Re: [PATCH v3] blktrace: fix the field offsets of the synthesized v1 record

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] blk_trace_synthesize_old_trace unconditionally parses ring buffer entries as 64-byte blk_io_trace2 structures, resulting in an out-of-bounds read and info leak when processing 48-byte v1 entries because the required dependency patch is missing.
--

commit d247914d4d21399a0ee1cb2876aa1eda1b802a86
Author: Donggeun Yoo <donggeunyoo.kernel@gmail.com>

blktrace: fix the field offsets of the synthesized v1 record

This commit fixes the field offsets of the synthesized v1 record in
blk_trace_synthesize_old_trace(). It assigns each v1 field from its v2
counterpart and appends the pdu from the end of the v2 record to prevent
reading garbage data.

Link: https://lore.kernel.org/all/20260903202932.156278-1-adrianox@gmail.com/

> diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
> index 8cd2520b4c99e..99c00cdae42b4 100644
> --- a/kernel/trace/blktrace.c
> +++ b/kernel/trace/blktrace.c
> @@ -1768,17 +1768,23 @@ static enum print_line_t blk_trace_event_print(struct trace_iterator *iter,
>  
>  static void blk_trace_synthesize_old_trace(struct trace_iterator *iter)
>  {
> +	const struct blk_io_trace2 *t = te_blk_io_trace(iter->ent);
>  	struct trace_seq *s = &iter->seq;

[ ... ]

> +		.pdu_len  = t->pdu_len,
>  	};
>  
> -	trace_seq_putmem(s, &old, offset);
> -	trace_seq_putmem(s, &t->sector,
> -			 sizeof(old) - offset + t->pdu_len);
> +	trace_seq_putmem(s, &old, sizeof(old));
> +	trace_seq_putmem(s, t + 1, old.pdu_len);

[Severity: High]
Does unconditionally parsing ring buffer entries as 64-byte blk_io_trace2
structures result in an out-of-bounds read and info leak?

If a user configures blktrace via the setup ioctl (which sets
bt->version = 1) enabling the block ftrace plugin, __blk_add_trace()
still allocates and writes 48-byte struct blk_io_trace events because
the required dependency patch is missing:

kernel/trace/blktrace.c:__blk_add_trace() {
    ...
    case 1:
        trace_len = sizeof(struct blk_io_trace);
        break;
    ...
}

When blk_trace_synthesize_old_trace() casts a 48-byte entry to a 64-byte
struct blk_io_trace2, reading t->pdu_len accesses offset 50 (which is out
of bounds and retrieves garbage). Then calling trace_seq_putmem()
starting at t + 1 reads from offset 64 (16 bytes out of bounds) for
old.pdu_len bytes.

If the random length pdu_len read from the out-of-bounds offset is large,
it copies up to 64KB of adjacent kernel memory from the ring buffer to
userspace, and crosses page boundaries which can trigger a kernel panic if
kasan is enabled.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913090232.715798-1-donggeunyoo.kernel@gmail.com?part=1