Commit 157a4a01 authored by Tze-nan Wu's avatar Tze-nan Wu Committed by Liu Chuang
Browse files

tracing: Fix overflow in get_free_elt() 

stable inclusion
from stable-v5.10.224
commit eb223bf01e688dfe37e813c8988ee11c8c9f8d0a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMMUB
CVE: CVE-2024-43890

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=eb223bf01e688dfe37e813c8988ee11c8c9f8d0a



--------------------------------

commit bcf86c01ca4676316557dd482c8416ece8c2e143 upstream.

"tracing_map->next_elt" in get_free_elt() is at risk of overflowing.

Once it overflows, new elements can still be inserted into the tracing_map
even though the maximum number of elements (`max_elts`) has been reached.
Continuing to insert elements after the overflow could result in the
tracing_map containing "tracing_map->max_size" elements, leaving no empty
entries.
If any attempt is made to insert an element into a full tracing_map using
`__tracing_map_insert()`, it will cause an infinite loop with preemption
disabled, leading to a CPU hang problem.

Fix this by preventing any further increments to "tracing_map->next_elt"
once it reaches "tracing_map->max_elt".

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: 08d43a5f ("tracing: Add lock-free tracing_map")
Co-developed-by: default avatarCheng-Jui Wang <cheng-jui.wang@mediatek.com>
Link: https://lore.kernel.org/20240805055922.6277-1-Tze-nan.Wu@mediatek.com


Signed-off-by: default avatarCheng-Jui Wang <cheng-jui.wang@mediatek.com>
Signed-off-by: default avatarTze-nan Wu <Tze-nan.Wu@mediatek.com>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarLiu Chuang <liuchuang40@huawei.com>
parent f7cda317

kernel/trace/tracing_map.c

+3 −3
Original line number Diff line number Diff line
@@ -454,7 +454,7 @@ static struct tracing_map_elt *get_free_elt(struct tracing_map *map) 
	struct tracing_map_elt *elt = NULL;

	int idx;



	idx = atomic_inc_return(&map->next_elt);

	idx = atomic_fetch_add_unless(&map->next_elt, 1, map->max_elts);

	if (idx < map->max_elts) {

		elt = *(TRACING_MAP_ELT(map->elts, idx));

		if (map->ops && map->ops->elt_init)
@@ -699,7 +699,7 @@ void tracing_map_clear(struct tracing_map *map) 
{

	unsigned int i;



	atomic_set(&map->next_elt, -1);

	atomic_set(&map->next_elt, 0);

	atomic64_set(&map->hits, 0);

	atomic64_set(&map->drops, 0);
@@ -783,7 +783,7 @@ struct tracing_map *tracing_map_create(unsigned int map_bits, 


	map->map_bits = map_bits;

	map->max_elts = (1 << map_bits);

	atomic_set(&map->next_elt, -1);

	atomic_set(&map->next_elt, 0);



	map->map_size = (1 << (map_bits + 1));

	map->ops = ops;