From patchwork Fri Nov 11 10:10:06 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li Huafei X-Patchwork-Id: 18642 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp655758wru; Fri, 11 Nov 2022 02:17:40 -0800 (PST) X-Google-Smtp-Source: AA0mqf5Kk5QgDSrXgQdIDRiy5j3xDO8IWde+AbPAHhWCegHh+uFWXIBZEwmVakJjjUiBTdGa7KSL X-Received: by 2002:a17:906:eb59:b0:7ae:c1b2:d928 with SMTP id mc25-20020a170906eb5900b007aec1b2d928mr1312313ejb.296.1668161859873; Fri, 11 Nov 2022 02:17:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668161859; cv=none; d=google.com; s=arc-20160816; b=f1FGED9Nhho3dai6oxVnHrZ+q3ZpOnzAsAOIEYS89RKhlGFa6JolXqAnDmPd2fDnzl aBHOsNHrCjfOPbV+xGD4Q54LBkubHt8yJ0QlAuuDhqk205l3q5OJ9DoStxt3sXJ5EXsv IHTa0r71/3Vtf7yRjyV7T3lLpFJRZZzKi2JonrP01zf5Z9sBdwez2RonmcxhR/DrOsjs fawiwQ49N3z4nh+CQy4ZPCthPf7abXKxxDzV66CjlNNlT00ov07Kilj+gU6LCZIzb0sl EOqe9PEh3rGZ0nT6ipO3n1lL5L2nNbBTMyTADrsOGd6ZFtNsW02jDncbx3kUIu+oijAH ZmsA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:message-id:date:subject:cc:to:from; bh=4zfyEQvlV9hDOuM1KvhSLJwQJ/7eq6ey8lu8Zk4h5gw=; b=qB4fxGD4g6KJJ9uC396dqLS4zyYsdjC+pJWY9y+WCUUXj4c7cKauHlj4sQvDtqrz5z ydez32fwAz4zWTf7Kjsjp2cMp3IO8SDqrApAK2HQnIKJbGkLx715DkIaXtb7tyfx5NS7 hvs0Z0jYuhiYBE+j8b/9Ycyu3pv0cWvpGK62uw8+d6+LhDGBGGrHg9iKxASIEsAPJSK4 ZJIy6acIEzTTA/xA33vD92BbiF9IrhmpB326I/mfm0F46sx1P6rSIskfMmlhQTjs4tjm 5G43mKhlTnXubRe9IwYq9U7rreRj0ult+UtjGKlP2cWBJGqd6g8o7BVAFJUMeSzW1zjj jw4g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id x3-20020aa7dac3000000b00465f6a9fbb3si1758453eds.155.2022.11.11.02.17.15; Fri, 11 Nov 2022 02:17:39 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233367AbiKKKNW (ORCPT + 99 others); Fri, 11 Nov 2022 05:13:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51066 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233057AbiKKKNV (ORCPT ); Fri, 11 Nov 2022 05:13:21 -0500 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E7973EE20 for ; Fri, 11 Nov 2022 02:13:18 -0800 (PST) Received: from dggemv704-chm.china.huawei.com (unknown [172.30.72.57]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4N7vZQ4bVTzbndc; Fri, 11 Nov 2022 18:09:34 +0800 (CST) Received: from kwepemm600010.china.huawei.com (7.193.23.86) by dggemv704-chm.china.huawei.com (10.3.19.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Fri, 11 Nov 2022 18:13:17 +0800 Received: from ubuntu1804.huawei.com (10.67.174.174) by kwepemm600010.china.huawei.com (7.193.23.86) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Fri, 11 Nov 2022 18:13:16 +0800 From: Li Huafei To: , CC: , , , , , , Subject: [PATCH] kprobes: Update ftrace_ops when clearing ftrace-based aggrprobe's post_handler Date: Fri, 11 Nov 2022 18:10:06 +0800 Message-ID: <20221111101006.239177-1-lihuafei1@huawei.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.67.174.174] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To kwepemm600010.china.huawei.com (7.193.23.86) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1749194490282062914?= X-GMAIL-MSGID: =?utf-8?q?1749194490282062914?= In __unregister_kprobe_top(), if the currently unregistered probe has post_handler but other child probes of the aggrprobe do not have post_handler, the post_handler of the aggrprobe is cleared. If this is a ftrace-based probe, there is a problem. In later calls to disarm_kprobe(), we will use kprobe_ftrace_ops because post_handler is NULL. But we're armed with kprobe_ipmodify_ops. This triggers a WARN in __disarm_kprobe_ftrace() and may even cause use-after-free: Failed to disarm kprobe-ftrace at kernel_clone+0x0/0x3c0 (error -2) WARNING: CPU: 5 PID: 137 at kernel/kprobes.c:1135 __disarm_kprobe_ftrace.isra.21+0xcf/0xe0 Modules linked in: testKprobe_007(-) CPU: 5 PID: 137 Comm: rmmod Not tainted 6.1.0-rc4-dirty #18 [...] Call Trace: __disable_kprobe+0xcd/0xe0 __unregister_kprobe_top+0x12/0x150 ? mutex_lock+0xe/0x30 unregister_kprobes.part.23+0x31/0xa0 unregister_kprobe+0x32/0x40 __x64_sys_delete_module+0x15e/0x260 ? do_user_addr_fault+0x2cd/0x6b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] For ftrace kprobe, update post_handler at the same time update ftrace_ops, moving it from kprobe_ipmodify_ops to kprobe_ftrace_ops. Fixes: 0bc11ed5ab60 ("kprobes: Allow kprobes coexist with livepatch") Reported-by: Zhao Gongyi Signed-off-by: Li Huafei --- kernel/kprobes.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index cd9f5a66a690..f8bec48a9cf9 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1766,7 +1766,17 @@ static int __unregister_kprobe_top(struct kprobe *p) if ((list_p != p) && (list_p->post_handler)) goto noclean; } - ap->post_handler = NULL; + /* + * For ftrace kprobe, we need to update ftrace_ops + * at the same time as we update post_handler, moving + * it from kprobe_ipmodify_ops to kprobe_ftrace_ops. + */ + if (unlikely(kprobe_ftrace(ap))) { + disarm_kprobe(ap, false); + ap->post_handler = NULL; + arm_kprobe(ap); + } else + ap->post_handler = NULL; } noclean: /*