Re: [PATCH] fprobe: Release rethook after the ftrace_ops is unregistered
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Date: 2023-06-27 14:33:17
Also in:
bpf, lkml
Hi Jiri, On Thu, 15 Jun 2023 13:52:36 +0200 Jiri Olsa [off-list ref] wrote:
While running bpf selftests it's possible to get following fault: general protection fault, probably for non-canonical address \ 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI ... Call Trace: <TASK> fprobe_handler+0xc1/0x270 ? __pfx_bpf_testmod_init+0x10/0x10 ? __pfx_bpf_testmod_init+0x10/0x10 ? bpf_fentry_test1+0x5/0x10 ? bpf_fentry_test1+0x5/0x10 ? bpf_testmod_init+0x22/0x80 ? do_one_initcall+0x63/0x2e0 ? rcu_is_watching+0xd/0x40 ? kmalloc_trace+0xaf/0xc0 ? do_init_module+0x60/0x250 ? __do_sys_finit_module+0xac/0x120 ? do_syscall_64+0x37/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc </TASK> In unregister_fprobe function we can't release fp->rethook while it's possible there are some of its users still running on another cpu.
Ah, OK. rethook_free() invoked call_rcu(rethook_free_rcu) to free the rethook, and it is possible rethook_free_rcu() is called before disabling all fprobe, then `rethook_try_get(fp->rethook)` will access fp->rethook which has been freed.
Moving rethook_free call after fp->ops is unregistered with
unregister_ftrace_function call.
Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support")
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Thank you!
quoted hunk ↗ jump to hunk
--- kernel/trace/fprobe.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c index 18d36842faf5..0121e8c0d54e 100644 --- a/kernel/trace/fprobe.c +++ b/kernel/trace/fprobe.c@@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp) fp->ops.saved_func != fprobe_kprobe_handler)) return -EINVAL; - /* - * rethook_free() starts disabling the rethook, but the rethook handlers - * may be running on other processors at this point. To make sure that all - * current running handlers are finished, call unregister_ftrace_function() - * after this. - */ - if (fp->rethook) - rethook_free(fp->rethook); - ret = unregister_ftrace_function(&fp->ops); if (ret < 0) return ret; + if (fp->rethook) + rethook_free(fp->rethook); + ftrace_free_filter(&fp->ops); return ret;-- 2.40.1
-- Masami Hiramatsu (Google) [off-list ref]