| Message ID | 168873859949.156157.13039240432299335849.stgit@devnote2 (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | [v2] fprobe: Ensure running fprobe_exit_handler() finished before calling rethook_free() | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch |
On Fri, 7 Jul 2023 23:03:19 +0900 "Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote: > From: Masami Hiramatsu (Google) <mhiramat@kernel.org> > > Ensure running fprobe_exit_handler() has finished before > calling rethook_free() in the unregister_fprobe() so that caller can free > the fprobe right after unregister_fprobe(). > > unregister_fprobe() ensured that all running fprobe_entry/exit_handler() > have finished by calling unregister_ftrace_function() which synchronizes > RCU. But commit 5f81018753df ("fprobe: Release rethook after the ftrace_ops > is unregistered") changed to call rethook_free() after > unregister_ftrace_function(). So call rethook_stop() to make rethook > disabled before unregister_ftrace_function() and ensure it again. > > Here is the possible code flow that can call the exit handler after > unregister_fprobe(). > > ------ > CPU1 CPU2 > call unregister_fprobe(fp) > ... > __fprobe_handler() > rethook_hook() on probed function > unregister_ftrace_function() > return from probed function > rethook hooks > find rh->handler == fprobe_exit_handler > call fprobe_exit_handler() > rethook_free(): > set rh->handler = NULL; > return from unreigster_fprobe; > call fp->exit_handler() <- (*) > ------ > > (*) At this point, the exit handler is called after returning from > unregister_fprobe(). > > This fixes it as following; > ------ > CPU1 CPU2 > call unregister_fprobe() > ... > rethook_stop(): > set rh->handler = NULL; > __fprobe_handler() > rethook_hook() on probed function > unregister_ftrace_function() > return from probed function > rethook hooks > find rh->handler == NULL > return from rethook > rethook_free() > return from unreigster_fprobe; > ------ > > > Fixes: 5f81018753df ("fprobe: Release rethook after the ftrace_ops is unregistered") > Cc: stable@vger.kernel.org > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Looks good. Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> > --- > Changes in v2: > - Update changelog to add a problematic code flow. Nit, for making forensic analysis easier in the future, I now always add a link to the previous version. That is: Changes since v1: https://lore.kernel.org/linux-trace-kernel/168796344232.46347.7947681068822514750.stgit@devnote2/ - Update changelog to add a problematic code flow. -- Steve > --- > include/linux/rethook.h | 1 + > kernel/trace/fprobe.c | 3 +++ > kernel/trace/rethook.c | 13 +++++++++++++ > 3 files changed, 17 insertions(+) >
On Mon, 10 Jul 2023 18:04:22 -0400 Steven Rostedt <rostedt@goodmis.org> wrote: > On Fri, 7 Jul 2023 23:03:19 +0900 > "Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote: > > > From: Masami Hiramatsu (Google) <mhiramat@kernel.org> > > > > Ensure running fprobe_exit_handler() has finished before > > calling rethook_free() in the unregister_fprobe() so that caller can free > > the fprobe right after unregister_fprobe(). > > > > unregister_fprobe() ensured that all running fprobe_entry/exit_handler() > > have finished by calling unregister_ftrace_function() which synchronizes > > RCU. But commit 5f81018753df ("fprobe: Release rethook after the ftrace_ops > > is unregistered") changed to call rethook_free() after > > unregister_ftrace_function(). So call rethook_stop() to make rethook > > disabled before unregister_ftrace_function() and ensure it again. > > > > Here is the possible code flow that can call the exit handler after > > unregister_fprobe(). > > > > ------ > > CPU1 CPU2 > > call unregister_fprobe(fp) > > ... > > __fprobe_handler() > > rethook_hook() on probed function > > unregister_ftrace_function() > > return from probed function > > rethook hooks > > find rh->handler == fprobe_exit_handler > > call fprobe_exit_handler() > > rethook_free(): > > set rh->handler = NULL; > > return from unreigster_fprobe; > > call fp->exit_handler() <- (*) > > ------ > > > > (*) At this point, the exit handler is called after returning from > > unregister_fprobe(). > > > > This fixes it as following; > > ------ > > CPU1 CPU2 > > call unregister_fprobe() > > ... > > rethook_stop(): > > set rh->handler = NULL; > > __fprobe_handler() > > rethook_hook() on probed function > > unregister_ftrace_function() > > return from probed function > > rethook hooks > > find rh->handler == NULL > > return from rethook > > rethook_free() > > return from unreigster_fprobe; > > ------ > > > > > > Fixes: 5f81018753df ("fprobe: Release rethook after the ftrace_ops is unregistered") > > Cc: stable@vger.kernel.org > > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> > > Looks good. > > Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Thank you :) > > > > --- > > Changes in v2: > > - Update changelog to add a problematic code flow. > > Nit, for making forensic analysis easier in the future, I now always add a > link to the previous version. That is: > > Changes since v1: https://lore.kernel.org/linux-trace-kernel/168796344232.46347.7947681068822514750.stgit@devnote2/ > - Update changelog to add a problematic code flow. OK, I'll add it for an isolated patch too. Thanks! > > -- Steve > > > > --- > > include/linux/rethook.h | 1 + > > kernel/trace/fprobe.c | 3 +++ > > kernel/trace/rethook.c | 13 +++++++++++++ > > 3 files changed, 17 insertions(+) > >
diff --git a/include/linux/rethook.h b/include/linux/rethook.h index c8ac1e5afcd1..bdbe6717f45a 100644 --- a/include/linux/rethook.h +++ b/include/linux/rethook.h @@ -59,6 +59,7 @@ struct rethook_node { }; struct rethook *rethook_alloc(void *data, rethook_handler_t handler); +void rethook_stop(struct rethook *rh); void rethook_free(struct rethook *rh); void rethook_add_node(struct rethook *rh, struct rethook_node *node); struct rethook_node *rethook_try_get(struct rethook *rh); diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c index 0121e8c0d54e..75517667b54f 100644 --- a/kernel/trace/fprobe.c +++ b/kernel/trace/fprobe.c @@ -364,6 +364,9 @@ int unregister_fprobe(struct fprobe *fp) fp->ops.saved_func != fprobe_kprobe_handler)) return -EINVAL; + if (fp->rethook) + rethook_stop(fp->rethook); + ret = unregister_ftrace_function(&fp->ops); if (ret < 0) return ret; diff --git a/kernel/trace/rethook.c b/kernel/trace/rethook.c index 60f6cb2b486b..468006cce7ca 100644 --- a/kernel/trace/rethook.c +++ b/kernel/trace/rethook.c @@ -53,6 +53,19 @@ static void rethook_free_rcu(struct rcu_head *head) kfree(rh); } +/** + * rethook_stop() - Stop using a rethook. + * @rh: the struct rethook to stop. + * + * Stop using a rethook to prepare for freeing it. If you want to wait for + * all running rethook handler before calling rethook_free(), you need to + * call this first and wait RCU, and call rethook_free(). + */ +void rethook_stop(struct rethook *rh) +{ + WRITE_ONCE(rh->handler, NULL); +} + /** * rethook_free() - Free struct rethook. * @rh: the struct rethook to be freed.