From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
To: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>,
Steven Rostedt <rostedt@goodmis.org>,
Mark Rutland <mark.rutland@arm.com>,
lkml <linux-kernel@vger.kernel.org>,
linux-trace-kernel@vger.kernel.org, bpf@vger.kernel.org
Subject: Re: [PATCH] fprobe: Release rethook after the ftrace_ops is unregistered
Date: Wed, 28 Jun 2023 01:23:05 +0900 [thread overview]
Message-ID: <20230628012305.978e34d44f1a53fe20327fde@kernel.org> (raw)
In-Reply-To: <20230627233306.b9b04d75f86944466f6534c2@kernel.org>
On Tue, 27 Jun 2023 23:33:06 +0900
Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote:
> > diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
> > index 18d36842faf5..0121e8c0d54e 100644
> > --- a/kernel/trace/fprobe.c
> > +++ b/kernel/trace/fprobe.c
> > @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp)
> > fp->ops.saved_func != fprobe_kprobe_handler))
> > return -EINVAL;
> >
> > - /*
> > - * rethook_free() starts disabling the rethook, but the rethook handlers
> > - * may be running on other processors at this point. To make sure that all
> > - * current running handlers are finished, call unregister_ftrace_function()
> > - * after this.
> > - */
Oh, wait, here is an important comment. If a rethook handler is still running
(because it hooks target function exit), returning from unregister_fprobe()
right after rethook_free() may cause another issue.
rethook_free() clears 'rh->handler', so after calling rethook_free(), we
can ensure no NEW rethook handler (means fprobe_exit_handler()) is called.
However, it doesn't mean there is no current running fprobe_exit_handler().
Thus if unregister_fprobe() caller releases the 'fp' right after returning
from unregister_fprobe(), current running fprobe_exit_handler() can access
'fp' (use-after-free).
Thus we need to add below code with this patch;
/*
* The rethook handlers may be running on other processors at this point.
* To make sure that all current running handlers are finished, disable
* rethook by clearing handler and call unregister_ftrace_function()
* to ensure all running rethook handlers exit. And call rethook_free().
*/
if (fp->rethook)
WRITE_ONCE(fp->rethook->handler, NULL);
> > - if (fp->rethook)
> > - rethook_free(fp->rethook);
> > -
> > ret = unregister_ftrace_function(&fp->ops);
> > if (ret < 0)
> > return ret;
> >
> > + if (fp->rethook)
> > + rethook_free(fp->rethook);
> > +
> > ftrace_free_filter(&fp->ops);
> >
> > return ret;
Thank you,
> > --
> > 2.40.1
> >
>
>
> --
> Masami Hiramatsu (Google) <mhiramat@kernel.org>
--
Masami Hiramatsu (Google) <mhiramat@kernel.org>
next prev parent reply other threads:[~2023-06-27 16:23 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-15 11:52 [PATCH] fprobe: Release rethook after the ftrace_ops is unregistered Jiri Olsa
2023-06-15 12:59 ` Steven Rostedt
2023-06-23 11:11 ` Jiri Olsa
2023-06-27 14:33 ` Masami Hiramatsu
2023-06-27 16:23 ` Masami Hiramatsu [this message]
2023-06-28 14:44 ` [PATCH] fprobe: Ensure running fprobe_exit_handler() finished before calling rethook_free() Masami Hiramatsu (Google)
2023-07-05 23:59 ` Masami Hiramatsu
2023-07-06 1:26 ` Steven Rostedt
2023-07-06 5:10 ` Masami Hiramatsu
2023-07-06 13:56 ` Steven Rostedt
2023-07-07 0:17 ` Masami Hiramatsu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230628012305.978e34d44f1a53fe20327fde@kernel.org \
--to=mhiramat@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=rostedt@goodmis.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).