[PATCH v10 3/4] ring-buffer: Cap static ring buffer nr_pages

[Vincent Donnefort]

Static ring buffers (i.e. persistent, user-mapped and remote) rely on
the bpage::id field. The number of pages for those ring buffers must fit
into that variable. Enforce this limit on ring buffer creation or
user-mapping.

While at it, prevent nr_pages underflow when allocating a persistent
buffer.

Fixes: be68d63a139b ("ring-buffer: Add ring_buffer_alloc_range()")
Signed-off-by: Vincent Donnefort <vdonnef...@google.com>

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 2f61cb510b0a..6b914abd80e3 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -657,6 +657,15 @@ static bool rb_is_static(struct ring_buffer_per_cpu 
*cpu_buffer)
        return cpu_buffer->user_mapped || cpu_buffer->remote || 
cpu_buffer->ring_meta;
 }
 
+static unsigned long rb_static_max_pages(void)
+{
+       /*
+        * Static ring buffers are using bpage::id and must account for the
+        * reader page.
+        */
+       return (1UL << 30) - 1;
+}
+
 struct ring_buffer_iter {
        struct ring_buffer_per_cpu      *cpu_buffer;
        unsigned long                   head;
@@ -2833,6 +2842,8 @@ static struct trace_buffer *alloc_buffer(unsigned long 
size, unsigned flags,
                size = end - buffers_start;
                size = size / nr_cpu_ids;
 
+               if (size < sizeof(struct ring_buffer_cpu_meta))
+                       goto fail_free_buffers;
                /*
                 * The number of sub-buffers (nr_pages) is determined by the
                 * total size allocated minus the meta data size.
@@ -2842,6 +2853,10 @@ static struct trace_buffer *alloc_buffer(unsigned long 
size, unsigned flags,
                 */
                nr_pages = (size - sizeof(struct ring_buffer_cpu_meta)) /
                        (subbuf_size + sizeof(int));
+
+               if (nr_pages > rb_static_max_pages())
+                       goto fail_free_buffers;
+
                /* Need at least two pages plus the reader page */
                if (nr_pages < 3)
                        goto fail_free_buffers;
@@ -2874,6 +2889,10 @@ static struct trace_buffer *alloc_buffer(unsigned long 
size, unsigned flags,
                /* The writer is remote. This ring-buffer is read-only */
                atomic_inc(&buffer->record_disabled);
                nr_pages = desc->nr_page_va - 1;
+
+               if (nr_pages > rb_static_max_pages())
+                       goto fail_free_buffers;
+
                if (nr_pages < 2)
                        goto fail_free_buffers;
        } else {
@@ -7836,6 +7855,9 @@ int ring_buffer_map(struct trace_buffer *buffer, int cpu,
        /* prevent another thread from changing buffer/sub-buffer sizes */
        guard(mutex)(&buffer->mutex);
 
+       if (cpu_buffer->nr_pages > rb_static_max_pages())
+               return -E2BIG;
+
        err = rb_alloc_meta_page(cpu_buffer);
        if (err)
                return err;
-- 
2.55.0.979.g7e5102b832-goog