: Move is_good_name() from trace_probe.h to trace.h	2020-10-15 12:01:13 -04:00
trace_sched_switch.c	tracing: Fix sched switch start/stop refcount racy updates	2020-01-30 09:46:10 -05:00
trace_sched_wakeup.c	tracing: Make struct ring_buffer less ambiguous	2020-01-13 13:19:38 -05:00
trace_selftest_dynamic.c
trace_selftest.c	tracing: Disable ftrace selftests when any tracer is running	2020-12-30 11:54:28 +01:00
trace_seq.c	tracing: Remove unused TRACE_SEQ_BUF_USED	2020-01-21 18:39:54 -05:00
trace_stack.c	tracing: make tracing_init_dentry() returns an integer instead of a d_entry pointer	2020-09-18 22:17:14 -04:00
trace_stat.c	tracing: make tracing_init_dentry() returns an integer instead of a d_entry pointer	2020-09-18 22:17:14 -04:00
trace_stat.h
trace_synth.h	tracing: Add support for dynamic strings to synthetic events	2020-10-05 19:32:18 -04:00
trace_syscalls.c	Tracing updates:	2020-02-06 07:12:11 +00:00
trace_uprobe.c	tracing/uprobes: Support perf-style return probe	2020-09-21 21:06:03 -04:00
trace.c	tracing: Correct the length check which causes memory corruption	2021-06-16 12:01:47 +02:00
trace.h	tracing: Disable ftrace selftests when any tracer is running	2020-12-30 11:54:28 +01:00
tracing_map.c	tracing: Delete repeated words in comments	2020-09-21 21:06:02 -04:00
tracing_map.h