From patchwork Sat Nov 12 07:00:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li Huafei X-Patchwork-Id: 19118 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp1148891wru; Fri, 11 Nov 2022 23:04:39 -0800 (PST) X-Google-Smtp-Source: AA0mqf4unpbSilZDsgV0O+Nd6WiCo3fBRweKj43EZqYmJhHhIobqcyTVNjg9GWgBOkM7MleJ2i3m X-Received: by 2002:a17:903:3286:b0:187:a98:7eea with SMTP id jh6-20020a170903328600b001870a987eeamr5606008plb.109.1668236679195; Fri, 11 Nov 2022 23:04:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668236679; cv=none; d=google.com; s=arc-20160816; b=Bj5+e3vX9K8hbsPbcF8QRp2BKmYggEuqfL/YRMVFAeKCbGlKayTgUoGANufVCpj+8T LYtlFYVmWpqgdgs247CteaLV5qjDyt4Jw0+zp7Zv4wXuHjTow/mCIA6ujzcoDqqBTmGr k3J9FS42HRb0pdn+c7j490eCUyq76bNwprRQix92c3cZVQ1i5AAg/zUrH+co9kDKiLbV gMWvr5q+lJ8+OQ23wUOXdPsdrJXkgxWXwmpikOSFoN6HoVHmY9oCclwcjfDqJY73zDrC 6pt4LYzmQxuJiebEVv9shrhi/qLPW13FNhJ7koJQnAWyiLP+ro3ykr0WN5Enw4BlYl/L Ta4g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:message-id:date:subject:cc:to:from; bh=6iKspdzjUiqeQjXXEt/HTpfvnugXiBY/eJsFrdcKK4M=; b=j605LwKq/sIu3pAMKBRFAw/nFfEZ9VBnEI1qPmoGFa+uMNfj4bxfIqimXvIni9DVHR cwWwqHFYXGuRO9KKN4ABnTwSVCGhv3LYFsFqbaDBEAspAs4KK/YPOqeQ8mZ+Zojc0mGL FBR3JUJ2Pf3z0wMTQ8cK1mAWWT/db/pXL8MA29YvVPq9dR4LuMo+lt/2DM4PPsdl7X4l 7g2mc3cZ58PZ8aQCOgAgocloJkTUkTXqoxTv2Yf8mGXUDtsGd/e4zkklExgEs3FLxFlT bik9YjRgskXFQcNNgvE33vTWeHLolghSW+aSzeTpiKiv5q745jnIpE6eLo9SPnzmpKTj gomQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 20-20020a631454000000b0044b5e15db73si4800646pgu.249.2022.11.11.23.04.26; Fri, 11 Nov 2022 23:04:39 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231469AbiKLHDe (ORCPT + 99 others); Sat, 12 Nov 2022 02:03:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50912 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230043AbiKLHD3 (ORCPT ); Sat, 12 Nov 2022 02:03:29 -0500 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0606ADE4 for ; Fri, 11 Nov 2022 23:03:26 -0800 (PST) Received: from dggemv704-chm.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4N8RNq1qTKzmVqs; Sat, 12 Nov 2022 15:03:07 +0800 (CST) Received: from kwepemm600010.china.huawei.com (7.193.23.86) by dggemv704-chm.china.huawei.com (10.3.19.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Sat, 12 Nov 2022 15:03:09 +0800 Received: from ubuntu1804.huawei.com (10.67.174.174) by kwepemm600010.china.huawei.com (7.193.23.86) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Sat, 12 Nov 2022 15:03:09 +0800 From: Li Huafei To: CC: , , , , , , , Subject: [PATCH v2] kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case Date: Sat, 12 Nov 2022 15:00:00 +0800 Message-ID: <20221112070000.35299-1-lihuafei1@huawei.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.67.174.174] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To kwepemm600010.china.huawei.com (7.193.23.86) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1749272944535028399?= X-GMAIL-MSGID: =?utf-8?q?1749272944535028399?= In __unregister_kprobe_top(), if the currently unregistered probe has post_handler but other child probes of the aggrprobe do not have post_handler, the post_handler of the aggrprobe is cleared. If this is a ftrace-based probe, there is a problem. In later calls to disarm_kprobe(), we will use kprobe_ftrace_ops because post_handler is NULL. But we're armed with kprobe_ipmodify_ops. This triggers a WARN in __disarm_kprobe_ftrace() and may even cause use-after-free: Failed to disarm kprobe-ftrace at kernel_clone+0x0/0x3c0 (error -2) WARNING: CPU: 5 PID: 137 at kernel/kprobes.c:1135 __disarm_kprobe_ftrace.isra.21+0xcf/0xe0 Modules linked in: testKprobe_007(-) CPU: 5 PID: 137 Comm: rmmod Not tainted 6.1.0-rc4-dirty #18 [...] Call Trace: __disable_kprobe+0xcd/0xe0 __unregister_kprobe_top+0x12/0x150 ? mutex_lock+0xe/0x30 unregister_kprobes.part.23+0x31/0xa0 unregister_kprobe+0x32/0x40 __x64_sys_delete_module+0x15e/0x260 ? do_user_addr_fault+0x2cd/0x6b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] For the kprobe-on-ftrace case, we keep the post_handler setting to identify this aggrprobe armed with kprobe_ipmodify_ops. This way we can disarm it correctly. Fixes: 0bc11ed5ab60 ("kprobes: Allow kprobes coexist with livepatch") Reported-by: Zhao Gongyi Suggested-by: Masami Hiramatsu (Google) Signed-off-by: Li Huafei Acked-by: Masami Hiramatsu (Google) --- kernel/kprobes.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index cd9f5a66a690..3050631e528d 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1766,7 +1766,13 @@ static int __unregister_kprobe_top(struct kprobe *p) if ((list_p != p) && (list_p->post_handler)) goto noclean; } - ap->post_handler = NULL; + /* + * For the kprobe-on-ftrace case, we keep the + * post_handler setting to identify this aggrprobe + * armed with kprobe_ipmodify_ops. + */ + if (!kprobe_ftrace(ap)) + ap->post_handler = NULL; } noclean: /*