In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix race issue between cpu buffer write and swap
Warning happened in rbendcommit() at code: if (RBWARNON(cpubuffer, !localread(&cpu_buffer->committing)))
WARNING: CPU: 0 PID: 139 at kernel/trace/ringbuffer.c:3142 rbcommit+0x402/0x4a0 Call Trace: ringbufferunlockcommit+0x42/0x250 tracebufferunlockcommitregs+0x3b/0x250 traceeventbuffercommit+0xe5/0x440 traceeventbufferreserve+0x11c/0x150 traceeventraweventschedswitch+0x23c/0x2c0 _traceiterschedswitch+0x59/0x80 _schedule+0x72b/0x1580 schedule+0x92/0x120 worker_thread+0xa0/0x6f0
It is because the race between writing event into cpu buffer and swapping cpu buffer through file per_cpu/cpu0/snapshot:
Write on CPU 0 Swap buffer by percpu/cpu0/snapshot on CPU 1 -------- -------- tracingsnapshot_write() [...]
ringbufferlockreserve() cpubuffer = buffer->buffers[cpu]; // 1. Suppose find 'cpubuffera'; [...] rbreservenext_event() [...]
ring_buffer_swap_cpu()
if (local_read(&cpu_buffer_a->committing))
goto out_dec;
if (local_read(&cpu_buffer_b->committing))
goto out_dec;
buffer_a->buffers[cpu] = cpu_buffer_b;
buffer_b->buffers[cpu] = cpu_buffer_a;
// 2. cpu_buffer has swapped here.
rb_start_commit(cpu_buffer);
if (unlikely(READ_ONCE(cpu_buffer->buffer)
!= buffer)) { // 3. This check passed due to 'cpu_buffer->buffer'
[...] // has not changed here.
return NULL;
}
cpu_buffer_b->buffer = buffer_a;
cpu_buffer_a->buffer = buffer_b;
[...]
// 4. Reserve event from 'cpu_buffer_a'.
ringbufferunlockcommit() [...] cpubuffer = buffer->buffers[cpu]; // 5. Now find 'cpubufferb' !!! rbcommit(cpubuffer) rbendcommit() // 6. WARN for the wrong 'committing' state !!!
Based on above analysis, we can easily reproduce by following testcase:
#!/bin/bash
dmesg -n 7
sysctl -w kernel.panic_on_warn=1
TR=/sys/kernel/tracing
echo 7 > ${TR}/buffer_size_kb
echo "sched:sched_switch" > ${TR}/set_event
while [ true ]; do
echo 1 > ${TR}/per_cpu/cpu0/snapshot
done &
while [ true ]; do
echo 1 > ${TR}/per_cpu/cpu0/snapshot
done &
while [ true ]; do
echo 1 > ${TR}/per_cpu/cpu0/snapshot
done &
To fix it, IIUC, we can use smpcallfunction_single() to do the swap on the target cpu where the buffer is located, so that above race would be avoided.
{ "vanir_signatures": [ { "digest": { "length": 1568.0, "function_hash": "303678546161588536177966029780776816154" }, "target": { "function": "tracing_snapshot_write", "file": "kernel/trace/trace.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90e037cabc2c2dfc39b3dd9c5b22ea91f995539a", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-04a24181" }, { "digest": { "length": 1568.0, "function_hash": "206494460162087226934035112432069665733" }, "target": { "function": "tracing_snapshot_write", "file": "kernel/trace/trace.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37ca1b686078b00cc4ffa008e2190615f7709b5d", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-2006ff49" }, { "digest": { "line_hashes": [ "243004481916788987264034754307705467643", "223961531244371859944182427083087728100", "216132693899220238810820413740806098040", "142529740926259231435490174093006222314", "257211654933955963856844747406207846519", "330196377192871226104406344972067647217", "266383562070325755619556280692865336184", "17936981731491773589297511123617080033", "200842398354717357090081827636925631327", "59874187433864324203142059791697394349", "170453545937308753964277999142527624875", "273612629975737382405469342333245694454" ], "threshold": 0.9 }, "target": { "file": "kernel/trace/trace.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74c85396bd73eca80b96510b4edf93b9a3aff75f", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-229c6b3d" }, { "digest": { "line_hashes": [ "243004481916788987264034754307705467643", "223961531244371859944182427083087728100", "216132693899220238810820413740806098040", "142529740926259231435490174093006222314", "257211654933955963856844747406207846519", "330196377192871226104406344972067647217", "266383562070325755619556280692865336184", "17936981731491773589297511123617080033", "200842398354717357090081827636925631327", "59874187433864324203142059791697394349", "170453545937308753964277999142527624875", "273612629975737382405469342333245694454" ], "threshold": 0.9 }, "target": { "file": "kernel/trace/trace.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90e037cabc2c2dfc39b3dd9c5b22ea91f995539a", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-3d9bdbeb" }, { "digest": { "length": 1568.0, "function_hash": "206494460162087226934035112432069665733" }, "target": { "function": "tracing_snapshot_write", "file": "kernel/trace/trace.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6182318ac04648b46db9d441fd7d696337fcdd0b", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-4ac987d1" }, { "digest": { "length": 1568.0, "function_hash": "206494460162087226934035112432069665733" }, "target": { "function": "tracing_snapshot_write", "file": "kernel/trace/trace.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74c85396bd73eca80b96510b4edf93b9a3aff75f", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-4c8645b1" }, { "digest": { "length": 1568.0, "function_hash": "206494460162087226934035112432069665733" }, "target": { "function": "tracing_snapshot_write", "file": "kernel/trace/trace.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3163f635b20e9e1fb4659e74f47918c9dddfe64e", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-651feaf5" }, { "digest": { "line_hashes": [ "243004481916788987264034754307705467643", "223961531244371859944182427083087728100", "216132693899220238810820413740806098040", "142529740926259231435490174093006222314", "257211654933955963856844747406207846519", "330196377192871226104406344972067647217", "266383562070325755619556280692865336184", "17936981731491773589297511123617080033", "200842398354717357090081827636925631327", "59874187433864324203142059791697394349", "170453545937308753964277999142527624875", "273612629975737382405469342333245694454" ], "threshold": 0.9 }, "target": { "file": "kernel/trace/trace.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3163f635b20e9e1fb4659e74f47918c9dddfe64e", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-679b51d3" }, { "digest": { "line_hashes": [ "243004481916788987264034754307705467643", "223961531244371859944182427083087728100", "216132693899220238810820413740806098040", "142529740926259231435490174093006222314", "257211654933955963856844747406207846519", "330196377192871226104406344972067647217", "266383562070325755619556280692865336184", "17936981731491773589297511123617080033", "200842398354717357090081827636925631327", "59874187433864324203142059791697394349", "170453545937308753964277999142527624875", "273612629975737382405469342333245694454" ], "threshold": 0.9 }, "target": { "file": "kernel/trace/trace.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37ca1b686078b00cc4ffa008e2190615f7709b5d", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-87e028a4" }, { "digest": { "line_hashes": [ "243004481916788987264034754307705467643", "223961531244371859944182427083087728100", "216132693899220238810820413740806098040", "142529740926259231435490174093006222314", "257211654933955963856844747406207846519", "330196377192871226104406344972067647217", "266383562070325755619556280692865336184", "17936981731491773589297511123617080033", "200842398354717357090081827636925631327", "59874187433864324203142059791697394349", "170453545937308753964277999142527624875", "273612629975737382405469342333245694454" ], "threshold": 0.9 }, "target": { "file": "kernel/trace/trace.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5d30d6aa83d99fba8dfdd9cf6c4e4e7a63244db", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-92c4c8b3" }, { "digest": { "line_hashes": [ "243004481916788987264034754307705467643", "223961531244371859944182427083087728100", "216132693899220238810820413740806098040", "142529740926259231435490174093006222314", "257211654933955963856844747406207846519", "330196377192871226104406344972067647217", "266383562070325755619556280692865336184", "17936981731491773589297511123617080033", "200842398354717357090081827636925631327", "59874187433864324203142059791697394349", "170453545937308753964277999142527624875", "273612629975737382405469342333245694454" ], "threshold": 0.9 }, "target": { "file": "kernel/trace/trace.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6182318ac04648b46db9d441fd7d696337fcdd0b", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-b22b6e29" }, { "digest": { "length": 1568.0, "function_hash": "206494460162087226934035112432069665733" }, "target": { "function": "tracing_snapshot_write", "file": "kernel/trace/trace.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5d30d6aa83d99fba8dfdd9cf6c4e4e7a63244db", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-bab72d90" }, { "digest": { "line_hashes": [ "243004481916788987264034754307705467643", "223961531244371859944182427083087728100", "216132693899220238810820413740806098040", "142529740926259231435490174093006222314", "257211654933955963856844747406207846519", "330196377192871226104406344972067647217", "266383562070325755619556280692865336184", "17936981731491773589297511123617080033", "200842398354717357090081827636925631327", "59874187433864324203142059791697394349", "170453545937308753964277999142527624875", "273612629975737382405469342333245694454" ], "threshold": 0.9 }, "target": { "file": "kernel/trace/trace.c" }, "signature_type": "Line", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89c89da92a60028013f9539be0dcce7e44405a43", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-d37a3d9b" }, { "digest": { "length": 1568.0, "function_hash": "206494460162087226934035112432069665733" }, "target": { "function": "tracing_snapshot_write", "file": "kernel/trace/trace.c" }, "signature_type": "Function", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89c89da92a60028013f9539be0dcce7e44405a43", "deprecated": false, "signature_version": "v1", "id": "CVE-2023-53368-d5aa602f" } ] }