tracing: Limit access to parser->buffer when trace_get_user failed

访问trace_parser->buffer报OOB告警；

BUG: KASAN: slab-out-of-bounds in strpbrk lib/string.c:574 [inline]
BUG: KASAN: slab-out-of-bounds in strsep+0xc0/0xd4 lib/string.c:605
Read of size 1 at addr ffff0000d886c1f3 by task syz.1.542/3988

CPU: 1 PID: 3988 Comm: syz.1.542 Not tainted 5.10.0-g19119f1eadcd #1
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x4f0 arch/arm64/kernel/stacktrace.c:202
 show_stack+0x34/0x44 arch/arm64/kernel/stacktrace.c:267
 __dump_stack lib/dump_stack.c:82 [inline]
 dump_stack+0x1d0/0x248 lib/dump_stack.c:123
 print_address_description.constprop.0+0x2c/0x1fc mm/kasan/report.c:400
 __kasan_report+0xfc/0x160 mm/kasan/report.c:560
 kasan_report+0x44/0x60 mm/kasan/report.c:585
 check_memory_region_inline mm/kasan/generic.c:217 [inline]
 __asan_load1+0x70/0xa0 mm/kasan/generic.c:280
 strpbrk lib/string.c:574 [inline]
 strsep+0xc0/0xd4 lib/string.c:605
 ftrace_process_regex.isra.0+0xb8/0x214 kernel/trace/ftrace.c:4894
 ftrace_regex_release+0x2f8/0x334 kernel/trace/ftrace.c:5709
 __fput+0x17c/0x5cc fs/file_table.c:294
 ____fput+0x28/0x40 fs/file_table.c:324
 task_work_run+0xe8/0x190 kernel/task_work.c:187
 exit_task_work include/linux/task_work.h:33 [inline]
 do_exit+0x424/0x8b0 kernel/exit.c:920
 do_group_exit+0x94/0x170 kernel/exit.c:1035
 get_signal+0x308/0xbd0 kernel/signal.c:3017
 do_signal+0x154/0x41c arch/arm64/kernel/signal.c:669
 do_notify_resume+0x2a0/0x3e0 arch/arm64/kernel/signal.c:725
 work_pending+0xc/0x6d8

Allocated by task 3988:
 kasan_save_stack+0x28/0x60 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 set_alloc_info mm/kasan/common.c:513 [inline]
 __kasan_kmalloc mm/kasan/common.c:545 [inline]
 __kasan_kmalloc.constprop.0+0xd8/0x140 mm/kasan/common.c:516
 kasan_kmalloc+0x10/0x20 mm/kasan/common.c:559
 __kmalloc+0xd8/0x7cc mm/slub.c:4104
 kmalloc include/linux/slab.h:620 [inline]
 trace_parser_get_init+0x3c/0xa0 kernel/trace/trace.c:1578
 ftrace_regex_open+0xd8/0x60c kernel/trace/ftrace.c:3816
 ftrace_filter_open+0x38/0x50 kernel/trace/ftrace.c:3888
 do_dentry_open+0x400/0x950 fs/open.c:826
 vfs_open+0x60/0x70 fs/open.c:935
 do_open+0x4f0/0x6f0 fs/namei.c:3316
 path_openat+0x260/0x39c fs/namei.c:3434
 do_filp_open+0x108/0x22c fs/namei.c:3461
 do_sys_openat2+0x4c4/0x6b0 fs/open.c:1232
 do_sys_open fs/open.c:1249 [inline]
 __do_sys_openat fs/open.c:1265 [inline]
 __se_sys_openat fs/open.c:1260 [inline]
 __arm64_sys_openat+0x118/0x194 fs/open.c:1260
 __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
 el0_svc_common.constprop.0+0xec/0x41c arch/arm64/kernel/syscall.c:155
 do_el0_svc+0x50/0x130 arch/arm64/kernel/syscall.c:217
 el0_svc+0x24/0x34 arch/arm64/kernel/entry-common.c:385
 el0_sync_handler+0x180/0x18c arch/arm64/kernel/entry-common.c:417
 el0_sync+0x180/0x1c0 arch/arm64/kernel/entry.S:1192

GVP openEuler/kernel

内容风险标识

评论 (3)

GVPopenEuler/kernel

内容风险标识