FAILED: patch "[PATCH] ftrace: Fix possible use-after-free issue in" failed to apply to 4.19-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y
git checkout FETCH_HEAD
git cherry-pick -x e60b613df8b6253def41215402f72986fee3fc8d
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2024052700-ferry-breeder-caa8@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From e60b613df8b6253def41215402f72986fee3fc8d Mon Sep 17 00:00:00 2001
From: Zheng Yejian <[email protected]>
Date: Fri, 10 May 2024 03:28:59 +0800
Subject: [PATCH] ftrace: Fix possible use-after-free issue in
ftrace_location()
KASAN reports a bug:
BUG: KASAN: use-after-free in ftrace_location+0x90/0x120 Read of size 8 at addr ffff888141d40010 by task insmod/424 CPU: 8 PID: 424 Comm: insmod Tainted: G W 6.9.0-rc2+ [...] Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 print_report+0xcf/0x610 kasan_report+0xb5/0xe0 ftrace_location+0x90/0x120 register_kprobe+0x14b/0xa40 kprobe_init+0x2d/0xff0 [kprobe_example] do_one_initcall+0x8f/0x2d0 do_init_module+0x13a/0x3c0 load_module+0x3082/0x33d0 init_module_from_file+0xd2/0x130 __x64_sys_finit_module+0x306/0x440 do_syscall_64+0x68/0x140 entry_SYSCALL_64_after_hwframe+0x71/0x79
The root cause is that, in lookup_rec(), ftrace record of some address is being searched in ftrace pages of some module, but those ftrace pages at the same time is being freed in ftrace_release_mod() as the corresponding module is being deleted:
CPU1 | CPU2
register_kprobes() { | delete_module() {
check_kprobe_address_safe() { |
arch_check_ftrace_location() { |
ftrace_location() { |
lookup_rec() // USE! | ftrace_release_mod() // Free!To fix this issue:
1. Hold rcu lock as accessing ftrace pages in ftrace_location_range();
2. Use ftrace_location_range() instead of lookup_rec() in
ftrace_location();
3. Call synchronize_rcu() before freeing any ftrace pages both in ftrace_process_locs()/ftrace_release_mod()/ftrace_free_mem().
kernel/trace/ftrace.c +23 -16
@@ -1595,12 +1595,15 @@ static struct dyn_ftrace *lookup_rec(unsigned long start, unsigned long end)unsigned long ftrace_location_range (unsigned long start,unsigned long end) {struct dyn_ftrace *rec; +unsigned long ip =0 ; +rcu_read_lock (); rec =lookup_rec (start, end);if (rec) -return rec->ip; + ip = rec->ip; +rcu_read_unlock (); -return 0 ; +return ip; }/**
@@ -1614,25 +1617,22 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end)*/ unsigned long ftrace_location (unsigned long ip) { -struct dyn_ftrace *rec; +unsigned long loc;unsigned long offset;unsigned long size; - rec =lookup_rec (ip, ip); -if (!rec) { + loc =ftrace_location_range (ip, ip); +if (!loc) {if (!kallsyms_lookup_size_offset (ip, &size, &offset)) goto out;/* map sym+0 to __fentry__ */ if (!offset) - rec =lookup_rec (ip, ip + size -1 ); + loc =ftrace_location_range (ip, ip + size -1 ); } -if (rec) -return rec->ip; - out: -return 0 ; +return loc; }/**
@@ -6591,6 +6591,8 @@ static int ftrace_process_locs(struct module *mod,/* We should have used all pages unless we skipped some */ if (pg_unuse) {WARN_ON (!skipped); +/* Need to synchronize with ftrace_location_range() */ +synchronize_rcu ();ftrace_free_pages (pg_unuse); }return ret;
@@ -6804,6 +6806,9 @@ void ftrace_release_mod(struct module *mod) out_unlock:mutex_unlock (&ftrace_lock); +/* Need to synchronize with ftrace_location_range() */ +if (tmp_page) +synchronize_rcu ();for (pg = tmp_page; pg; pg = tmp_page) {/* Needs to be called outside of ftrace_lock */
@@ -7137,6 +7142,7 @@ void ftrace_free_mem(struct module *mod, void *start_ptr, void *end_ptr)unsigned long start = (unsigned long )(start_ptr);unsigned long end = (unsigned long )(end_ptr);struct ftrace_page **last_pg = &ftrace_pages_start; +struct ftrace_page *tmp_page =NULL ;struct ftrace_page *pg;struct dyn_ftrace *rec;struct dyn_ftrace key;
@@ -7178,12 +7184,8 @@ void ftrace_free_mem(struct module *mod, void *start_ptr, void *end_ptr) ftrace_update_tot_cnt--;if (!pg->index) { *last_pg = pg->next; -if (pg->records) { -free_pages ((unsigned long )pg->records, pg->order); - ftrace_number_of_pages -=1 << pg->order; - } - ftrace_number_of_groups--; -kfree (pg); + pg->next = tmp_page; + tmp_page = pg; pg = container_of(last_pg, struct ftrace_page, next);if (!(*last_pg)) ftrace_pages = pg;
@@ -7200,6 +7202,11 @@ void ftrace_free_mem(struct module *mod, void *start_ptr, void *end_ptr)clear_func_from_hashes (func);kfree (func); } +/* Need to synchronize with ftrace_location_range() */ +if (tmp_page) { +synchronize_rcu (); +ftrace_free_pages (tmp_page); + } }void __init ftrace_free_init_mem (void )