5.10-stable patches

added patches:
	tracing-fix-oob-write-in-trace_seq_to_buffer.patch

diff --git a/queue-5.10/series b/queue-5.10/series
index dd58bd56b07a0533da52871ed39c720c4066a01c..ed0ac8aeaa4abad4532f639c6147c89034eb8094 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -11,3 +11,4 @@ dm-integrity-fix-a-warning-on-invalid-table-line.patch
 dm-always-update-the-array-size-in-realloc_argv-on-success.patch
 iommu-amd-fix-potential-buffer-overflow-in-parse_ivrs_acpihid.patch
 iommu-vt-d-apply-quirk_iommu_igfx-for-8086-0044-qm57-qs57.patch
+tracing-fix-oob-write-in-trace_seq_to_buffer.patch

diff --git a/queue-5.10/tracing-fix-oob-write-in-trace_seq_to_buffer.patch b/queue-5.10/tracing-fix-oob-write-in-trace_seq_to_buffer.patch
new file mode 100644 (file)
index 0000000..a7e1bc7
--- /dev/null
+++ b/queue-5.10/tracing-fix-oob-write-in-trace_seq_to_buffer.patch
@@ -0,0 +1,66 @@
+From f5178c41bb43444a6008150fe6094497135d07cb Mon Sep 17 00:00:00 2001
+From: Jeongjun Park <aha310510@gmail.com>
+Date: Tue, 22 Apr 2025 20:30:25 +0900
+Subject: tracing: Fix oob write in trace_seq_to_buffer()
+
+From: Jeongjun Park <aha310510@gmail.com>
+
+commit f5178c41bb43444a6008150fe6094497135d07cb upstream.
+
+syzbot reported this bug:
+==================================================================
+BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]
+BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822
+Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260
+
+CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:408 [inline]
+ print_report+0xc3/0x670 mm/kasan/report.c:521
+ kasan_report+0xe0/0x110 mm/kasan/report.c:634
+ check_region_inline mm/kasan/generic.c:183 [inline]
+ kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
+ __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106
+ trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]
+ tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822
+ ....
+==================================================================
+
+It has been reported that trace_seq_to_buffer() tries to copy more data
+than PAGE_SIZE to buf. Therefore, to prevent this, we should use the
+smaller of trace_seq_used(&iter->seq) and PAGE_SIZE as an argument.
+
+Link: https://lore.kernel.org/20250422113026.13308-1-aha310510@gmail.com
+Reported-by: syzbot+c8cd2d2c412b868263fb@syzkaller.appspotmail.com
+Fixes: 3c56819b14b0 ("tracing: splice support for tracing_pipe")
+Suggested-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Jeongjun Park <aha310510@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -6685,13 +6685,14 @@ static ssize_t tracing_splice_read_pipe(
+               /* Copy the data into the page, so we can start over. */
+               ret = trace_seq_to_buffer(&iter->seq,
+                                         page_address(spd.pages[i]),
+-                                        trace_seq_used(&iter->seq));
++                                        min((size_t)trace_seq_used(&iter->seq),
++                                                PAGE_SIZE));
+               if (ret < 0) {
+                       __free_page(spd.pages[i]);
+                       break;
+               }
+               spd.partial[i].offset = 0;
+-              spd.partial[i].len = trace_seq_used(&iter->seq);
++              spd.partial[i].len = ret;
+ 
+               trace_seq_init(&iter->seq);
+       }