In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting namedtriggers list The following commands causes a crash: ~# cd /sys/kernel/tracing/events/rcu/rcucallback ~# echo 'hist:name=bad:keys=commonpid:onmax(bogus).save(commonpid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=commonpid' > trigger Because the following occurs: eventtriggerwrite() { triggerprocessregex() { eventhisttriggerparse() { data = eventtriggeralloc(..); eventtriggerregister(.., data) { cmdops->reg(.., data, ..) [histregistertrigger()] { data->ops->init() [eventhisttriggerinit()] { savenamedtrigger(name, data) { listadd(&data->namedlist, &namedtriggers); } } } } ret = createactions(); (return -EINVAL) if (ret) goto outunreg; [..] ret = histtriggerenable(data, ...) { listaddtailrcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] outunreg: eventhistunregister(.., data) { cmdops->unreg(.., data, ..) [histunregistertrigger()] { listforeachentry(iter, &file->triggers, list) { if (!histtriggermatch(data, iter, nameddata, false)) <- never matches continue; [..] test = iter; } if (test && test->ops->free) <<<-- test is NULL test->ops->free(test) [eventhisttriggerfree()] { [..] if (data->name) delnamedtrigger(data) { listdel(&data->namedlist); <<<<-- NEVER gets removed! } } } } [..] kfree(data); <<<-- frees item but it is still on list The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash. Move the code around such that if eventtriggerregister() succeeds, the next thing called is histtriggerenable() which adds it to the list. A bunch of actions is called if getnamedtriggerdata() returns false. But that doesn't need to be called after eventtriggerregister(), so it can be moved up, allowing eventtriggerregister() to be called just before histtriggerenable() keeping them together and allowing the file->triggers to be properly populated.
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-azure-6.11-cloud-tools-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-azure-6.11-headers-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-azure-6.11-tools-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-cloud-tools-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-headers-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-azure-dbgsym" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-extra-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-iwlwifi-6.11.0-1015-azure" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-tools-6.11.0-1015-azure" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-gcp-6.11-headers-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-gcp-6.11-lib-rust-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-gcp-6.11-tools-6.11.0-1015" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-headers-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-headers-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-64k-dbgsym" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1015-gcp-dbgsym" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-extra-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-modules-extra-6.11.0-1015-gcp-64k" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-tools-6.11.0-1015-gcp" }, { "binary_version": "6.11.0-1015.15~24.04.1", "binary_name": "linux-tools-6.11.0-1015-gcp-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-buildinfo-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-buildinfo-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-cloud-tools-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-headers-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-headers-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-cloud-tools-6.11.0-26" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-headers-6.11.0-26" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-lib-rust-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-hwe-6.11-tools-6.11.0-26" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-6.11.0-26-generic-dbgsym" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic-64k-dbgsym" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-26-generic-dbgsym" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-6.11.0-26-generic-64k" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-extra-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-ipu6-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-ipu7-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-iwlwifi-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-usbio-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-modules-vision-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-tools-6.11.0-26-generic" }, { "binary_version": "6.11.0-26.26~24.04.1", "binary_name": "linux-tools-6.11.0-26-generic-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-buildinfo-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-cloud-tools-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-headers-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-headers-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-64k-dbgsym" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-image-unsigned-6.11.0-1014-lowlatency-dbgsym" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-cloud-tools-6.11.0-1014" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-headers-6.11.0-1014" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-lib-rust-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-lowlatency-hwe-6.11-tools-6.11.0-1014" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-modules-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-modules-6.11.0-1014-lowlatency-64k" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-modules-iwlwifi-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-tools-6.11.0-1014-lowlatency" }, { "binary_version": "6.11.0-1014.15~24.04.1", "binary_name": "linux-tools-6.11.0-1014-lowlatency-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.11.0-1022.22", "binary_name": "linux-buildinfo-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-headers-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-image-unsigned-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-image-unsigned-6.11.0-1022-oem-dbgsym" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-ipu6-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-ipu7-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-iwlwifi-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-usbio-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-modules-vision-6.11.0-1022-oem" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-oem-6.11-headers-6.11.0-1022" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-oem-6.11-tools-6.11.0-1022" }, { "binary_version": "6.11.0-1022.22", "binary_name": "linux-tools-6.11.0-1022-oem" } ] }