Re: [PATCH v3] blktrace: fix the field offsets of the synthesized v1 record
From: sashiko-bot@kernel.org
Date: 2026-09-13 09:13:22
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] blk_trace_synthesize_old_trace unconditionally parses ring buffer entries as 64-byte blk_io_trace2 structures, resulting in an out-of-bounds read and info leak when processing 48-byte v1 entries because the required dependency patch is missing. -- commit d247914d4d21399a0ee1cb2876aa1eda1b802a86 Author: Donggeun Yoo [off-list ref] blktrace: fix the field offsets of the synthesized v1 record This commit fixes the field offsets of the synthesized v1 record in blk_trace_synthesize_old_trace(). It assigns each v1 field from its v2 counterpart and appends the pdu from the end of the v2 record to prevent reading garbage data. Link: https://lore.kernel.org/all/20260903202932.156278-1-adrianox@gmail.com/ (local)
quoted hunk ↗ jump to hunk
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c index 8cd2520b4c99e..99c00cdae42b4 100644 --- a/kernel/trace/blktrace.c +++ b/kernel/trace/blktrace.c@@ -1768,17 +1768,23 @@ static enum print_line_t blk_trace_event_print(struct trace_iterator *iter, static void blk_trace_synthesize_old_trace(struct trace_iterator *iter) { + const struct blk_io_trace2 *t = te_blk_io_trace(iter->ent); struct trace_seq *s = &iter->seq;
[ ... ]
+ .pdu_len = t->pdu_len, }; - trace_seq_putmem(s, &old, offset); - trace_seq_putmem(s, &t->sector, - sizeof(old) - offset + t->pdu_len); + trace_seq_putmem(s, &old, sizeof(old)); + trace_seq_putmem(s, t + 1, old.pdu_len);
[Severity: High]
Does unconditionally parsing ring buffer entries as 64-byte blk_io_trace2
structures result in an out-of-bounds read and info leak?
If a user configures blktrace via the setup ioctl (which sets
bt->version = 1) enabling the block ftrace plugin, __blk_add_trace()
still allocates and writes 48-byte struct blk_io_trace events because
the required dependency patch is missing:
kernel/trace/blktrace.c:__blk_add_trace() {
...
case 1:
trace_len = sizeof(struct blk_io_trace);
break;
...
}
When blk_trace_synthesize_old_trace() casts a 48-byte entry to a 64-byte
struct blk_io_trace2, reading t->pdu_len accesses offset 50 (which is out
of bounds and retrieves garbage). Then calling trace_seq_putmem()
starting at t + 1 reads from offset 64 (16 bytes out of bounds) for
old.pdu_len bytes.
If the random length pdu_len read from the out-of-bounds offset is large,
it copies up to 64KB of adjacent kernel memory from the ring buffer to
userspace, and crosses page boundaries which can trigger a kernel panic if
kasan is enabled.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260913090232.715798-1-donggeunyoo.kernel@gmail.com?part=1