Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]ring-buffer: Handle race between rb_move_tail and rb_check_pages[EOL][EOL]It seems a data race between ring_buffer writing and integrity check.[EOL]That is, RB_FLAG of head_page is been updating, while at same time[EOL]RB_FLAG was cleared when doing integrity check rb_check_pages():[EOL][EOL]  rb_check_pages()            rb_handle_head_page():[EOL]  --------                    --------[EOL]  rb_head_page_deactivate()[EOL]                              rb_head_page_set_normal()[EOL]  rb_head_page_activate()[EOL][EOL]We do intergrity test of the list to check if the list is corrupted and[EOL]it is still worth doing it. So, let's refactor rb_check_pages() such that[EOL]we no longer clear and set flag during the list sanity checking.[EOL][EOL][1] and [2] are the test to reproduce and the crash report respectively.[EOL][EOL]1:[EOL]``` read_trace.sh[EOL]  while true;[EOL]  do[EOL]    # the "trace" file is closed after read[EOL]    head -1 /sys/kernel/tracing/trace > /dev/null[EOL]  done[EOL]```[EOL]``` repro.sh[EOL]  sysctl -w kernel.panic_on_warn=1[EOL]  # function tracer will writing enough data into ring_buffer[EOL]  echo function > /sys/kernel/tracing/current_tracer[EOL]  ./read_trace.sh &[EOL]  ./read_trace.sh &[EOL]  ./read_trace.sh &[EOL]  ./read_trace.sh &[EOL]  ./read_trace.sh &[EOL]  ./read_trace.sh &[EOL]  ./read_trace.sh &[EOL]  ./read_trace.sh &[EOL]```[EOL][EOL]2:[EOL]------------[ cut here ]------------[EOL]WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653[EOL]rb_move_tail+0x450/0x470[EOL]Modules linked in:[EOL]CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G        W          6.2.0-rc6+[EOL]Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS[EOL]rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014[EOL]RIP: 0010:rb_move_tail+0x450/0x470[EOL]Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24[EOL]83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83[EOL]f8 02 0f 84 ce fb ff ff e9 db[EOL]RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203[EOL]RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18[EOL]RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400[EOL]RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2[EOL]R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000[EOL]R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108[EOL]FS:  0000000000000000(0000) GS:ffff9db3bdcc0000(0000)[EOL]knlGS:0000000000000000[EOL]CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033[EOL]CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0[EOL]Call Trace:[EOL] <TASK>[EOL] ring_buffer_lock_reserve+0x136/0x360[EOL] ? __do_softirq+0x287/0x2df[EOL] ? __pfx_rcu_softirq_qs+0x10/0x10[EOL] trace_function+0x21/0x110[EOL] ? __pfx_rcu_softirq_qs+0x10/0x10[EOL] ? __do_softirq+0x287/0x2df[EOL] function_trace_call+0xf6/0x120[EOL] 0xffffffffc038f097[EOL] ? rcu_softirq_qs+0x5/0x140[EOL] rcu_softirq_qs+0x5/0x140[EOL] __do_softirq+0x287/0x2df[EOL] run_ksoftirqd+0x2a/0x30[EOL] smpboot_thread_fn+0x188/0x220[EOL] ? __pfx_smpboot_thread_fn+0x10/0x10[EOL] kthread+0xe7/0x110[EOL] ? __pfx_kthread+0x10/0x10[EOL] ret_from_fork+0x2c/0x50[EOL] </TASK>[EOL]---[ end trace 0000000000000000 ]---[EOL][EOL][ crash report and test reproducer credit goes to Zheng Yejian]

CVEs

• CVE-2023-53709