kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-09-28 19:20:30 +00:00
Code Issues Releases Packages Activity

Hao Qin reported an integer overflow possibility with signed and

Browse source 
unsigned numbers in the ring-buffer code.
 
   https://bugzilla.kernel.org/show_bug.cgi?id=118001
 
 At first I did not think this was too much of an issue, because the
 overflow would be caught later when either too much data was allocated
 or it would trigger RB_WARN_ON() which shuts down the ring buffer.
 
 But looking closer into it, I found that the right settings could bypass
 the checks and crash the kernel. Luckily, this is only accessible
 by root.
 
 The first fix is to convert all the variables into long, such that
 we don't get into issues between 32 bit variables being assigned 64 bit
 ones. This fixes the RB_WARN_ON() triggering.
 
 The next fix is to get rid of a duplicate DIV_ROUND_UP() that when called
 twice with the right value, can cause a kernel crash.
 
 The first DIV_ROUND_UP() is to normalize the input and it is checked
 against the minimum allowable value. But then DIV_ROUND_UP() is called
 again, which can overflow due to the (a + b - 1)/b, logic. The first
 called upped the value, the second can overflow (with the +b part).
 
 The second call to DIV_ROUND_UP() came in via a second change a while ago
 and the code is cleaned up to remove it.
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEbBAABAgAGBQJXOdaqAAoJEKKk/i67LK/8FSAH93vLHClJJFaD5kn8dRhTS7rl
 xVHAC5jHCHiKkQqIGI/N7qhzZ7DqiXpIQjs8KcE86Ser65AGNA48aeBKAA6xSQ+k
 nghDGhiwLixaMIUFA7SNry4VBEcbACxtLENIhBMWo9fmw85jVTH98B958J6CXdlL
 g6OC/PCNmt7eZwPrSB/aqpZ1Jp0Fik3GMXjMtY7axo9D+ONm7LF9qiHT9BcyKxN4
 WHC83yDwUsWqLWxuvuhpGAeMu+nCQurRsPebyXwFh4hj56fhWJjv21ZLKtn2MjKL
 8VO9sKCVEQTvLRGSzPMNP9lxkeuVp/wPrj2JRvX2JtGOqurnRNt2gqIZn2qPqA==
 =Zjyz
 -----END PGP SIGNATURE-----

Merge tag 'trace-fixes-v4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

Pull tracing ring-buffer fixes from Steven Rostedt:
 "Hao Qin reported an integer overflow possibility with signed and
  unsigned numbers in the ring-buffer code.

    https://bugzilla.kernel.org/show_bug.cgi?id=118001

  At first I did not think this was too much of an issue, because the
  overflow would be caught later when either too much data was allocated
  or it would trigger RB_WARN_ON() which shuts down the ring buffer.

  But looking closer into it, I found that the right settings could
  bypass the checks and crash the kernel.  Luckily, this is only
  accessible by root.

  The first fix is to convert all the variables into long, such that we
  don't get into issues between 32 bit variables being assigned 64 bit
  ones.  This fixes the RB_WARN_ON() triggering.

  The next fix is to get rid of a duplicate DIV_ROUND_UP() that when
  called twice with the right value, can cause a kernel crash.

  The first DIV_ROUND_UP() is to normalize the input and it is checked
  against the minimum allowable value.  But then DIV_ROUND_UP() is
  called again, which can overflow due to the (a + b - 1)/b, logic.  The
  first called upped the value, the second can overflow (with the +b
  part).

  The second call to DIV_ROUND_UP() came in via a second change a while
  ago and the code is cleaned up to remove it"

* tag 'trace-fixes-v4.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  ring-buffer: Prevent overflow of size in ring_buffer_resize()
  ring-buffer: Use long for nr_pages to avoid overflow failures
This commit is contained in:
Linus Torvalds 2016-05-17 09:42:58 -07:00
commit 2fe2edf85f
1 changed files with 18 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files