CVE-2023-53709

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ring-buffer: Handle race between rb_move_tail and rb_check_pages<br /> <br /> It seems a data race between ring_buffer writing and integrity check.<br /> That is, RB_FLAG of head_page is been updating, while at same time<br /> RB_FLAG was cleared when doing integrity check rb_check_pages():<br /> <br /> rb_check_pages() rb_handle_head_page():<br /> -------- --------<br /> rb_head_page_deactivate()<br /> rb_head_page_set_normal()<br /> rb_head_page_activate()<br /> <br /> We do intergrity test of the list to check if the list is corrupted and<br /> it is still worth doing it. So, let&amp;#39;s refactor rb_check_pages() such that<br /> we no longer clear and set flag during the list sanity checking.<br /> <br /> [1] and [2] are the test to reproduce and the crash report respectively.<br /> <br /> 1:<br /> ``` read_trace.sh<br /> while true;<br /> do<br /> # the "trace" file is closed after read<br /> head -1 /sys/kernel/tracing/trace &gt; /dev/null<br /> done<br /> ```<br /> ``` repro.sh<br /> sysctl -w kernel.panic_on_warn=1<br /> # function tracer will writing enough data into ring_buffer<br /> echo function &gt; /sys/kernel/tracing/current_tracer<br /> ./read_trace.sh &amp;<br /> ./read_trace.sh &amp;<br /> ./read_trace.sh &amp;<br /> ./read_trace.sh &amp;<br /> ./read_trace.sh &amp;<br /> ./read_trace.sh &amp;<br /> ./read_trace.sh &amp;<br /> ./read_trace.sh &amp;<br /> ```<br /> <br /> 2:<br /> ------------[ cut here ]------------<br /> WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653<br /> rb_move_tail+0x450/0x470<br /> Modules linked in:<br /> CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS<br /> rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014<br /> RIP: 0010:rb_move_tail+0x450/0x470<br /> Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24<br /> 83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 0b 83<br /> f8 02 0f 84 ce fb ff ff e9 db<br /> RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203<br /> RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18<br /> RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400<br /> RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2<br /> R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000<br /> R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108<br /> FS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000)<br /> knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0<br /> Call Trace:<br /> <br /> ring_buffer_lock_reserve+0x136/0x360<br /> ? __do_softirq+0x287/0x2df<br /> ? __pfx_rcu_softirq_qs+0x10/0x10<br /> trace_function+0x21/0x110<br /> ? __pfx_rcu_softirq_qs+0x10/0x10<br /> ? __do_softirq+0x287/0x2df<br /> function_trace_call+0xf6/0x120<br /> 0xffffffffc038f097<br /> ? rcu_softirq_qs+0x5/0x140<br /> rcu_softirq_qs+0x5/0x140<br /> __do_softirq+0x287/0x2df<br /> run_ksoftirqd+0x2a/0x30<br /> smpboot_thread_fn+0x188/0x220<br /> ? __pfx_smpboot_thread_fn+0x10/0x10<br /> kthread+0xe7/0x110<br /> ? __pfx_kthread+0x10/0x10<br /> ret_from_fork+0x2c/0x50<br /> <br /> ---[ end trace 0000000000000000 ]---<br /> <br /> [ crash report and test reproducer credit goes to Zheng Yejian]