diff mbox series

fprobe: Release rethook after the ftrace_ops is unregistered

Message ID 20230615115236.3476617-1-jolsa@kernel.org
State New
Headers
Series fprobe: Release rethook after the ftrace_ops is unregistered |

Commit Message

Jiri Olsa June 15, 2023, 11:52 a.m. UTC 
  While running bpf selftests it's possible to get following fault:

  general protection fault, probably for non-canonical address \
  0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI
  ...
  Call Trace:
   <TASK>
   fprobe_handler+0xc1/0x270
   ? __pfx_bpf_testmod_init+0x10/0x10
   ? __pfx_bpf_testmod_init+0x10/0x10
   ? bpf_fentry_test1+0x5/0x10
   ? bpf_fentry_test1+0x5/0x10
   ? bpf_testmod_init+0x22/0x80
   ? do_one_initcall+0x63/0x2e0
   ? rcu_is_watching+0xd/0x40
   ? kmalloc_trace+0xaf/0xc0
   ? do_init_module+0x60/0x250
   ? __do_sys_finit_module+0xac/0x120
   ? do_syscall_64+0x37/0x90
   ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
   </TASK>

In unregister_fprobe function we can't release fp->rethook while it's
possible there are some of its users still running on another cpu.

Moving rethook_free call after fp->ops is unregistered with
unregister_ftrace_function call.

Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support")
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 kernel/trace/fprobe.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

Comments

Steven Rostedt June 15, 2023, 12:59 p.m. UTC | #1 
Masami,

Want to take this via your probes/urgent branch and send it off to Linus?

-- Steve


On Thu, 15 Jun 2023 13:52:36 +0200
Jiri Olsa <jolsa@kernel.org> wrote:

> While running bpf selftests it's possible to get following fault:
> 
>   general protection fault, probably for non-canonical address \
>   0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI
>   ...
>   Call Trace:
>    <TASK>
>    fprobe_handler+0xc1/0x270
>    ? __pfx_bpf_testmod_init+0x10/0x10
>    ? __pfx_bpf_testmod_init+0x10/0x10
>    ? bpf_fentry_test1+0x5/0x10
>    ? bpf_fentry_test1+0x5/0x10
>    ? bpf_testmod_init+0x22/0x80
>    ? do_one_initcall+0x63/0x2e0
>    ? rcu_is_watching+0xd/0x40
>    ? kmalloc_trace+0xaf/0xc0
>    ? do_init_module+0x60/0x250
>    ? __do_sys_finit_module+0xac/0x120
>    ? do_syscall_64+0x37/0x90
>    ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
>    </TASK>
> 
> In unregister_fprobe function we can't release fp->rethook while it's
> possible there are some of its users still running on another cpu.
> 
> Moving rethook_free call after fp->ops is unregistered with
> unregister_ftrace_function call.
> 
> Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support")
> Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---
>  kernel/trace/fprobe.c | 12 +++---------
>  1 file changed, 3 insertions(+), 9 deletions(-)
> 
> diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
> index 18d36842faf5..0121e8c0d54e 100644
> --- a/kernel/trace/fprobe.c
> +++ b/kernel/trace/fprobe.c
> @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp)
>  		    fp->ops.saved_func != fprobe_kprobe_handler))
>  		return -EINVAL;
>  
> -	/*
> -	 * rethook_free() starts disabling the rethook, but the rethook handlers
> -	 * may be running on other processors at this point. To make sure that all
> -	 * current running handlers are finished, call unregister_ftrace_function()
> -	 * after this.
> -	 */
> -	if (fp->rethook)
> -		rethook_free(fp->rethook);
> -
>  	ret = unregister_ftrace_function(&fp->ops);
>  	if (ret < 0)
>  		return ret;
>  
> +	if (fp->rethook)
> +		rethook_free(fp->rethook);
> +
>  	ftrace_free_filter(&fp->ops);
>  
>  	return ret;
Jiri Olsa June 23, 2023, 11:11 a.m. UTC | #2 
On Thu, Jun 15, 2023 at 08:59:20AM -0400, Steven Rostedt wrote:
> 
> Masami,
> 
> Want to take this via your probes/urgent branch and send it off to Linus?

hi,
did this one make it into some tree?

thanks,
jirka


> 
> -- Steve
> 
> 
> On Thu, 15 Jun 2023 13:52:36 +0200
> Jiri Olsa <jolsa@kernel.org> wrote:
> 
> > While running bpf selftests it's possible to get following fault:
> > 
> >   general protection fault, probably for non-canonical address \
> >   0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI
> >   ...
> >   Call Trace:
> >    <TASK>
> >    fprobe_handler+0xc1/0x270
> >    ? __pfx_bpf_testmod_init+0x10/0x10
> >    ? __pfx_bpf_testmod_init+0x10/0x10
> >    ? bpf_fentry_test1+0x5/0x10
> >    ? bpf_fentry_test1+0x5/0x10
> >    ? bpf_testmod_init+0x22/0x80
> >    ? do_one_initcall+0x63/0x2e0
> >    ? rcu_is_watching+0xd/0x40
> >    ? kmalloc_trace+0xaf/0xc0
> >    ? do_init_module+0x60/0x250
> >    ? __do_sys_finit_module+0xac/0x120
> >    ? do_syscall_64+0x37/0x90
> >    ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
> >    </TASK>
> > 
> > In unregister_fprobe function we can't release fp->rethook while it's
> > possible there are some of its users still running on another cpu.
> > 
> > Moving rethook_free call after fp->ops is unregistered with
> > unregister_ftrace_function call.
> > 
> > Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support")
> > Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > ---
> >  kernel/trace/fprobe.c | 12 +++---------
> >  1 file changed, 3 insertions(+), 9 deletions(-)
> > 
> > diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
> > index 18d36842faf5..0121e8c0d54e 100644
> > --- a/kernel/trace/fprobe.c
> > +++ b/kernel/trace/fprobe.c
> > @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp)
> >  		    fp->ops.saved_func != fprobe_kprobe_handler))
> >  		return -EINVAL;
> >  
> > -	/*
> > -	 * rethook_free() starts disabling the rethook, but the rethook handlers
> > -	 * may be running on other processors at this point. To make sure that all
> > -	 * current running handlers are finished, call unregister_ftrace_function()
> > -	 * after this.
> > -	 */
> > -	if (fp->rethook)
> > -		rethook_free(fp->rethook);
> > -
> >  	ret = unregister_ftrace_function(&fp->ops);
> >  	if (ret < 0)
> >  		return ret;
> >  
> > +	if (fp->rethook)
> > +		rethook_free(fp->rethook);
> > +
> >  	ftrace_free_filter(&fp->ops);
> >  
> >  	return ret;
>
Masami Hiramatsu (Google) June 27, 2023, 2:33 p.m. UTC | #3 
Hi Jiri,

On Thu, 15 Jun 2023 13:52:36 +0200
Jiri Olsa <jolsa@kernel.org> wrote:

> While running bpf selftests it's possible to get following fault:
> 
>   general protection fault, probably for non-canonical address \
>   0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI
>   ...
>   Call Trace:
>    <TASK>
>    fprobe_handler+0xc1/0x270
>    ? __pfx_bpf_testmod_init+0x10/0x10
>    ? __pfx_bpf_testmod_init+0x10/0x10
>    ? bpf_fentry_test1+0x5/0x10
>    ? bpf_fentry_test1+0x5/0x10
>    ? bpf_testmod_init+0x22/0x80
>    ? do_one_initcall+0x63/0x2e0
>    ? rcu_is_watching+0xd/0x40
>    ? kmalloc_trace+0xaf/0xc0
>    ? do_init_module+0x60/0x250
>    ? __do_sys_finit_module+0xac/0x120
>    ? do_syscall_64+0x37/0x90
>    ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
>    </TASK>
> 
> In unregister_fprobe function we can't release fp->rethook while it's
> possible there are some of its users still running on another cpu.

Ah, OK. rethook_free() invoked call_rcu(rethook_free_rcu) to free the
rethook, and it is possible rethook_free_rcu() is called before disabling
all fprobe, then `rethook_try_get(fp->rethook)` will access fp->rethook
which has been freed.

> 
> Moving rethook_free call after fp->ops is unregistered with
> unregister_ftrace_function call.
> 
> Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support")
> Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>

Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Thank you!


> ---
>  kernel/trace/fprobe.c | 12 +++---------
>  1 file changed, 3 insertions(+), 9 deletions(-)
> 
> diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
> index 18d36842faf5..0121e8c0d54e 100644
> --- a/kernel/trace/fprobe.c
> +++ b/kernel/trace/fprobe.c
> @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp)
>  		    fp->ops.saved_func != fprobe_kprobe_handler))
>  		return -EINVAL;
>  
> -	/*
> -	 * rethook_free() starts disabling the rethook, but the rethook handlers
> -	 * may be running on other processors at this point. To make sure that all
> -	 * current running handlers are finished, call unregister_ftrace_function()
> -	 * after this.
> -	 */
> -	if (fp->rethook)
> -		rethook_free(fp->rethook);
> -
>  	ret = unregister_ftrace_function(&fp->ops);
>  	if (ret < 0)
>  		return ret;
>  
> +	if (fp->rethook)
> +		rethook_free(fp->rethook);
> +
>  	ftrace_free_filter(&fp->ops);
>  
>  	return ret;
> -- 
> 2.40.1
>
Masami Hiramatsu (Google) June 27, 2023, 4:23 p.m. UTC | #4 
On Tue, 27 Jun 2023 23:33:06 +0900
Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote:

> > diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
> > index 18d36842faf5..0121e8c0d54e 100644
> > --- a/kernel/trace/fprobe.c
> > +++ b/kernel/trace/fprobe.c
> > @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp)
> >  		    fp->ops.saved_func != fprobe_kprobe_handler))
> >  		return -EINVAL;
> >  
> > -	/*
> > -	 * rethook_free() starts disabling the rethook, but the rethook handlers
> > -	 * may be running on other processors at this point. To make sure that all
> > -	 * current running handlers are finished, call unregister_ftrace_function()
> > -	 * after this.
> > -	 */

Oh, wait, here is an important comment. If a rethook handler is still running
(because it hooks target function exit), returning from unregister_fprobe()
right after rethook_free() may cause another issue.

rethook_free() clears 'rh->handler', so after calling rethook_free(), we
can ensure no NEW rethook handler (means fprobe_exit_handler()) is called.
However, it doesn't mean there is no current running fprobe_exit_handler().
Thus if unregister_fprobe() caller releases the 'fp' right after returning
from unregister_fprobe(), current running fprobe_exit_handler() can access
'fp' (use-after-free).

Thus we need to add below code with this patch;
	/*
	 * The rethook handlers may be running on other processors at this point.
	 * To make sure that all current running handlers are finished, disable
	 * rethook by clearing handler and call unregister_ftrace_function()
	 * to ensure all running rethook handlers exit. And call rethook_free().
	 */
	if (fp->rethook)
		WRITE_ONCE(fp->rethook->handler, NULL);

> > -	if (fp->rethook)
> > -		rethook_free(fp->rethook);
> > -
> >  	ret = unregister_ftrace_function(&fp->ops);
> >  	if (ret < 0)
> >  		return ret;
> >  
> > +	if (fp->rethook)
> > +		rethook_free(fp->rethook);
> > +
> >  	ftrace_free_filter(&fp->ops);
> >  
> >  	return ret;

Thank you,

> > -- 
> > 2.40.1
> > 
> 
> 
> -- 
> Masami Hiramatsu (Google) <mhiramat@kernel.org>
diff mbox series

Patch

diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
index 18d36842faf5..0121e8c0d54e 100644
--- a/kernel/trace/fprobe.c
+++ b/kernel/trace/fprobe.c
@@ -364,19 +364,13 @@  int unregister_fprobe(struct fprobe *fp)
 		    fp->ops.saved_func != fprobe_kprobe_handler))
 		return -EINVAL;
 
-	/*
-	 * rethook_free() starts disabling the rethook, but the rethook handlers
-	 * may be running on other processors at this point. To make sure that all
-	 * current running handlers are finished, call unregister_ftrace_function()
-	 * after this.
-	 */
-	if (fp->rethook)
-		rethook_free(fp->rethook);
-
 	ret = unregister_ftrace_function(&fp->ops);
 	if (ret < 0)
 		return ret;
 
+	if (fp->rethook)
+		rethook_free(fp->rethook);
+
 	ftrace_free_filter(&fp->ops);
 
 	return ret;