Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] blk_trace_synthesize_old_trace unconditionally parses ring buffer entries as 64-byte blk_io_trace2 structures, resulting in an out-of-bounds read and info leak when processing 48-byte v1 entries because the required dependency patch is missing. --
commit d247914d4d21399a0ee1cb2876aa1eda1b802a86 Author: Donggeun Yoo <[email protected]> blktrace: fix the field offsets of the synthesized v1 record This commit fixes the field offsets of the synthesized v1 record in blk_trace_synthesize_old_trace(). It assigns each v1 field from its v2 counterpart and appends the pdu from the end of the v2 record to prevent reading garbage data. Link: https://lore.kernel.org/all/[email protected]/ > diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c > index 8cd2520b4c99e..99c00cdae42b4 100644 > --- a/kernel/trace/blktrace.c > +++ b/kernel/trace/blktrace.c > @@ -1768,17 +1768,23 @@ static enum print_line_t blk_trace_event_print(struct > trace_iterator *iter, > > static void blk_trace_synthesize_old_trace(struct trace_iterator *iter) > { > + const struct blk_io_trace2 *t = te_blk_io_trace(iter->ent); > struct trace_seq *s = &iter->seq; [ ... ] > + .pdu_len = t->pdu_len, > }; > > - trace_seq_putmem(s, &old, offset); > - trace_seq_putmem(s, &t->sector, > - sizeof(old) - offset + t->pdu_len); > + trace_seq_putmem(s, &old, sizeof(old)); > + trace_seq_putmem(s, t + 1, old.pdu_len); [Severity: High] Does unconditionally parsing ring buffer entries as 64-byte blk_io_trace2 structures result in an out-of-bounds read and info leak? If a user configures blktrace via the setup ioctl (which sets bt->version = 1) enabling the block ftrace plugin, __blk_add_trace() still allocates and writes 48-byte struct blk_io_trace events because the required dependency patch is missing: kernel/trace/blktrace.c:__blk_add_trace() { ... case 1: trace_len = sizeof(struct blk_io_trace); break; ... } When blk_trace_synthesize_old_trace() casts a 48-byte entry to a 64-byte struct blk_io_trace2, reading t->pdu_len accesses offset 50 (which is out of bounds and retrieves garbage). Then calling trace_seq_putmem() starting at t + 1 reads from offset 64 (16 bytes out of bounds) for old.pdu_len bytes. If the random length pdu_len read from the out-of-bounds offset is large, it copies up to 64KB of adjacent kernel memory from the ring buffer to userspace, and crosses page boundaries which can trigger a kernel panic if kasan is enabled. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
