[for-linus][PATCH 05/13] ring_buffer: Check page order under reader_lock

[Steven Rostedt]

From: Yash Suthar <yashsuthar983@xxxxxxxxx>

When the ring_buffer_subbuf_order_set() is called the same time as the
ring_buffer_read_page(), the wrong buffer->subbuf_size can be used as
there is nothing keeping that in sync. This can cause an incorrect
allocation and initialization that can cause a crash.

Move the saving of the subbuf_size into a variable within the
cpu_buffer->reader_lock, and use that throughout the function.
The size only needs to be consistent throughout the allocation and
initialization. If the buffer->subbuf_size changes when used, the reader
data page will be found to be invalid and the read function will return an
error (this is as expected).

syzbot did not provide a reproducer for this crash, the race
condition is logically sound and found via code inspection of the
trace.

Cc: stable@xxxxxxxxxxxxxxx
Link: https://patch.msgid.link/20260611151736.255767-1-yashsuthar983@xxxxxxxxx
Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
Reported-by: syzbot+2dd9d02f60775ce5c1fb@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=2dd9d02f60775ce5c1fb
Signed-off-by: Yash Suthar <yashsuthar983@xxxxxxxxx>
[ Rebased to 7.2-rc2 ]
Signed-off-by: Steven Rostedt <rostedt@xxxxxxxxxxx>
---
 kernel/trace/ring_buffer.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index d9af2bbaf9c0..3ec173e22eeb 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7070,6 +7070,7 @@ int ring_buffer_read_page(struct trace_buffer *buffer,
 	struct ring_buffer_event *event;
 	struct buffer_data_page *dpage;
 	struct buffer_page *reader;
+	unsigned int subbuf_size;
 	long missed_events;
 	unsigned int commit;
 	unsigned int size;
@@ -7092,15 +7093,22 @@ int ring_buffer_read_page(struct trace_buffer *buffer,
 	if (!data_page || !data_page->data)
 		return -1;
 
-	if (data_page->order != buffer->subbuf_order)
-		return -1;
-
 	dpage = data_page->data;
 	if (!dpage)
 		return -1;
 
 	guard(raw_spinlock_irqsave)(&cpu_buffer->reader_lock);
 
+	/*
+	 * Check data_page order under lock to prevent a race with a
+	 * concurrent ring_buffer_subbuf_order_set() swap, which can
+	 * cause an outofbounds memset() if the subbuf_size changes.
+	 */
+	if (data_page->order != buffer->subbuf_order)
+		return -1;
+
+	subbuf_size = (PAGE_SIZE << data_page->order) - BUF_PAGE_HDR_SIZE;
+
 	reader = rb_get_reader_page(cpu_buffer);
 	if (!reader)
 		return -1;
@@ -7226,7 +7234,7 @@ int ring_buffer_read_page(struct trace_buffer *buffer,
 		 * missed events, then record it there.
 		 */
 		if (missed_events > 0 &&
-		    buffer->subbuf_size - size >= sizeof(missed_events)) {
+		    subbuf_size - size >= sizeof(missed_events)) {
 			memcpy(&dpage->data[size], &missed_events,
 			       sizeof(missed_events));
 			local_add(RB_MISSED_STORED, &dpage->commit);
@@ -7246,8 +7254,8 @@ int ring_buffer_read_page(struct trace_buffer *buffer,
 	/*
 	 * This page may be off to user land. Zero it out here.
 	 */
-	if (size < buffer->subbuf_size)
-		memset(&dpage->data[size], 0, buffer->subbuf_size - size);
+	if (size < subbuf_size)
+		memset(&dpage->data[size], 0, subbuf_size - size);
 
 	return read;
 }
-- 
2.53.0