Received-SPF: pass (google.com: domain of linux-kernel+bounces-150068-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Date: Thu, 18 Apr 2024 14:34:57 +0200
From: "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>
To: Siddh Raman Pant <siddh.raman.pant@oracle.com>
Cc: "cve@kernel.org" <cve@kernel.org>,
	"linux-cve-announce@vger.kernel.org" <linux-cve-announce@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: CVE-2024-26920: tracing/trigger: Fix to return error if failed
 to alloc snapshot
Message-ID: <2024041805-rippling-entourage-1a72@gregkh>
References: <2024041738-CVE-2024-26920-a681@gregkh>
 <6fa1eb4368cbaa2d0b243539f1d91692da95e117.camel@oracle.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <6fa1eb4368cbaa2d0b243539f1d91692da95e117.camel@oracle.com>

On Thu, Apr 18, 2024 at 11:59:41AM +0000, Siddh Raman Pant wrote:
> Hi Greg,
> 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > tracing/trigger: Fix to return error if failed to alloc snapshot
> > 
> > Fix register_snapshot_trigger() to return error code if it failed to
> > allocate a snapshot instead of 0 (success). Unless that, it will register
> > snapshot trigger without an error.
> 
> This commit is problematic on 4.19.y, 5.4.y, 5.10.y, and 5.15.y,
> and should be reversed, and this CVE should be rejected for those
> versions.

Then please submit a patch for this.

But note, CVEs are not for specific versions, sorry.  We give a hint as
to what kernel versions might be affected, but we don not assign CVE to
versions.


> 
> The return value should be 0 on failure, because in the functions
> event_trigger_callback() and event_enable_trigger_func(), we have:
> 
> 	ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file);
> 	/*
> 	 * The above returns on success the # of functions enabled,
> 	 * but if it didn't find any functions it returns zero.
> 	 * Consider no functions a failure too.
> 	 */
> 	if (!ret) {
> 		ret = -ENOENT;
> 
> Thus, the commit breaks this assumption.
> 
> This commit needs b8cc44a4d3c1 ("tracing: Remove logic for registering
> multiple event triggers at a time") as a prerequisite, as it removes
> the above.

Should we just take that patch instead?

thanks,

greg k-h