Skip to content

Commit 2e8a12b

Browse files
compudjrostedt
authored andcommitted
tracing: Fix syscall tracepoint use-after-free
The grace period used internally within tracepoint.c:release_probes() uses call_rcu() to batch waiting for quiescence of old probe arrays, rather than using the tracepoint_synchronize_unregister() which blocks while waiting for quiescence. With the introduction of faultable syscall tracepoints, this causes use-after-free issues reproduced with syzkaller. Fix this by using the appropriate call_rcu() or call_rcu_tasks_trace() before invoking the rcu_free_old_probes callback. This can be chosen using the tracepoint_is_faultable() API. A similar issue exists in bpf use of call_rcu(). Fixing this is left to a separate change. Reported-by: syzbot+b390c8062d8387b6272a@syzkaller.appspotmail.com Fixes: a363d27 ("tracing: Allow system call tracepoints to handle page faults") Tested-by: Jordan Rife <jrife@google.com> Cc: Michael Jeanson <mjeanson@efficios.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Yonghong Song <yhs@fb.com> Cc: Paul E. McKenney <paulmck@kernel.org> Cc: Ingo Molnar <mingo@redhat.com> Cc: Arnaldo Carvalho de Melo <acme@kernel.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Andrii Nakryiko <andrii.nakryiko@gmail.com> Cc: bpf@vger.kernel.org Cc: Joel Fernandes <joel@joelfernandes.org> Cc: Jordan Rife <jrife@google.com> Cc: linux-trace-kernel@vger.kernel.org Link: https://lore.kernel.org/20241031152056.744137-4-mathieu.desnoyers@efficios.com Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
1 parent 654ced4 commit 2e8a12b

File tree

1 file changed

+7
-4
lines changed

1 file changed

+7
-4
lines changed

kernel/tracepoint.c

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,13 +106,16 @@ static void rcu_free_old_probes(struct rcu_head *head)
106106
kfree(container_of(head, struct tp_probes, rcu));
107107
}
108108

109-
static inline void release_probes(struct tracepoint_func *old)
109+
static inline void release_probes(struct tracepoint *tp, struct tracepoint_func *old)
110110
{
111111
if (old) {
112112
struct tp_probes *tp_probes = container_of(old,
113113
struct tp_probes, probes[0]);
114114

115-
call_rcu(&tp_probes->rcu, rcu_free_old_probes);
115+
if (tracepoint_is_faultable(tp))
116+
call_rcu_tasks_trace(&tp_probes->rcu, rcu_free_old_probes);
117+
else
118+
call_rcu(&tp_probes->rcu, rcu_free_old_probes);
116119
}
117120
}
118121

@@ -334,7 +337,7 @@ static int tracepoint_add_func(struct tracepoint *tp,
334337
break;
335338
}
336339

337-
release_probes(old);
340+
release_probes(tp, old);
338341
return 0;
339342
}
340343

@@ -405,7 +408,7 @@ static int tracepoint_remove_func(struct tracepoint *tp,
405408
WARN_ON_ONCE(1);
406409
break;
407410
}
408-
release_probes(old);
411+
release_probes(tp, old);
409412
return 0;
410413
}
411414

0 commit comments

Comments
 (0)