| Message ID | 20230615115236.3476617-1-jolsa@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Masami Hiramatsu |
| Headers | show |
| Series | fprobe: Release rethook after the ftrace_ops is unregistered | expand |
Masami, Want to take this via your probes/urgent branch and send it off to Linus? -- Steve On Thu, 15 Jun 2023 13:52:36 +0200 Jiri Olsa <jolsa@kernel.org> wrote: > While running bpf selftests it's possible to get following fault: > > general protection fault, probably for non-canonical address \ > 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI > ... > Call Trace: > <TASK> > fprobe_handler+0xc1/0x270 > ? __pfx_bpf_testmod_init+0x10/0x10 > ? __pfx_bpf_testmod_init+0x10/0x10 > ? bpf_fentry_test1+0x5/0x10 > ? bpf_fentry_test1+0x5/0x10 > ? bpf_testmod_init+0x22/0x80 > ? do_one_initcall+0x63/0x2e0 > ? rcu_is_watching+0xd/0x40 > ? kmalloc_trace+0xaf/0xc0 > ? do_init_module+0x60/0x250 > ? __do_sys_finit_module+0xac/0x120 > ? do_syscall_64+0x37/0x90 > ? entry_SYSCALL_64_after_hwframe+0x72/0xdc > </TASK> > > In unregister_fprobe function we can't release fp->rethook while it's > possible there are some of its users still running on another cpu. > > Moving rethook_free call after fp->ops is unregistered with > unregister_ftrace_function call. > > Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support") > Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> > Signed-off-by: Jiri Olsa <jolsa@kernel.org> > --- > kernel/trace/fprobe.c | 12 +++--------- > 1 file changed, 3 insertions(+), 9 deletions(-) > > diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c > index 18d36842faf5..0121e8c0d54e 100644 > --- a/kernel/trace/fprobe.c > +++ b/kernel/trace/fprobe.c > @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp) > fp->ops.saved_func != fprobe_kprobe_handler)) > return -EINVAL; > > - /* > - * rethook_free() starts disabling the rethook, but the rethook handlers > - * may be running on other processors at this point. To make sure that all > - * current running handlers are finished, call unregister_ftrace_function() > - * after this. > - */ > - if (fp->rethook) > - rethook_free(fp->rethook); > - > ret = unregister_ftrace_function(&fp->ops); > if (ret < 0) > return ret; > > + if (fp->rethook) > + rethook_free(fp->rethook); > + > ftrace_free_filter(&fp->ops); > > return ret;
On Thu, Jun 15, 2023 at 08:59:20AM -0400, Steven Rostedt wrote: > > Masami, > > Want to take this via your probes/urgent branch and send it off to Linus? hi, did this one make it into some tree? thanks, jirka > > -- Steve > > > On Thu, 15 Jun 2023 13:52:36 +0200 > Jiri Olsa <jolsa@kernel.org> wrote: > > > While running bpf selftests it's possible to get following fault: > > > > general protection fault, probably for non-canonical address \ > > 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI > > ... > > Call Trace: > > <TASK> > > fprobe_handler+0xc1/0x270 > > ? __pfx_bpf_testmod_init+0x10/0x10 > > ? __pfx_bpf_testmod_init+0x10/0x10 > > ? bpf_fentry_test1+0x5/0x10 > > ? bpf_fentry_test1+0x5/0x10 > > ? bpf_testmod_init+0x22/0x80 > > ? do_one_initcall+0x63/0x2e0 > > ? rcu_is_watching+0xd/0x40 > > ? kmalloc_trace+0xaf/0xc0 > > ? do_init_module+0x60/0x250 > > ? __do_sys_finit_module+0xac/0x120 > > ? do_syscall_64+0x37/0x90 > > ? entry_SYSCALL_64_after_hwframe+0x72/0xdc > > </TASK> > > > > In unregister_fprobe function we can't release fp->rethook while it's > > possible there are some of its users still running on another cpu. > > > > Moving rethook_free call after fp->ops is unregistered with > > unregister_ftrace_function call. > > > > Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support") > > Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> > > Signed-off-by: Jiri Olsa <jolsa@kernel.org> > > --- > > kernel/trace/fprobe.c | 12 +++--------- > > 1 file changed, 3 insertions(+), 9 deletions(-) > > > > diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c > > index 18d36842faf5..0121e8c0d54e 100644 > > --- a/kernel/trace/fprobe.c > > +++ b/kernel/trace/fprobe.c > > @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp) > > fp->ops.saved_func != fprobe_kprobe_handler)) > > return -EINVAL; > > > > - /* > > - * rethook_free() starts disabling the rethook, but the rethook handlers > > - * may be running on other processors at this point. To make sure that all > > - * current running handlers are finished, call unregister_ftrace_function() > > - * after this. > > - */ > > - if (fp->rethook) > > - rethook_free(fp->rethook); > > - > > ret = unregister_ftrace_function(&fp->ops); > > if (ret < 0) > > return ret; > > > > + if (fp->rethook) > > + rethook_free(fp->rethook); > > + > > ftrace_free_filter(&fp->ops); > > > > return ret; >
Hi Jiri, On Thu, 15 Jun 2023 13:52:36 +0200 Jiri Olsa <jolsa@kernel.org> wrote: > While running bpf selftests it's possible to get following fault: > > general protection fault, probably for non-canonical address \ > 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI > ... > Call Trace: > <TASK> > fprobe_handler+0xc1/0x270 > ? __pfx_bpf_testmod_init+0x10/0x10 > ? __pfx_bpf_testmod_init+0x10/0x10 > ? bpf_fentry_test1+0x5/0x10 > ? bpf_fentry_test1+0x5/0x10 > ? bpf_testmod_init+0x22/0x80 > ? do_one_initcall+0x63/0x2e0 > ? rcu_is_watching+0xd/0x40 > ? kmalloc_trace+0xaf/0xc0 > ? do_init_module+0x60/0x250 > ? __do_sys_finit_module+0xac/0x120 > ? do_syscall_64+0x37/0x90 > ? entry_SYSCALL_64_after_hwframe+0x72/0xdc > </TASK> > > In unregister_fprobe function we can't release fp->rethook while it's > possible there are some of its users still running on another cpu. Ah, OK. rethook_free() invoked call_rcu(rethook_free_rcu) to free the rethook, and it is possible rethook_free_rcu() is called before disabling all fprobe, then `rethook_try_get(fp->rethook)` will access fp->rethook which has been freed. > > Moving rethook_free call after fp->ops is unregistered with > unregister_ftrace_function call. > > Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support") > Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> > Signed-off-by: Jiri Olsa <jolsa@kernel.org> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Thank you! > --- > kernel/trace/fprobe.c | 12 +++--------- > 1 file changed, 3 insertions(+), 9 deletions(-) > > diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c > index 18d36842faf5..0121e8c0d54e 100644 > --- a/kernel/trace/fprobe.c > +++ b/kernel/trace/fprobe.c > @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp) > fp->ops.saved_func != fprobe_kprobe_handler)) > return -EINVAL; > > - /* > - * rethook_free() starts disabling the rethook, but the rethook handlers > - * may be running on other processors at this point. To make sure that all > - * current running handlers are finished, call unregister_ftrace_function() > - * after this. > - */ > - if (fp->rethook) > - rethook_free(fp->rethook); > - > ret = unregister_ftrace_function(&fp->ops); > if (ret < 0) > return ret; > > + if (fp->rethook) > + rethook_free(fp->rethook); > + > ftrace_free_filter(&fp->ops); > > return ret; > -- > 2.40.1 >
On Tue, 27 Jun 2023 23:33:06 +0900 Masami Hiramatsu (Google) <mhiramat@kernel.org> wrote: > > diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c > > index 18d36842faf5..0121e8c0d54e 100644 > > --- a/kernel/trace/fprobe.c > > +++ b/kernel/trace/fprobe.c > > @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp) > > fp->ops.saved_func != fprobe_kprobe_handler)) > > return -EINVAL; > > > > - /* > > - * rethook_free() starts disabling the rethook, but the rethook handlers > > - * may be running on other processors at this point. To make sure that all > > - * current running handlers are finished, call unregister_ftrace_function() > > - * after this. > > - */ Oh, wait, here is an important comment. If a rethook handler is still running (because it hooks target function exit), returning from unregister_fprobe() right after rethook_free() may cause another issue. rethook_free() clears 'rh->handler', so after calling rethook_free(), we can ensure no NEW rethook handler (means fprobe_exit_handler()) is called. However, it doesn't mean there is no current running fprobe_exit_handler(). Thus if unregister_fprobe() caller releases the 'fp' right after returning from unregister_fprobe(), current running fprobe_exit_handler() can access 'fp' (use-after-free). Thus we need to add below code with this patch; /* * The rethook handlers may be running on other processors at this point. * To make sure that all current running handlers are finished, disable * rethook by clearing handler and call unregister_ftrace_function() * to ensure all running rethook handlers exit. And call rethook_free(). */ if (fp->rethook) WRITE_ONCE(fp->rethook->handler, NULL); > > - if (fp->rethook) > > - rethook_free(fp->rethook); > > - > > ret = unregister_ftrace_function(&fp->ops); > > if (ret < 0) > > return ret; > > > > + if (fp->rethook) > > + rethook_free(fp->rethook); > > + > > ftrace_free_filter(&fp->ops); > > > > return ret; Thank you, > > -- > > 2.40.1 > > > > > -- > Masami Hiramatsu (Google) <mhiramat@kernel.org>
diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c index 18d36842faf5..0121e8c0d54e 100644 --- a/kernel/trace/fprobe.c +++ b/kernel/trace/fprobe.c @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp) fp->ops.saved_func != fprobe_kprobe_handler)) return -EINVAL; - /* - * rethook_free() starts disabling the rethook, but the rethook handlers - * may be running on other processors at this point. To make sure that all - * current running handlers are finished, call unregister_ftrace_function() - * after this. - */ - if (fp->rethook) - rethook_free(fp->rethook); - ret = unregister_ftrace_function(&fp->ops); if (ret < 0) return ret; + if (fp->rethook) + rethook_free(fp->rethook); + ftrace_free_filter(&fp->ops); return ret;
While running bpf selftests it's possible to get following fault: general protection fault, probably for non-canonical address \ 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI ... Call Trace: <TASK> fprobe_handler+0xc1/0x270 ? __pfx_bpf_testmod_init+0x10/0x10 ? __pfx_bpf_testmod_init+0x10/0x10 ? bpf_fentry_test1+0x5/0x10 ? bpf_fentry_test1+0x5/0x10 ? bpf_testmod_init+0x22/0x80 ? do_one_initcall+0x63/0x2e0 ? rcu_is_watching+0xd/0x40 ? kmalloc_trace+0xaf/0xc0 ? do_init_module+0x60/0x250 ? __do_sys_finit_module+0xac/0x120 ? do_syscall_64+0x37/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc </TASK> In unregister_fprobe function we can't release fp->rethook while it's possible there are some of its users still running on another cpu. Moving rethook_free call after fp->ops is unregistered with unregister_ftrace_function call. Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support") Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Jiri Olsa <jolsa@kernel.org> --- kernel/trace/fprobe.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-)