CVE-2023-53668

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix deadloop issue on reading trace_pipe

Soft lockup occurs when reading file 'trace_pipe':

watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488] [...] RIP: 0010:ringbufferempty_cpu+0xed/0x170 RSP: 0018:ffff88810dd6fc48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff93d1aaeb RDX: ffff88810a280040 RSI: 0000000000000008 RDI: ffff88811164b218 RBP: ffff88811164b218 R08: 0000000000000000 R09: ffff88815156600f R10: ffffed102a2acc01 R11: 0000000000000001 R12: 0000000051651901 R13: 0000000000000000 R14: ffff888115e49500 R15: 0000000000000000 [...] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8d853c2000 CR3: 000000010dcd8000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __findnextentry+0x1a8/0x4b0 ? peeknextentry+0x250/0x250 ? downwrite+0xa5/0x120 ? downwritekillable+0x130/0x130 tracefindnextentryinc+0x3b/0x1d0 tracingreadpipe+0x423/0xae0 ? tracingsplicereadpipe+0xcb0/0xcb0 vfsread+0x16b/0x490 ksysread+0x105/0x210 ? __ia32syspwrite64+0x200/0x200 ? switchfpureturn+0x108/0x220 dosyscall64+0x33/0x40 entrySYSCALL64afterhwframe+0x61/0xc6

Through the vmcore, I found it's because in tracingreadpipe(), ringbufferemptycpu() found some buffer is not empty but then it cannot read anything due to "rbnumofentries() == 0" always true, Then it infinitely loop the procedure due to user buffer not been filled, see following code path:

tracingreadpipe() { ... ... waitagain: tracingwaitpipe() // 1. find non-empty buffer here tracefindnextentryinc() // 2. loop here try to find an entry _findnextentry() ringbufferemptycpu(); // 3. find non-empty buffer peeknextentry() // 4. but peek always return NULL ringbufferpeek() rbbufferpeek() rbgetreaderpage() // 5. because rbnumofentries() == 0 always true here // then return NULL // 6. user buffer not been filled so goto 'waitgain' // and eventually leads to an deadloop in kernel!!! }

By some analyzing, I found that when resetting ringbuffer, the 'entries' of its pages are not all cleared (see rbresetcpu()). Then when reducing the ringbuffer, and if some reduced pages exist dirty 'entries' data, they will be added into 'cpubuffer->overrun' (see rbremove_pages()), which cause wrong 'overrun' count and eventually cause the deadloop issue.

To fix it, we need to clear every pages in rbresetcpu().