CVE-2024-38601

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ring-buffer: Fix a race between readers and resize checks<br /> <br /> The reader code in rb_get_reader_page() swaps a new reader page into the<br /> ring buffer by doing cmpxchg on old-&gt;list.prev-&gt;next to point it to the<br /> new page. Following that, if the operation is successful,<br /> old-&gt;list.next-&gt;prev gets updated too. This means the underlying<br /> doubly-linked list is temporarily inconsistent, page-&gt;prev-&gt;next or<br /> page-&gt;next-&gt;prev might not be equal back to page for some page in the<br /> ring buffer.<br /> <br /> The resize operation in ring_buffer_resize() can be invoked in parallel.<br /> It calls rb_check_pages() which can detect the described inconsistency<br /> and stop further tracing:<br /> <br /> [ 190.271762] ------------[ cut here ]------------<br /> [ 190.271771] WARNING: CPU: 1 PID: 6186 at kernel/trace/ring_buffer.c:1467 rb_check_pages.isra.0+0x6a/0xa0<br /> [ 190.271789] Modules linked in: [...]<br /> [ 190.271991] Unloaded tainted modules: intel_uncore_frequency(E):1 skx_edac(E):1<br /> [ 190.272002] CPU: 1 PID: 6186 Comm: cmd.sh Kdump: loaded Tainted: G E 6.9.0-rc6-default #5 158d3e1e6d0b091c34c3b96bfd99a1c58306d79f<br /> [ 190.272011] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552c-rebuilt.opensuse.org 04/01/2014<br /> [ 190.272015] RIP: 0010:rb_check_pages.isra.0+0x6a/0xa0<br /> [ 190.272023] Code: [...]<br /> [ 190.272028] RSP: 0018:ffff9c37463abb70 EFLAGS: 00010206<br /> [ 190.272034] RAX: ffff8eba04b6cb80 RBX: 0000000000000007 RCX: ffff8eba01f13d80<br /> [ 190.272038] RDX: ffff8eba01f130c0 RSI: ffff8eba04b6cd00 RDI: ffff8eba0004c700<br /> [ 190.272042] RBP: ffff8eba0004c700 R08: 0000000000010002 R09: 0000000000000000<br /> [ 190.272045] R10: 00000000ffff7f52 R11: ffff8eba7f600000 R12: ffff8eba0004c720<br /> [ 190.272049] R13: ffff8eba00223a00 R14: 0000000000000008 R15: ffff8eba067a8000<br /> [ 190.272053] FS: 00007f1bd64752c0(0000) GS:ffff8eba7f680000(0000) knlGS:0000000000000000<br /> [ 190.272057] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> [ 190.272061] CR2: 00007f1bd6662590 CR3: 000000010291e001 CR4: 0000000000370ef0<br /> [ 190.272070] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000<br /> [ 190.272073] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400<br /> [ 190.272077] Call Trace:<br /> [ 190.272098] <br /> [ 190.272189] ring_buffer_resize+0x2ab/0x460<br /> [ 190.272199] __tracing_resize_ring_buffer.part.0+0x23/0xa0<br /> [ 190.272206] tracing_resize_ring_buffer+0x65/0x90<br /> [ 190.272216] tracing_entries_write+0x74/0xc0<br /> [ 190.272225] vfs_write+0xf5/0x420<br /> [ 190.272248] ksys_write+0x67/0xe0<br /> [ 190.272256] do_syscall_64+0x82/0x170<br /> [ 190.272363] entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> [ 190.272373] RIP: 0033:0x7f1bd657d263<br /> [ 190.272381] Code: [...]<br /> [ 190.272385] RSP: 002b:00007ffe72b643f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001<br /> [ 190.272391] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f1bd657d263<br /> [ 190.272395] RDX: 0000000000000002 RSI: 0000555a6eb538e0 RDI: 0000000000000001<br /> [ 190.272398] RBP: 0000555a6eb538e0 R08: 000000000000000a R09: 0000000000000000<br /> [ 190.272401] R10: 0000555a6eb55190 R11: 0000000000000246 R12: 00007f1bd6662500<br /> [ 190.272404] R13: 0000000000000002 R14: 00007f1bd6667c00 R15: 0000000000000002<br /> [ 190.272412] <br /> [ 190.272414] ---[ end trace 0000000000000000 ]---<br /> <br /> Note that ring_buffer_resize() calls rb_check_pages() only if the parent<br /> trace_buffer has recording disabled. Recent commit d78ab792705c<br /> ("tracing: Stop current tracer when resizing buffer") causes that it is<br /> now always the case which makes it more likely to experience this issue.<br /> <br /> The window to hit this race is nonetheless very small. To help<br /> reproducing it, one can add a delay loop in rb_get_reader_page():<br /> <br /> ret = rb_head_page_replace(reader, cpu_buffer-&gt;reader_page);<br /> if (!ret)<br /> goto spin;<br /> for (unsigned i = 0; i reader_page-&gt;list;<br /> <br /> .. <br /> ---truncated---