[PATCH v3] blktrace: fix the field offsets of the synthesized v1 record

[PATCH v3] blktrace: fix the field offsets of the synthesized v1 record

[Donggeun Yoo]

blk_trace_synthesize_old_trace() emits a classic blk_io_trace for the
binary trace_pipe output by copying 32 bytes from the ring buffer
entry's sector onward into a struct blk_io_trace. The entry is a
blk_io_trace2, and the two layouts diverge after bytes: v2 has a 32-bit
pid at 28 and a 64-bit action at 32, where v1 has a 32-bit action at 28
and pid at 32. Every field from action on lands one slot off, so a
consumer reads the pid as the action, the device as the cpu, and the cpu
as error and pdu_len.

The PDU comes from the wrong offset as well. The copy ends at v2 offset
48 + pdu_len while the PDU starts at 64, so for any event carrying one
-- BLK_TA_REMAP, SPLIT, UNPLUG_*, DRV_DATA, BLK_TN_MESSAGE -- the bytes
appended are the error, pdu_len and pad trailer rather than the PDU.

Assign each v1 field from its v2 counterpart and append the PDU from the
end of the v2 record.

This applies on top of Adriano Cordova's "blktrace: always record ftrace
events as blk_io_trace2", <20260903202932.156278-1-adrianox@gmail.com>,
and needs it. Without that patch __blk_add_trace() still reserves a
48-byte v1 entry when the trace was set up by BLKTRACESETUP, and nothing
in the entry says which layout it has: magic and sequence are the ftrace
trace_entry header and neither writer fills them, and the two sizes
overlap, because a v1 record carrying a 16-byte BLK_TA_REMAP PDU is also
64 bytes. Removing the short entry is what makes reading the v2 layout
unconditionally correct.

Fixes: 4d8bc7bd4f73 ("blktrace: move ftrace blk_io_tracer to blk_io_trace2")
Link: https://lore.kernel.org/all/20260903202932.156278-1-adrianox@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Assisted-by: Claude:claude-fable-5
---
Note: this applies on top of Adriano Cordova's "blktrace: always record
ftrace events as blk_io_trace2" and is not correct without it -- please
apply it after his.

  https://lore.kernel.org/all/20260903202932.156278-1-adrianox@gmail.com/

v3:
 - Drop the min_t() bound on pdu_len. Both TRACE_BLK producers reserve
   sizeof(struct blk_io_trace2) + pdu_len + cgid_len, so the entry is
   always at least sizeof(*t) + t->pdu_len and the bound never clamps.
   sashiko-bot read it as an integer underflow,
   <20260913064414.01DF31F00893@smtp.kernel.org>; that needs an entry
   smaller than 64 bytes, which the patch above removes.
v2:
 - Drop the iter->ent_size test v1 used to tell a v1 entry from a v2 one.
   It cannot: a 48-byte v1 record carrying a 16-byte BLK_TA_REMAP PDU is
   also 64 bytes. Caught by sashiko-bot,
   <20260913031030.E85191F000FF@smtp.kernel.org>.
 - Drop the syzbot Reported-by/Closes. That report is the unbounded copy
   on a 48-byte entry, which the patch above closes, not this one.
v2: https://lore.kernel.org/all/20260913063155.708520-1-donggeunyoo.kernel@gmail.com/
v1: https://lore.kernel.org/all/20260913025827.457116-1-donggeunyoo.kernel@gmail.com/

QEMU x86_64, origin/master 2f0c1cf72f46 plus the patch above, one config
and one initramfs across all arms. BLKTRACESETUP on a partitioned virtio
disk, blk tracer with options/bin, and a partition read for a
BLK_TA_REMAP with a 16-byte PDU. Decoded at v1 offsets:

  patched     action 0x0811000f, pid 0x75, device 0x0fe00010, pdu_len 16,
              PDU device_from 0x0fe00011 device_to 0x0fe00010
              sector_from 0, next record on the boundary. Byte-identical
              between v2 and v3, stable over four boots.
  unpatched   the same fields, correct, then extra bytes appended: that
              length is read at v2 offset 50, which on a v1 entry is
              inside the PDU, so it is garbage. 8 bytes in one boot; the
              first record in the stream varies between boots, so the
              overrun is not a fixed size.

Not exercised: the syzbot splat. iter->ent points into a ring buffer
sub-buffer page, so KASAN sees an over-read only when it crosses the page
end; 120 rounds over varying buffer sizes did not land it.
 kernel/trace/blktrace.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index ae010969c144..89d7b707daff 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -1728,17 +1728,23 @@ static enum print_line_t blk_trace_event_print(struct trace_iterator *iter,
 
 static void blk_trace_synthesize_old_trace(struct trace_iterator *iter)
 {
+	const struct blk_io_trace2 *t = te_blk_io_trace(iter->ent);
 	struct trace_seq *s = &iter->seq;
-	struct blk_io_trace2 *t = (struct blk_io_trace2 *)iter->ent;
-	const int offset = offsetof(struct blk_io_trace2, sector);
 	struct blk_io_trace old = {
 		.magic	  = BLK_IO_TRACE_MAGIC | BLK_IO_TRACE_VERSION,
 		.time     = iter->ts,
+		.sector   = t->sector,
+		.bytes    = t->bytes,
+		.action   = lower_32_bits(t->action),
+		.pid      = t->pid,
+		.device   = t->device,
+		.cpu      = t->cpu,
+		.error    = t->error,
+		.pdu_len  = t->pdu_len,
 	};
 
-	trace_seq_putmem(s, &old, offset);
-	trace_seq_putmem(s, &t->sector,
-			 sizeof(old) - offset + t->pdu_len);
+	trace_seq_putmem(s, &old, sizeof(old));
+	trace_seq_putmem(s, t + 1, old.pdu_len);
 }
 
 static enum print_line_t
-- 
2.53.0

Re: [PATCH v3] blktrace: fix the field offsets of the synthesized v1 record

[Donggeun Yoo]

On Sun, 13 Sep 2026 09:13:21 +0000, sashiko-bot@kernel.org wrote:
> - [High] blk_trace_synthesize_old_trace unconditionally parses ring buffer
> entries as 64-byte blk_io_trace2 structures, resulting in an out-of-bounds
> read and info leak when processing 48-byte v1 entries because the required
> dependency patch is missing.

Correct, and as the patch says, Adriano Cordova's patch has to be applied
first.

The read side cannot know the layout: magic and sequence are the ftrace
trace_entry header and neither writer fills them, and the sizes overlap,
since a 48-byte v1 record carrying a 16-byte BLK_TA_REMAP PDU is also 64.
His patch fixes it on the write side, by not recording a v1 entry at all.
With that applied this patch is correct -- measured on a BLKTRACESETUP
trace with the blk tracer, reading a partition for that remap.