JIRA: https://issues.redhat.com/browse/RHEL-78701

Upstream Status: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

commit aef7ee7
Author: Fedor Pchelkin <[email protected]>
Date:   Wed Nov 27 21:59:26 2024 +0300

    dma-debug: fix physical address calculation for struct dma_debug_entry

    Offset into the page should also be considered while calculating a physical
    address for struct dma_debug_entry. page_to_phys() just shifts the value
    PAGE_SHIFT bits to the left so offset part is zero-filled.

    An example (wrong) debug assertion failure with CONFIG_DMA_API_DEBUG
    enabled which is observed during systemd boot process after recent
    dma-debug changes:

    DMA-API: e1000 0000:00:03.0: cacheline tracking EEXIST, overlapping mappings aren't supported
    WARNING: CPU: 4 PID: 941 at kernel/dma/debug.c:596 add_dma_entry
    CPU: 4 UID: 0 PID: 941 Comm: ip Not tainted 6.12.0+ #288
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
    RIP: 0010:add_dma_entry kernel/dma/debug.c:596
    Call Trace:
     <TASK>
    debug_dma_map_page kernel/dma/debug.c:1236
    dma_map_page_attrs kernel/dma/mapping.c:179
    e1000_alloc_rx_buffers drivers/net/ethernet/intel/e1000/e1000_main.c:4616
    ...

    Found by Linux Verification Center (linuxtesting.org).

    Fixes: 9d4f645 ("dma-debug: store a phys_addr_t in struct dma_debug_entry")
    Signed-off-by: Fedor Pchelkin <[email protected]>
    [hch: added a little helper to clean up the code]
    Signed-off-by: Christoph Hellwig <[email protected]>

Signed-off-by: Eder Zulian <[email protected]>

[ Upstream commit aef7ee7 ]

Offset into the page should also be considered while calculating a physical
address for struct dma_debug_entry. page_to_phys() just shifts the value
PAGE_SHIFT bits to the left so offset part is zero-filled.

An example (wrong) debug assertion failure with CONFIG_DMA_API_DEBUG
enabled which is observed during systemd boot process after recent
dma-debug changes:

DMA-API: e1000 0000:00:03.0: cacheline tracking EEXIST, overlapping mappings aren't supported
WARNING: CPU: 4 PID: 941 at kernel/dma/debug.c:596 add_dma_entry
CPU: 4 UID: 0 PID: 941 Comm: ip Not tainted 6.12.0+ #288
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:add_dma_entry kernel/dma/debug.c:596
Call Trace:
 <TASK>
debug_dma_map_page kernel/dma/debug.c:1236
dma_map_page_attrs kernel/dma/mapping.c:179
e1000_alloc_rx_buffers drivers/net/ethernet/intel/e1000/e1000_main.c:4616
...

Found by Linux Verification Center (linuxtesting.org).

Fixes: 9d4f645 ("dma-debug: store a phys_addr_t in struct dma_debug_entry")
Signed-off-by: Fedor Pchelkin <[email protected]>
[hch: added a little helper to clean up the code]
Signed-off-by: Christoph Hellwig <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>

When config osnoise cpus by write() syscall, the following KASAN splat may
be observed:

BUG: KASAN: slab-out-of-bounds in _parse_integer_limit+0x103/0x130
Read of size 1 at addr ffff88810121e3a1 by task test/447
CPU: 1 UID: 0 PID: 447 Comm: test Not tainted 6.17.0-rc6-dirty #288 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x55/0x70
 print_report+0xcb/0x610
 kasan_report+0xb8/0xf0
 _parse_integer_limit+0x103/0x130
 bitmap_parselist+0x16d/0x6f0
 osnoise_cpus_write+0x116/0x2d0
 vfs_write+0x21e/0xcc0
 ksys_write+0xee/0x1c0
 do_syscall_64+0xa8/0x2a0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

This issue can be reproduced by below code:

const char *cpulist = "1";
int fd=open("/sys/kernel/debug/tracing/osnoise/cpus", O_WRONLY);
write(fd, cpulist, strlen(cpulist));

Function bitmap_parselist() was called to parse cpulist, it require that
the parameter 'buf' must be terminated with a '\0' or '\n'. Fix this issue
by adding a '\0' to 'buf' in osnoise_cpus_write().

Cc: <[email protected]>
Cc: <[email protected]>
Cc: <[email protected]>
Link: https://lore.kernel.org/[email protected]
Fixes: 17f8910 ("tracing/osnoise: Allow arbitrarily long CPU string")
Signed-off-by: Wang Liang <[email protected]>
Signed-off-by: Steven Rostedt (Google) <[email protected]>