A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-06 03:45:24 -04:00
Code Issues Projects Releases Packages Wiki Activity
android_kernel_motorola_sm6375/kernel/trace
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Liangyan d63f00ec90 tracing: Correct the length check which causes memory corruption 
commit 3e08a9f9760f4a70d633c328a76408e62d6f80a3 upstream.

We've suffered from severe kernel crashes due to memory corruption on
our production environment, like,

Call Trace:
[1640542.554277] general protection fault: 0000 [#1] SMP PTI
[1640542.554856] CPU: 17 PID: 26996 Comm: python Kdump: loaded Tainted:G
[1640542.556629] RIP: 0010:kmem_cache_alloc+0x90/0x190
[1640542.559074] RSP: 0018:ffffb16faa597df8 EFLAGS: 00010286
[1640542.559587] RAX: 0000000000000000 RBX: 0000000000400200 RCX:
0000000006e931bf
[1640542.560323] RDX: 0000000006e931be RSI: 0000000000400200 RDI:
ffff9a45ff004300
[1640542.560996] RBP: 0000000000400200 R08: 0000000000023420 R09:
0000000000000000
[1640542.561670] R10: 0000000000000000 R11: 0000000000000000 R12:
ffffffff9a20608d
[1640542.562366] R13: ffff9a45ff004300 R14: ffff9a45ff004300 R15:
696c662f65636976
[1640542.563128] FS:  00007f45d7c6f740(0000) GS:ffff9a45ff840000(0000)
knlGS:0000000000000000
[1640542.563937] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[1640542.564557] CR2: 00007f45d71311a0 CR3: 000000189d63e004 CR4:
00000000003606e0
[1640542.565279] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[1640542.566069] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
0000000000000400
[1640542.566742] Call Trace:
[1640542.567009]  anon_vma_clone+0x5d/0x170
[1640542.567417]  __split_vma+0x91/0x1a0
[1640542.567777]  do_munmap+0x2c6/0x320
[1640542.568128]  vm_munmap+0x54/0x70
[1640542.569990]  __x64_sys_munmap+0x22/0x30
[1640542.572005]  do_syscall_64+0x5b/0x1b0
[1640542.573724]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[1640542.575642] RIP: 0033:0x7f45d6e61e27

James Wang has reproduced it stably on the latest 4.19 LTS.
After some debugging, we finally proved that it's due to ftrace
buffer out-of-bound access using a debug tool as follows:
[   86.775200] BUG: Out-of-bounds write at addr 0xffff88aefe8b7000
[   86.780806]  no_context+0xdf/0x3c0
[   86.784327]  __do_page_fault+0x252/0x470
[   86.788367]  do_page_fault+0x32/0x140
[   86.792145]  page_fault+0x1e/0x30
[   86.795576]  strncpy_from_unsafe+0x66/0xb0
[   86.799789]  fetch_memory_string+0x25/0x40
[   86.804002]  fetch_deref_string+0x51/0x60
[   86.808134]  kprobe_trace_func+0x32d/0x3a0
[   86.812347]  kprobe_dispatcher+0x45/0x50
[   86.816385]  kprobe_ftrace_handler+0x90/0xf0
[   86.820779]  ftrace_ops_assist_func+0xa1/0x140
[   86.825340]  0xffffffffc00750bf
[   86.828603]  do_sys_open+0x5/0x1f0
[   86.832124]  do_syscall_64+0x5b/0x1b0
[   86.835900]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

commit b220c049d519 ("tracing: Check length before giving out
the filter buffer") adds length check to protect trace data
overflow introduced in 0fc1b09ff1, seems that this fix can't prevent
overflow entirely, the length check should also take the sizeof
entry->array[0] into account, since this array[0] is filled the
length of trace data and occupy addtional space and risk overflow.

Link: https://lkml.kernel.org/r/20210607125734.1770447-1-liangyan.peng@linux.alibaba.com

Cc: stable@vger.kernel.org
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Xunlei Pang <xlpang@linux.alibaba.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: b220c049d519 ("tracing: Check length before giving out the filter buffer")
Reviewed-by: Xunlei Pang <xlpang@linux.alibaba.com>
Reviewed-by: yinbinbin <yinbinbin@alibabacloud.com>
Reviewed-by: Wetp Zhang <wetp.zy@linux.alibaba.com>
Tested-by: James Wang <jnwang@linux.alibaba.com>
Signed-off-by: Liangyan <liangyan.peng@linux.alibaba.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-16 11:59:46 +02:00
..
blktrace.c blktrace: ensure our debugfs dir exists 2020-09-03 11:26:42 +02:00
bpf_trace.c bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address() 2020-12-30 11:51:18 +01:00
fgraph.c fgraph: Initialize tracing_graph_pause at task creation 2021-02-10 09:25:29 +01:00
ftrace.c ftrace: Do not blindly read the ip address in ftrace_bug() 2021-06-16 11:59:45 +02:00
ftrace_internal.h
Kconfig tracing/kprobes: Do the notrace functions check without kprobes on ftrace 2021-01-19 18:26:12 +01:00
Makefile
power-traces.c
preemptirq_delay_test.c
ring_buffer.c tracing: Fix race in trace_open and buffer resize call 2021-01-30 13:54:10 +01:00
ring_buffer_benchmark.c
rpm-traces.c
trace.c tracing: Correct the length check which causes memory corruption 2021-06-16 11:59:46 +02:00
trace.h ftrace: Handle tracing when switching between context 2020-11-10 12:37:28 +01:00
trace_benchmark.c
trace_benchmark.h
trace_branch.c
trace_clock.c tracing: Restructure trace_clock_global() to never block 2021-05-11 14:04:18 +02:00
trace_dynevent.c
trace_dynevent.h
trace_entries.h tracing: Set kernel_stack's caller size properly 2020-10-01 13:17:29 +02:00
trace_event_perf.c
trace_events.c tracing: Do not count ftrace events in top level enable output 2021-02-17 10:35:14 +01:00
trace_events_filter.c
trace_events_filter_test.h
trace_events_hist.c tracing: fix double free 2020-10-01 13:18:23 +02:00
trace_events_trigger.c tracing: Fix event trigger to accept redundant spaces 2020-06-30 15:37:10 -04:00
trace_export.c
trace_functions.c
trace_functions_graph.c
trace_hwlat.c tracing: Remove WARN_ON in start_thread() 2020-12-08 10:40:28 +01:00
trace_irqsoff.c
trace_kdb.c
trace_kprobe.c tracing/kprobe: Fix to support kretprobe events on unloaded modules 2021-02-13 13:52:54 +01:00
trace_kprobe_selftest.c
trace_kprobe_selftest.h
trace_mmiotrace.c
trace_nop.c
trace_output.c tracing: Make the space reserved for the pid wider 2020-10-07 08:01:27 +02:00
trace_output.h
trace_preemptirq.c lockdep: fix order in trace_hardirqs_off_caller() 2020-10-01 13:18:14 +02:00
trace_printk.c
trace_probe.c tracing/probe: Fix memleak in fetch_op_data operations 2020-06-24 17:50:51 +02:00
trace_probe.h
trace_probe_tmpl.h
trace_sched_switch.c
trace_sched_wakeup.c
trace_selftest.c ftrace: Handle tracing when switching between context 2020-11-10 12:37:28 +01:00
trace_selftest_dynamic.c
trace_seq.c
trace_stack.c
trace_stat.c
trace_stat.h
trace_syscalls.c
trace_uprobe.c tracing/probe: Fix bpf_task_fd_query() for kprobes and uprobes 2020-06-24 17:50:43 +02:00
tracing_map.c
tracing_map.h