tracing: Fix oob write in trace_seq_to_buffer()

JIRA: https://issues.redhat.com/browse/RHEL-115358

CVE: CVE-2025-37923

commit f5178c4
Author: Jeongjun Park <aha310510@gmail.com>
Date:   Tue Apr 22 20:30:25 2025 +0900

    tracing: Fix oob write in trace_seq_to_buffer()

    syzbot reported this bug:
    ==================================================================
    BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]
    BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822
    Write of size 4507 at addr ffff888032b6b000 by task syz.2.320/7260

    CPU: 1 UID: 0 PID: 7260 Comm: syz.2.320 Not tainted 6.15.0-rc1-syzkaller-00301-g3bde70a2c827 #0 PREEMPT(full)
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:94 [inline]
     dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
     print_address_description mm/kasan/report.c:408 [inline]
     print_report+0xc3/0x670 mm/kasan/report.c:521
     kasan_report+0xe0/0x110 mm/kasan/report.c:634
     check_region_inline mm/kasan/generic.c:183 [inline]
     kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
     __asan_memcpy+0x3c/0x60 mm/kasan/shadow.c:106
     trace_seq_to_buffer kernel/trace/trace.c:1830 [inline]
     tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822
     ....
    ==================================================================

    It has been reported that trace_seq_to_buffer() tries to copy more data
    than PAGE_SIZE to buf. Therefore, to prevent this, we should use the
    smaller of trace_seq_used(&iter->seq) and PAGE_SIZE as an argument.

    Link: https://lore.kernel.org/20250422113026.13308-1-aha310510@gmail.com
    Reported-by: syzbot+c8cd2d2c412b868263fb@syzkaller.appspotmail.com
    Fixes: 3c56819 ("tracing: splice support for tracing_pipe")
    Suggested-by: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Jeongjun Park <aha310510@gmail.com>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Signed-off-by: Jerome Marchand <jmarchan@redhat.com>

Author: jeromemarchand

kernel/trace/trace.c

@@ -6701,13 +6701,14 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
 		/* Copy the data into the page, so we can start over. */
 		ret = trace_seq_to_buffer(&iter->seq,
 					  page_address(spd.pages[i]),
-					  trace_seq_used(&iter->seq));
+					  min((size_t)trace_seq_used(&iter->seq),
+						  PAGE_SIZE));
 		if (ret < 0) {
 			__free_page(spd.pages[i]);
 			break;
 		}
 		spd.partial[i].offset = 0;
-		spd.partial[i].len = trace_seq_used(&iter->seq);
+		spd.partial[i].len = ret;
 
 		trace_seq_init(&iter->seq);
 	}