In the Linux kernel, the following vulnerability has been resolved:
ftrace: Fix potential warning in traceprintkseq during ftrace_dump
When calling ftracedumpone() concurrently with reading tracepipe, a WARNONONCE() in traceprintk_seq() can be triggered due to a race condition.
The issue occurs because:
CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger
!traceempty(&iter) traceiteratorreset(&iter) <- len = size = 0 cat /sys/kernel/tracing/tracepipe tracefindnextentryinc(&iter) _findnextentry ringbufferemptycpu <- all empty return NULL
traceprintkseq(&iter.seq) WARNONONCE(s->seq.len >= s->seq.size)
In the context between traceempty() and tracefindnextentryinc()
during ftracedump, the ring buffer data was consumed by other readers.
This caused tracefindnextentryinc to return NULL, failing to populate
iter.seq
. At this point, due to the prior traceiteratorreset, both
iter.seq.len
and iter.seq.size
were set to 0. Since they are equal,
the WARNONONCE condition is triggered.
Move the traceprintkseq() into the if block that checks to make sure the return value of tracefindnextentryinc() is non-NULL in ftracedumpone(), ensuring the 'iter.seq' is properly populated before subsequent operations.