Traceprobe calculates dynamic string sizes before storing the values. A
probed pointer can change between those passes, so fetch_store_symstrlen()
can reserve space for a short symbol while fetch_store_symstring() observes
a longer one. The store path reads the reserved length but ignores it and
uses sprint_symbol(), allowing the second symbol to overwrite the trace
record.
KASAN reports:
BUG: KASAN: slab-out-of-bounds in sized_strscpy
Write of size 8
sized_strscpy
module_address_lookup
__sprint_symbol
process_fetch_insn
Format the symbol using the reserved length as the destination bound.
The patched kernel completes the same pointer-switching workload without a
KASAN report.
Fixes: b26a124cbfa8 ("tracing/probes: Add symstr type for dynamic events")
Signed-off-by: Yifan Zhang <[email protected]>
---
kernel/trace/trace_probe_tmpl.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/trace_probe_tmpl.h b/kernel/trace/trace_probe_tmpl.h
index 8db12f758fdae..cc317cb444e43 100644
--- a/kernel/trace/trace_probe_tmpl.h
+++ b/kernel/trace/trace_probe_tmpl.h
@@ -95,7 +95,7 @@ fetch_store_symstring(unsigned long addr, void *dest, void
*base)
__dest = get_loc_data(dest, base);
- return sprint_symbol(__dest, addr);
+ return scnprintf(__dest, maxlen, "%pS", (void *)addr) + 1;
}
/* common part of process_fetch_insn*/
--
2.39.5 (Apple Git-154)
