From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 5 May 2025 08:19:12 +0000 (+0200)
Subject: 5.10-stable patches
X-Git-Tag: v6.1.137~10
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1198e5b5329a985d57d52cbcd67edaa67ad4385d;p=thirdparty%2Fkernel%2Fstable-queue.git

5.10-stable patches

added patches:
	tracing-fix-oob-write-in-trace_seq_to_buffer.patch
---

diff --git a/queue-5.10/series b/queue-5.10/series
index dd58bd56b0..ed0ac8aeaa 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -11,3 +11,4 @@ dm-integrity-fix-a-warning-on-invalid-table-line.patch
 dm-always-update-the-array-size-in-realloc_argv-on-success.patch
 iommu-amd-fix-potential-buffer-overflow-in-parse_ivrs_acpihid.patch
 iommu-vt-d-apply-quirk_iommu_igfx-for-8086-0044-qm57-qs57.patch
+tracing-fix-oob-write-in-trace_seq_to_buffer.patch
diff --git a/queue-5.10/tracing-fix-oob-write-in-trace_seq_to_buffer.patch b/queue-5.10/tracing-fix-oob-write-in-trace_seq_to_buffer.patch
new file mode 100644
index 0000000000..a7e1bc70c6
--- /dev/null
+++ b/queue-5.10/tracing-fix-oob-write-in-trace_seq_to_buffer.patch
@@ -0,0 +1,66 @@
+From f5178c41bb43444a6008150fe6094497135d07cb Mon Sep 17 00:00:00 2001
+From: Jeongjun Park <aha310510@gmail.com>
+Date: Tue, 22 Apr 2025 20:30:25 +0900
+Subject: tracing: Fix oob write in trace_seq_to_buffer()
+
+From: Jeongjun Park <aha310510@gmail.com>
+
+commit f5178c41bb43444a6008150fe6094497135d07cb upstream.
+
+syzbot reported this bug:
+==================================================================
+BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]
+BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822
+Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260
+
+CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:408 [inline]
+ print_report+0xc3/0x670 mm/kasan/report.c:521
+ kasan_report+0xe0/0x110 mm/kasan/report.c:634
+ check_region_inline mm/kasan/generic.c:183 [inline]
+ kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
+ __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106
+ trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]
+ tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822
+ ....
+==================================================================
+
+It has been reported that trace_seq_to_buffer() tries to copy more data
+than PAGE_SIZE to buf. Therefore, to prevent this, we should use the
+smaller of trace_seq_used(&iter->seq) and PAGE_SIZE as an argument.
+
+Link: https://lore.kernel.org/20250422113026.13308-1-aha310510@gmail.com
+Reported-by: syzbot+c8cd2d2c412b868263fb@syzkaller.appspotmail.com
+Fixes: 3c56819b14b0 ("tracing: splice support for tracing_pipe")
+Suggested-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Jeongjun Park <aha310510@gmail.com>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/trace/trace.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -6685,13 +6685,14 @@ static ssize_t tracing_splice_read_pipe(
+ 		/* Copy the data into the page, so we can start over. */
+ 		ret = trace_seq_to_buffer(&iter->seq,
+ 					  page_address(spd.pages[i]),
+-					  trace_seq_used(&iter->seq));
++					  min((size_t)trace_seq_used(&iter->seq),
++						  PAGE_SIZE));
+ 		if (ret < 0) {
+ 			__free_page(spd.pages[i]);
+ 			break;
+ 		}
+ 		spd.partial[i].offset = 0;
+-		spd.partial[i].len = trace_seq_used(&iter->seq);
++		spd.partial[i].len = ret;
+ 
+ 		trace_seq_init(&iter->seq);
+ 	}