From nobody Fri Dec 19 12:29:44 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83374227B8E; Sat, 12 Apr 2025 21:03:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744491823; cv=none; b=jB+gDBDK8JwiVDZUdY9AJ+AlRL6xLKRqmuwB4wjVTM4TX7HpOFj26AH9LJgqs72kqejobiFD+H+EQ7abPoE1i3aG7s9+V1mEADOZWGCEpX8fC//ao1MaJt6J4g/6wkb0PM6YywoZ7V9iRVWr3Khxi0vm0tOSCQpUeWilBIU+Yzs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1744491823; c=relaxed/simple; bh=z8sTYKbHMCcEu+d5dLCKvRyatcQgaCISPyMbtmKmOSg=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=cUi5qP1PWBq01LttU9PPNx3d7pjK2cThpSBxPn1OFGKBgORUPLf8kAIG+N4lP2HtzJNI/rId8M5xX62Ekg0QMHv/upp3T70QAXJZKHQBXZZQzSiyC2WMuyXxhrR0i+b6U665LMc58BLjiDA46C9Jb5JNh1TDW+QRIij3OlX8avc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6F91CC4CEEE; Sat, 12 Apr 2025 21:03:43 +0000 (UTC) Received: from rostedt by gandalf with local (Exim 4.98) (envelope-from ) id 1u3i2J-0000000AEGK-1y8E; Sat, 12 Apr 2025 17:05:11 -0400 Message-ID: <20250412210511.320072168@goodmis.org> User-Agent: quilt/0.68 Date: Sat, 12 Apr 2025 17:04:53 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Gabriele Monaco , Nam Cao Subject: [for-linus][PATCH 7/7] rv: Fix out-of-bound memory access in rv_is_container_monitor() References: <20250412210446.338481957@goodmis.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Nam Cao When rv_is_container_monitor() is called on the last monitor in rv_monitors_list, KASAN yells: BUG: KASAN: global-out-of-bounds in rv_is_container_monitor+0x101/0x110 Read of size 8 at addr ffffffff97c7c798 by task setup/221 The buggy address belongs to the variable: rv_monitors_list+0x18/0x40 This is due to list_next_entry() is called on the last entry in the list. It wraps around to the first list_head, and the first list_head is not embedded in struct rv_monitor_def. Fix it by checking if the monitor is last in the list. Cc: stable@vger.kernel.org Cc: Gabriele Monaco Fixes: cb85c660fcd4 ("rv: Add option for nested monitors and include sched") Link: https://lore.kernel.org/e85b5eeb7228bfc23b8d7d4ab5411472c54ae91b.1744= 355018.git.namcao@linutronix.de Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) --- kernel/trace/rv/rv.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c index 968c5c3b0246..e4077500a91d 100644 --- a/kernel/trace/rv/rv.c +++ b/kernel/trace/rv/rv.c @@ -225,7 +225,12 @@ bool rv_is_nested_monitor(struct rv_monitor_def *mdef) */ bool rv_is_container_monitor(struct rv_monitor_def *mdef) { - struct rv_monitor_def *next =3D list_next_entry(mdef, list); + struct rv_monitor_def *next; + + if (list_is_last(&mdef->list, &rv_monitors_list)) + return false; + + next =3D list_next_entry(mdef, list); =20 return next->parent =3D=3D mdef->monitor || !mdef->monitor->enable; } --=20 2.47.2