From nobody Wed Dec 17 15:07:30 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33986C6FD18 for ; Wed, 19 Apr 2023 04:35:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231684AbjDSEfg (ORCPT ); Wed, 19 Apr 2023 00:35:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57736 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229633AbjDSEfe (ORCPT ); Wed, 19 Apr 2023 00:35:34 -0400 X-Greylist: delayed 1710 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Tue, 18 Apr 2023 21:35:32 PDT Received: from h3cspam02-ex.h3c.com (smtp.h3c.com [221.12.31.56]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3937E7297 for ; Tue, 18 Apr 2023 21:35:31 -0700 (PDT) Received: from h3cspam02-ex.h3c.com (localhost [127.0.0.2] (may be forged)) by h3cspam02-ex.h3c.com with ESMTP id 33J46x6Q095474 for ; Wed, 19 Apr 2023 12:06:59 +0800 (GMT-8) (envelope-from zhang.zhengming@h3c.com) Received: from mail.maildlp.com ([172.25.15.154]) by h3cspam02-ex.h3c.com with ESMTP id 33J469be094211; Wed, 19 Apr 2023 12:06:09 +0800 (GMT-8) (envelope-from zhang.zhengming@h3c.com) Received: from DAG2EX07-IDC.srv.huawei-3com.com (unknown [172.20.54.130]) by mail.maildlp.com (Postfix) with ESMTP id 7012522EB027; Wed, 19 Apr 2023 12:10:33 +0800 (CST) Received: from localhost.localdomain (10.99.222.162) by DAG2EX07-IDC.srv.huawei-3com.com (172.20.54.130) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.6; Wed, 19 Apr 2023 12:06:08 +0800 From: zhangzhengming To: , , , , , CC: , , Zhang Zhengming Subject: [PATCH] relayfs: fix out-of-bounds access in relay_file_read Date: Wed, 19 Apr 2023 12:02:03 +0800 Message-ID: <20230419040203.37676-1-zhang.zhengming@h3c.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.99.222.162] X-ClientProxiedBy: BJSMTP01-EX.srv.huawei-3com.com (10.63.20.132) To DAG2EX07-IDC.srv.huawei-3com.com (172.20.54.130) X-DNSRBL: X-MAIL: h3cspam02-ex.h3c.com 33J46x6Q095474 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Zhang Zhengming There is a crash in relay_file_read, as the var from=20 point to the end of last subbuf. The oops looks something like: pc : __arch_copy_to_user+0x180/0x310 lr : relay_file_read+0x20c/0x2c8 Call trace: __arch_copy_to_user+0x180/0x310 full_proxy_read+0x68/0x98 vfs_read+0xb0/0x1d0 ksys_read+0x6c/0xf0 __arm64_sys_read+0x20/0x28 el0_svc_common.constprop.3+0x84/0x108 do_el0_svc+0x74/0x90 el0_svc+0x1c/0x28 el0_sync_handler+0x88/0xb0 el0_sync+0x148/0x180 We get the condition by analyzing the vmcore: 1). The last produced byte and last consumed byte both at the end of the last subbuf 2). A softirq who will call function(e.g __blk_add_trace) to write relay buffer occurs when an program calling function relay_file_read_avail. relay_file_read relay_file_read_avail relay_file_read_consume(buf, 0, 0); //interrupted by softirq who will write subbuf .... return 1; //read_start point to the end of the last subbuf read_start =3D relay_file_read_start_pos //avail is equal to subsize avail =3D relay_file_read_subbuf_avail //from points to an invalid memory address =20 from =3D buf->start + read_start //system is crashed copy_to_user(buffer, from, avail) Signed-off-by: Zhang Zhengming Reviewed-by: Zhao Lei Reviewed-by: Zhou Kete Reviewed-by: Pengcheng Yang --- kernel/relay.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/relay.c b/kernel/relay.c index 9aa70ae..a80fa01 100644 --- a/kernel/relay.c +++ b/kernel/relay.c @@ -989,7 +989,8 @@ static size_t relay_file_read_start_pos(struct rchan_bu= f *buf) size_t subbuf_size =3D buf->chan->subbuf_size; size_t n_subbufs =3D buf->chan->n_subbufs; size_t consumed =3D buf->subbufs_consumed % n_subbufs; - size_t read_pos =3D consumed * subbuf_size + buf->bytes_consumed; + size_t read_pos =3D (consumed * subbuf_size + buf->bytes_consumed) + % (n_subbufs * subbuf_size); =20 read_subbuf =3D read_pos / subbuf_size; padding =3D buf->padding[read_subbuf]; --=20 2.17.1