Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1438866
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.19.y-ckt 67/99] ring-buffer: Prevent overflow of size in ring_buffer_resize() |
| Date | 2016-07-07 21:00 +0200 |
| Message-ID | <rSmGK-2kd-47@gated-at.bofh.it> (permalink) |
| References | <rSmnn-2ax-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.19.8-ckt23 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 59643d1535eb220668692a5359de22545af579f6 upstream.
If the size passed to ring_buffer_resize() is greater than MAX_LONG - BUF_PAGE_SIZE
then the DIV_ROUND_UP() will return zero.
Here's the details:
# echo 18014398509481980 > /sys/kernel/debug/tracing/buffer_size_kb
tracing_entries_write() processes this and converts kb to bytes.
18014398509481980 << 10 = 18446744073709547520
and this is passed to ring_buffer_resize() as unsigned long size.
size = DIV_ROUND_UP(size, BUF_PAGE_SIZE);
Where DIV_ROUND_UP(a, b) is (a + b - 1)/b
BUF_PAGE_SIZE is 4080 and here
18446744073709547520 + 4080 - 1 = 18446744073709551599
where 18446744073709551599 is still smaller than 2^64
2^64 - 18446744073709551599 = 17
But now 18446744073709551599 / 4080 = 4521260802379792
and size = size * 4080 = 18446744073709551360
This is checked to make sure its still greater than 2 * 4080,
which it is.
Then we convert to the number of buffer pages needed.
nr_page = DIV_ROUND_UP(size, BUF_PAGE_SIZE)
but this time size is 18446744073709551360 and
2^64 - (18446744073709551360 + 4080 - 1) = -3823
Thus it overflows and the resulting number is less than 4080, which makes
3823 / 4080 = 0
an nr_pages is set to this. As we already checked against the minimum that
nr_pages may be, this causes the logic to fail as well, and we crash the
kernel.
There's no reason to have the two DIV_ROUND_UP() (that's just result of
historical code changes), clean up the code and fix this bug.
Fixes: 83f40318dab00 ("ring-buffer: Make removal of ring buffer pages atomic")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
kernel/trace/ring_buffer.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 8533ec9..56607e9 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1691,14 +1691,13 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size,
!cpumask_test_cpu(cpu_id, buffer->cpumask))
return size;
- size = DIV_ROUND_UP(size, BUF_PAGE_SIZE);
- size *= BUF_PAGE_SIZE;
+ nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE);
/* we need a minimum of two pages */
- if (size < BUF_PAGE_SIZE * 2)
- size = BUF_PAGE_SIZE * 2;
+ if (nr_pages < 2)
+ nr_pages = 2;
- nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE);
+ size = nr_pages * BUF_PAGE_SIZE;
/*
* Don't succeed if resizing is disabled, as a reader might be
--
2.7.4
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.19.y-ckt stable] Linux 3.19.8-ckt23 stable review Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:40 +0200
[PATCH 3.19.y-ckt 06/99] drm/gma500: Fix possible out of bounds read Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:40 +0200
[PATCH 3.19.y-ckt 07/99] Bluetooth: vhci: fix open_timeout vs. hdev race Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:40 +0200
[PATCH 3.19.y-ckt 03/99] drm/i915: Fix race condition in intel_dp_destroy_mst_connector() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:40 +0200
[PATCH 3.19.y-ckt 08/99] Bluetooth: vhci: purge unhandled skbs Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:40 +0200
[PATCH 3.19.y-ckt 82/99] KVM: MTRR: remove MSR 0x2f8 Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 92/99] xen/events: Don't move disabled irqs Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 95/99] hpfs: fix remount failure when there are no options changed Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 84/99] Input: uinput - handle compat ioctl for UI_SET_PHYS Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 81/99] xfs: skip stale inodes in xfs_iflush_cluster Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 87/99] mmc: sdhci-pci: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 73/99] fs/cifs: correctly to anonymous authentication via NTLMSSP Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 74/99] fs/cifs: correctly to anonymous authentication for the LANMAN authentication Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 91/99] xen/x86: actually allocate legacy interrupts on PV guests Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 89/99] sunrpc: fix stripping of padded MIC tokens Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 43/99] MIPS: Fix siginfo.h to use strict posix types Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 05/99] ath5k: Change led pin configuration for compaq c700 laptop Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 88/99] mmc: sdhci-acpi: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 77/99] remove directory incorrectly tries to set delete on close on non-empty directories Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 71/99] drm/i915/fbdev: Fix num_connector references in intel_fb_initial_config() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 90/99] wait/ptrace: assume __WALL if the child is traced Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 76/99] fs/cifs: correctly to anonymous authentication for the NTLM(v2) authentication Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 70/99] MIPS: MSA: Fix a link error on `_init_msa_upper' with older GCC Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 98/99] powerpc/pseries: Fix PCI config address for DDW Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 64/99] powerpc/eeh: Restore initial state in eeh_pe_reset_and_recover() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 83/99] ASoC: ak4642: Enable cache usage to fix crashes on resume Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 93/99] dma-debug: avoid spinlock recursion when disabling dma-debug Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 65/99] MIPS: math-emu: Fix jalr emulation when rd == $0 Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 85/99] PM / sleep: Handle failures in device_suspend_late() consistently Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 97/99] powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 78/99] cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 96/99] hpfs: implement the show_options method Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 44/99] MIPS: Don't unwind to user mode with EVA Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 86/99] mmc: longer timeout for long read time quirk Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 01/99] mm: migrate dirty page without clear_page_dirty_for_io etc Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 99/99] can: fix handling of unmodifiable configuration options fix Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 75/99] fs/cifs: correctly to anonymous authentication for the NTLM(v1) authentication Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 69/99] PCI: Disable all BAR sizing for devices with non-compliant BARs Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 36/99] ACPI / osi: Fix an issue that acpi_osi=!* cannot disable ACPICA internal strings Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 94/99] Input: xpad - prevent spurious input from wired Xbox 360 controllers Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 80/99] xfs: fix inode validity check in xfs_iflush_cluster Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 79/99] xfs: xfs_iflush_cluster fails to abort on error Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 68/99] mmc: mmc: Fix partition switch timeout for some eMMCs Kamal Mostafa <kamal@canonical.com> - 2016-07-07 20:50 +0200
[PATCH 3.19.y-ckt 72/99] drm/fb_helper: Fix references to dev->mode_config.num_connector Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 53/99] USB: serial: quatech2: fix use-after-free in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 55/99] MIPS: KVM: Fix timer IRQ race when freezing timer Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 66/99] ring-buffer: Use long for nr_pages to avoid overflow failures Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 46/99] MIPS: Reserve nosave data for hibernation Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 59/99] arm64: cpuinfo: Missing NULL terminator in compat_hwcap_str Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 35/99] USB: serial: option: add even more ZTE device ids Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 58/99] irqchip/gic: Ensure ordering between read of INTACK and shared data Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 33/99] mcb: Fixed bar number assignment for the gdd Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 57/99] gcov: disable tree-loop-im to reduce stack usage Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 42/99] can: fix handling of unmodifiable configuration options Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 34/99] USB: serial: option: add more ZTE device ids Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 24/99] arm/arm64: KVM: Enforce Break-Before-Make on Stage-2 page tables Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 45/99] MIPS: Avoid using unwind_stack() with usermode Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 50/99] USB: serial: io_edgeport: fix memory leaks in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 26/99] aacraid: Fix for aac_command_thread hang Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 54/99] crypto: caam - fix caam_jr_alloc() ret code Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 52/99] USB: serial: mxuport: fix use-after-free in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 62/99] rtlwifi: pci: use dev_kfree_skb_irq instead of kfree_skb in rtl_pci_reset_trx_ring Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 67/99] ring-buffer: Prevent overflow of size in ring_buffer_resize() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 38/99] ext4: fix oops on corrupted filesystem Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 56/99] MIPS: KVM: Fix timer IRQ race when writing CP0_Compare Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 47/99] usb: host: xhci-rcar: Avoid long wait in xhci_reset() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 40/99] ext4: silence UBSAN in ext4_mb_init() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 61/99] rtlwifi: Fix logic error in enter/exit power-save mode Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 48/99] mfd: omap-usb-tll: Fix scheduling while atomic BUG Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 29/99] QE-UART: add "fsl,t1040-ucc-uart" to of_device_id Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 49/99] USB: serial: io_edgeport: fix memory leaks in attach error path Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 41/99] arm64: Ensure pmd_present() returns false after pmd_mknotpresent() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 30/99] thunderbolt: Fix double free of drom buffer Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 51/99] USB: serial: keyspan: fix use-after-free in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 63/99] powerpc/eeh: Don't report error in eeh_pe_reset_and_recover() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 60/99] kbuild: move -Wunused-const-variable to W=1 warning level Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 39/99] ext4: address UBSAN warning in mb_find_order_for_block() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:00 +0200
[PATCH 3.19.y-ckt 09/99] cpuidle: Indicate when a device has been unregistered Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 20/99] pinctrl: exynos5440: Use off-stack memory for pinctrl_gpio_range Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 21/99] btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 18/99] ath9k: Add a module parameter to invert LED polarity. Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 28/99] MIPS: ath79: make bootconsole wait for both THRE and TEMT Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 16/99] PM / Runtime: Fix error path in pm_runtime_force_resume() Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 17/99] crypto: s5p-sss - Fix missed interrupts when working with 8 kB blocks Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 32/99] USB: leave LPM alone if possible when binding/unbinding interface drivers Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 12/99] Revert "scsi: fix soft lockup in scsi_remove_target() on module removal" Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 10/99] [media] media: v4l2-compat-ioctl32: fix missing reserved field copy in put_v4l2_create32 Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 23/99] TTY: n_gsm, fix false positive WARN_ON Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 25/99] aacraid: Relinquish CPU during timeout wait Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 22/99] usb: core: hub: hub_port_init lock controller instead of bus Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 14/99] Bluetooth: vhci: Fix race at creating hci device Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 37/99] USB: serial: cp210x: fix hardware flow-control disable Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 04/99] ath10k: fix debugfs pktlog_filter write Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 02/99] ath10k: fix firmware assert in monitor mode Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 19/99] ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards. Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 11/99] scsi: Add intermediate STARGET_REMOVE state to scsi_target_state Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 15/99] powerpc/book3s64: Fix branching to OOL handlers in relocatable kernel Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 31/99] USB: serial: option: add support for Cinterion PH8 and AHxx Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 13/99] usb: f_mass_storage: test whether thread is running before starting another Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
[PATCH 3.19.y-ckt 27/99] ext4: fix hang when processing corrupted orphaned inode list Kamal Mostafa <kamal@canonical.com> - 2016-07-07 21:10 +0200
csiph-web