diff options
| author | Ankit Khushwaha <ankitkhushwaha.linux@gmail.com> | 2025-10-08 22:55:16 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-12 13:01:04 +0200 |
| commit | f125c1cfa11a92209b84bfde9a405a31c9f76195 (patch) | |
| tree | 0e171052d0d61ff637a8efb47af3b48c00ef905b | |
| parent | 3a062a5c55adc5507600b9ae6d911e247e2f1d6e (diff) | |
| download | linux-f125c1cfa11a92209b84bfde9a405a31c9f76195.tar.gz linux-f125c1cfa11a92209b84bfde9a405a31c9f76195.tar.bz2 linux-f125c1cfa11a92209b84bfde9a405a31c9f76195.zip | |
ring buffer: Propagate __rb_map_vma return value to caller
commit de4cbd704731778a2dc833ce5a24b38e5d672c05 upstream.
The return value from `__rb_map_vma()`, which rejects writable or
executable mappings (VM_WRITE, VM_EXEC, or !VM_MAYSHARE), was being
ignored. As a result the caller of `__rb_map_vma` always returned 0
even when the mapping had actually failed, allowing it to proceed
with an invalid VMA.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20251008172516.20697-1-ankitkhushwaha.linux@gmail.com
Fixes: 117c39200d9d7 ("ring-buffer: Introducing ring-buffer mapping functions")
Reported-by: syzbot+ddc001b92c083dbf2b97@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=194151be8eaebd826005329b2e123aecae714bdb
Signed-off-by: Ankit Khushwaha <ankitkhushwaha.linux@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | kernel/trace/ring_buffer.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 24bb5287c415..2bb311d99c10 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -7180,7 +7180,7 @@ int ring_buffer_map(struct trace_buffer *buffer, int cpu, atomic_dec(&cpu_buffer->resize_disabled); } - return 0; + return err; } int ring_buffer_unmap(struct trace_buffer *buffer, int cpu) |