Received-SPF: pass (google.com: domain of linux-kernel+bounces-150032-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: Siddh Raman Pant <siddh.raman.pant@oracle.com>
To: "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>
CC: "cve@kernel.org" <cve@kernel.org>,
        "linux-cve-announce@vger.kernel.org"
	<linux-cve-announce@vger.kernel.org>,
        "linux-kernel@vger.kernel.org"
	<linux-kernel@vger.kernel.org>
Subject: Re: CVE-2024-26920: tracing/trigger: Fix to return error if failed to
 alloc snapshot
Thread-Topic: CVE-2024-26920: tracing/trigger: Fix to return error if failed
 to alloc snapshot
Thread-Index: AQHakYflavlUUMfH9kOorpGL09z+TA==
Date: Thu, 18 Apr 2024 11:59:41 +0000
Message-ID: <6fa1eb4368cbaa2d0b243539f1d91692da95e117.camel@oracle.com>
In-Reply-To: <2024041738-CVE-2024-26920-a681@gregkh>
Accept-Language: en-US, en-IN
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 
 =?utf-8?B?bWdPL3RRWDN4dzM4Q0lmRlBlT251STJ4dWFNaVlBbnBRdE9TWkVEYjIxc3hh?=
 =?utf-8?B?dDVUd0VUcWwwM1lXb3B2UUNuSDVhK3pRY3owQm5wRXJJckZDVVFqVGZ4TUg1?=
 =?utf-8?B?alByN3BiR1NpQzhWaGZPOEFYMEJRRTJ5YVF0YlRTRXFUY1lzcVBoMkFLTU9N?=
 =?utf-8?B?VzF4ZDNhV21Pc0RJRzVmZUQyQm43VnRMc1cybjRKcThwTXo3L0kvZG83ZGZY?=
 =?utf-8?B?RlpSeStDbnFkWnlGY0o4SzFDSUhwTzY5RWd1U1VzR2w4Z3hLYWV1dStlcVdi?=
 =?utf-8?B?dVVGY0xSK0VmUHlIYVBVWWVUMzQ3TkxJcktaRytPVURXL0N1M1gxaXplUWcr?=
 =?utf-8?B?ZlFHRHh6UWNWMGIyRnFCWkJmMkRqVmlsN05aRW1sZHh5WldmdHE3dEYzQkNw?=
 =?utf-8?B?MlpJYnE1b2EvQ1hPWm5ZdWdoZ3YvWFJwZlowQ1BNSXU1RmxqSUJ1ZDcrZThX?=
 =?utf-8?B?ejZVQzlEQmUyeCtlRk5NZGgvMHpNQmdtZytOZVlRYnU0MVZrczBwMFdoUkVl?=
 =?utf-8?B?bGtTSnU2ZUFDNndvTmxYU2ZDNDU2T3BiZXorbjFSdksxWHdDQndONEFuUTEw?=
 =?utf-8?B?U1QzaGFNU2FEMnFaT2xkNnlsU1d1U2FNR1dOYnpHck9TclhmVk0vOWY2WExN?=
 =?utf-8?B?SVd0aDdBRUwrdkJZK2RsdkFFZncraEZWV0pRTWVDYjg5TkdaWVViSHJ6NGx4?=
 =?utf-8?B?TVR2Q1RmaEZqRko5empMQmhzMmZZUm0rWUZqLytxOVBOeVVSOWZpc29DTGYv?=
 =?utf-8?B?TWVwK3k3KzY1YVFhWkVTTmxONUJoQ1FOVTNMc1Erdjl1dkJkZjdkMTIySE9s?=
 =?utf-8?B?bzQ5OU53a2lXUmVnN05zd01pOWlyTVhPTUx4ZzJCZU5BbTBNNjNMTlo3Ly81?=
 =?utf-8?B?dGowbEJQVm1TZ3p0S0lxVU1zc1pWWi9DUHVqS1VWcjNleWw2Z2tHVWFiL1NG?=
 =?utf-8?B?Q29xSm5ackl5R0RRUW14U09jZUVzZS9EUzd0NW5tenlyVG5GTUlWeHR3QmVp?=
 =?utf-8?B?TzlXbm1DY0pDcytxZUdxMS92aFdrQm1QQzJwZS9iY2VCaVNZS1M3cjZwcXcy?=
 =?utf-8?B?RHpNd2pyY3JMZzVzVlg5ZHBGcWoweVV4UEMzMFh4S0NkTWwzenkvamxEdkhH?=
 =?utf-8?B?R3ZsZ0hzRUQybHBGWFV2ZnRQQ1FWeXEyRjNkcldmMHpIS1IvbE5OMS9KVXg4?=
 =?utf-8?B?VlFXVmg0bG5rVjZkR3dMZFBIazVXWXZGRmtyL29DMExPditaSWlMTE9wdUNh?=
 =?utf-8?B?ZS9pMUFnZitrdFU1UHNKcCtWTkZqWnpjSjR2Zzk3RVl5b3pRK0dRMGI4aTFu?=
 =?utf-8?B?K1UrZGljSnFxYkNBdVdGWE16Q2F3allxWkRBOTZPUWtFZzFZd3pCRkVjUjNE?=
 =?utf-8?B?ZWQ5Q3F0UFlwWUJ0bllEUk45WUI0a0FZREVodE95c00xdVliRzIwV2tlY2x4?=
 =?utf-8?B?ZTJsQkxFMmVROHJ3QUNiKzdybTNZVjNhTlc2UnhpOWdFYUM0ci9ld0o1RmdL?=
 =?utf-8?B?SG84R2hwakdId25QZG8yTkNUUFdOYUJldENIYng4L2M4L296dldJWXgvbFlF?=
 =?utf-8?B?UDFHM09rYmVqVTUzVHA0UFB3TmE1MDYyNDY5RGFaV0NyeDNnQWE0bmJHejNl?=
 =?utf-8?B?eTBRR3pQMjZKRkFsdHhMMDgwTzdxbTNMM3ZtNHA2V2VXN0g5RnBla2FlNzBP?=
 =?utf-8?B?WW1xNHJDdFlBM3VSNkFVVDdIYU5nZGcxQXBtZGU4bkpKRk9TdWMxRHV3WXFw?=
 =?utf-8?B?SXBQRnhWQUpubzNaV2tMM2k2czQ4VVVCVHNrR08yRFdHN1BIMjFML0xLTWZF?=
 =?utf-8?B?Z3ZmKzF6dTFUMTZJNUR1Qnk0VndCeFhGbDRlekczTjhuUnZ4bnJ2Z3VubDdk?=
 =?utf-8?B?Ri9VOWVuc3RkSGVkSENKMDlpZ2dNS1YrSXpERXdrSjh4d05wUVFpbjJrSURY?=
 =?utf-8?B?bksrR1FSQzY1Sk1lWU1mUXY1NTRTaUFEaFpGRFlVR1Z4R1FTcnVWQ3gyNm5z?=
 =?utf-8?B?NDBpSXBGVVZObE9vVEFaeFdNb3RZZjZsMktGMFgvdUlGT1VPcjd5dlp0Ni9W?=
 =?utf-8?B?UGhnRmFyQnBuZExQSHBzNFJtNTZlOWRrdmw4QXAwYzNrZWpBSzJPWUhQTld6?=
 =?utf-8?B?QlNQbWtkS1pSRVdGamdEWmN6ZGFBNlJhdUY0a3hiTjMxakZERWE5U09adEsx?=
 =?utf-8?Q?tKCFfikzwloL0I2Ggn4bv3ccmC9Miy1AJGDvCwUDi/Zm?=
Content-Type: multipart/signed; micalg="pgp-sha512";
	protocol="application/pgp-signature"; boundary="=-W9aZEBLwnMAziiiz42I7"
Precedence: bulk
X-Mailing-List: linux-kernel@vger.kernel.org
List-Id: <linux-kernel.vger.kernel.org>
List-Subscribe: <mailto:linux-kernel+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-kernel+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	uhOOBxvoNFVgBxiML9XcklypcVWJPS+Fi5N1Rb1wAnoTAv8BoxYOLb3XAZcjSR164GM1kYiyfQKuDeRF7OISOqCFJsJYPomLWdMTB4gyfrDCqg2DtjJOnrMNQxZhAQflT+O/jBLancnB9/e1kyuqOPOL1BrRsjGHVmZuuDlLL7n63s8c9TP+xfyto43AfvAx0bSRr9k0RMa5hOTTBgmLFnO03x+LvCLLB6D09JoPyvLUbiHqctbeNpXFcIzT35XdqmddtOIBM+N9WNlfyRAiXw01R8TsgmtD99/HcCAZ5HjBc7AQjvQOeBVXmGbcXp6EQVzoVC31E2b3VVftVvhPWG/mLuB/xpLxOei449XQCw51TKMct9RqVUkPKmTMmPJcdKuDdYocPrQxqzdvWxzAzZHWY4RUDZyr2lUcNxP1o7SzwZPy8Qb6X9qjEV0wSyxy41G/CdXHvLoSiqzdwaG8l0vc0lk+Lnnruk4WLVpvzKelPlifSDelhoHswaaqupEDp0Rw0wH79so1KM19MD0F//flvtCvN0WaNEqC2zxV8cGEE5jPTXvONMSKSIi1Xr5WlmcJzUfCk16+GtArK31oqnSm9cdc2uYLRx1cicl1Y5w=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DM6PR10MB2810.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 2974d143-5b83-4e18-d44a-08dc5f9f07ef
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Apr 2024 11:59:41.6874
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 80MoVsSDxbfoCJdq9Ft93xEpR8KPoGpBHzF7Lb1AXxUvugfnB9zu5o75u7u7RTsklkj2FLvnZMx1tXfy6MlnagyZ57jE0VJUWtbboUwoxp4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR10MB6637
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2024-04-18_10,2024-04-17_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 adultscore=0
 mlxlogscore=999 suspectscore=0 bulkscore=0 spamscore=0 mlxscore=0
 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2404010000 definitions=main-2404180085
X-Proofpoint-GUID: UerYFLX5mOT4vytleE4GhaoYPYejBxR4
X-Proofpoint-ORIG-GUID: UerYFLX5mOT4vytleE4GhaoYPYejBxR4

--=-W9aZEBLwnMAziiiz42I7
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Greg,

> In the Linux kernel, the following vulnerability has been resolved:
>=20
> tracing/trigger: Fix to return error if failed to alloc snapshot
>=20
> Fix register_snapshot_trigger() to return error code if it failed to
> allocate a snapshot instead of 0 (success). Unless that, it will register
> snapshot trigger without an error.

This commit is problematic on 4.19.y, 5.4.y, 5.10.y, and 5.15.y,
and should be reversed, and this CVE should be rejected for those
versions.

The return value should be 0 on failure, because in the functions
event_trigger_callback() and event_enable_trigger_func(), we have:

	ret =3D cmd_ops->reg(glob, trigger_ops, trigger_data, file);
	/*
	 * The above returns on success the # of functions enabled,
	 * but if it didn't find any functions it returns zero.
	 * Consider no functions a failure too.
	 */
	if (!ret) {
		ret =3D -ENOENT;

Thus, the commit breaks this assumption.

This commit needs b8cc44a4d3c1 ("tracing: Remove logic for registering
multiple event triggers at a time") as a prerequisite, as it removes
the above.

Thanks,
Siddh

--=-W9aZEBLwnMAziiiz42I7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEQ4+7hHLv3y1dvdaRBwq/MEwk8ioFAmYhCw0ACgkQBwq/MEwk
8ipm/Q/9Fw0bVZiofCcny1J5qEdsjy9m5J9Q+BW6GmFAV9Wam3m6HmASk9udrDWp
HY88I51/ds8KaoLUzMBtEU7liB/qvpO6POkzuX5DkqWSseN/4aU08uXvdw5HppwW
SQmgh7sKKzcm1xgjCJJc3zrZexL2I4JOBU0LBzlCQq7oatp9Se6G9Y1Mq2Ke3Nv/
hNyRweCSnunhZaAMWF2y2yncGPoarA8DXghK5FyxYS9rxpd/qXQ8fl84uzTZTfS3
5xdWOm2TZd9utGMIwmONyHZSVvZnUBytxB1f3oA11ZjfoGjCw0r8iimm1yn3japJ
FU+fZqictFl+5ChwNLr/+s2DkZx2dWCD0DYiFrP8U1cqkbKCQcimbAOUT2o1egVB
KESCDL75ljTQFICt+QiuFd3h/rMt1pKJRKLRQG7hmlYQhuW1600LP3ko8dLnjQ5i
5ReChVDawZl7+ir20Nqe20rErGgXSxVHYxrUiv2IFoA2v3ABI72wH/nUyB2lBtDv
gWr++k9/5XXNJ7+QVpIZMSi/S20w6xo7OufaJmfKOfdbrsH+Z4ZcIXUyjs0lqT0I
iIJtGWO57BxzgjITS6CGu/G85JdffHP89FbLI6E+PAJvH6XGyut3Fb1HTWJ0E/QX
GOdLaCYSn4VHaRmb1O9/VIdtsRkku0LBDX9eRn/qpSeGyRl7uL0=
=WAXp
-----END PGP SIGNATURE-----

--=-W9aZEBLwnMAziiiz42I7--