tracing: Fix buffer_ref pipe ops

This is preparation for fixing CVE-2019-11487.

3 files changed, 139 insertions, 0 deletions

diff --git a/debian/changelog b/debian/changelog
index 81db5364802a..34545147cf17 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1110,6 +1110,7 @@ linux (4.19.37-1) UNRELEASED; urgency=medium
     - aio: keep io_event in aio_kiocb
     - aio: store event at final iocb_put()
     - Fix aio_poll() races
+  * tracing: Fix buffer_ref pipe ops
 
   [ YunQiang Su ]
   * [mips*r6] Re-enable CONFIG_JUMP_LABEL, which has been fixed in upstream.
diff --git a/debian/patches/bugfix/all/tracing-fix-buffer_ref-pipe-ops.patch b/debian/patches/bugfix/all/tracing-fix-buffer_ref-pipe-ops.patch
new file mode 100644
index 000000000000..23f6bda0a90e
--- /dev/null
+++ b/debian/patches/bugfix/all/tracing-fix-buffer_ref-pipe-ops.patch
@@ -0,0 +1,137 @@
+From: Jann Horn <jannh@google.com>
+Date: Thu, 4 Apr 2019 23:59:25 +0200
+Subject: tracing: Fix buffer_ref pipe ops
+Origin: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit?id=cffeb9c84d20816a2173e3cfeca210c8bfa8e357
+
+commit b987222654f84f7b4ca95b3a55eca784cb30235b upstream.
+
+This fixes multiple issues in buffer_pipe_buf_ops:
+
+ - The ->steal() handler must not return zero unless the pipe buffer has
+   the only reference to the page. But generic_pipe_buf_steal() assumes
+   that every reference to the pipe is tracked by the page's refcount,
+   which isn't true for these buffers - buffer_pipe_buf_get(), which
+   duplicates a buffer, doesn't touch the page's refcount.
+   Fix it by using generic_pipe_buf_nosteal(), which refuses every
+   attempted theft. It should be easy to actually support ->steal, but the
+   only current users of pipe_buf_steal() are the virtio console and FUSE,
+   and they also only use it as an optimization. So it's probably not worth
+   the effort.
+ - The ->get() and ->release() handlers can be invoked concurrently on pipe
+   buffers backed by the same struct buffer_ref. Make them safe against
+   concurrency by using refcount_t.
+ - The pointers stored in ->private were only zeroed out when the last
+   reference to the buffer_ref was dropped. As far as I know, this
+   shouldn't be necessary anyway, but if we do it, let's always do it.
+
+Link: http://lkml.kernel.org/r/20190404215925.253531-1-jannh@google.com
+
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: stable@vger.kernel.org
+Fixes: 73a757e63114d ("ring-buffer: Return reader page back into existing ring buffer")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/splice.c               |  4 ++--
+ include/linux/pipe_fs_i.h |  1 +
+ kernel/trace/trace.c      | 28 ++++++++++++++--------------
+ 3 files changed, 17 insertions(+), 16 deletions(-)
+
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -333,8 +333,8 @@ const struct pipe_buf_operations default
+ 	.get = generic_pipe_buf_get,
+ };
+ 
+-static int generic_pipe_buf_nosteal(struct pipe_inode_info *pipe,
+-				    struct pipe_buffer *buf)
++int generic_pipe_buf_nosteal(struct pipe_inode_info *pipe,
++			     struct pipe_buffer *buf)
+ {
+ 	return 1;
+ }
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -181,6 +181,7 @@ void free_pipe_info(struct pipe_inode_in
+ void generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *);
++int generic_pipe_buf_nosteal(struct pipe_inode_info *, struct pipe_buffer *);
+ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
+ void pipe_buf_mark_unmergeable(struct pipe_buffer *buf);
+ 
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -6800,19 +6800,23 @@ struct buffer_ref {
+ 	struct ring_buffer	*buffer;
+ 	void			*page;
+ 	int			cpu;
+-	int			ref;
++	refcount_t		refcount;
+ };
+ 
++static void buffer_ref_release(struct buffer_ref *ref)
++{
++	if (!refcount_dec_and_test(&ref->refcount))
++		return;
++	ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page);
++	kfree(ref);
++}
++
+ static void buffer_pipe_buf_release(struct pipe_inode_info *pipe,
+ 				    struct pipe_buffer *buf)
+ {
+ 	struct buffer_ref *ref = (struct buffer_ref *)buf->private;
+ 
+-	if (--ref->ref)
+-		return;
+-
+-	ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page);
+-	kfree(ref);
++	buffer_ref_release(ref);
+ 	buf->private = 0;
+ }
+ 
+@@ -6821,7 +6825,7 @@ static void buffer_pipe_buf_get(struct p
+ {
+ 	struct buffer_ref *ref = (struct buffer_ref *)buf->private;
+ 
+-	ref->ref++;
++	refcount_inc(&ref->refcount);
+ }
+ 
+ /* Pipe buffer operations for a buffer. */
+@@ -6829,7 +6833,7 @@ static const struct pipe_buf_operations
+ 	.can_merge		= 0,
+ 	.confirm		= generic_pipe_buf_confirm,
+ 	.release		= buffer_pipe_buf_release,
+-	.steal			= generic_pipe_buf_steal,
++	.steal			= generic_pipe_buf_nosteal,
+ 	.get			= buffer_pipe_buf_get,
+ };
+ 
+@@ -6842,11 +6846,7 @@ static void buffer_spd_release(struct sp
+ 	struct buffer_ref *ref =
+ 		(struct buffer_ref *)spd->partial[i].private;
+ 
+-	if (--ref->ref)
+-		return;
+-
+-	ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page);
+-	kfree(ref);
++	buffer_ref_release(ref);
+ 	spd->partial[i].private = 0;
+ }
+ 
+@@ -6901,7 +6901,7 @@ tracing_buffers_splice_read(struct file
+ 			break;
+ 		}
+ 
+-		ref->ref = 1;
++		refcount_set(&ref->refcount, 1);
+ 		ref->buffer = iter->trace_buffer->buffer;
+ 		ref->page = ring_buffer_alloc_read_page(ref->buffer, iter->cpu_file);
+ 		if (IS_ERR(ref->page)) {
diff --git a/debian/patches/series b/debian/patches/series
index ce60e4117723..bc43f3c267cb 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -176,6 +176,7 @@ bugfix/all/0011-aio-fold-lookup_kiocb-into-its-sole-caller.patch
 bugfix/all/0012-aio-keep-io_event-in-aio_kiocb.patch
 bugfix/all/0013-aio-store-event-at-final-iocb_put.patch
 bugfix/all/0014-Fix-aio_poll-races.patch
+bugfix/all/tracing-fix-buffer_ref-pipe-ops.patch
 
 # Fix exported symbol versions
 bugfix/all/module-disable-matching-missing-version-crc.patch