git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From stable+bounces-185558-greg=kroah.com@vger.kernel.org Tue Oct 14 02:19:22 2025
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Mon, 13 Oct 2025 20:19:15 -0400
   4 Subject: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
   5 To: stable@vger.kernel.org
   6 Cc: Yuan Chen <chenyuan@kylinos.cn>, "Masami Hiramatsu (Google)" <mhiramat@kernel.org>, Sasha Levin <sashal@kernel.org>
   7 Message-ID: <20251014001915.3749537-1-sashal@kernel.org>
   8
   9 From: Yuan Chen <chenyuan@kylinos.cn>
  10
  11 [ Upstream commit 9cf9aa7b0acfde7545c1a1d912576e9bab28dc6f ]
  12
  13 There is a critical race condition in kprobe initialization that can lead to
  14 NULL pointer dereference and kernel crash.
  15
  16 [1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000
  17 ...
  18 [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO)
  19 [1135630.269239] pc : kprobe_perf_func+0x30/0x260
  20 [1135630.277643] lr : kprobe_dispatcher+0x44/0x60
  21 [1135630.286041] sp : ffffaeff4977fa40
  22 [1135630.293441] x29: ffffaeff4977fa40 x28: ffffaf015340e400
  23 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000
  24 [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528
  25 [1135630.321705] x23: ffffaeff4977fc50 x22: ffffaeff4977fc50
  26 [1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50
  27 [1135630.340586] x19: ffffaf015340e400 x18: 0000000000000000
  28 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000
  29 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000
  30 [1135630.368445] x13: 0000000000000000 x12: 0000000000000000
  31 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000
  32 [1135630.386411] x9 : 0000000000000000 x8 : 0000000000000000
  33 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000
  34 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000
  35 [1135630.412545] x3 : 0000710a04630000 x2 : 0000000000000006
  36 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000
  37 [1135630.429410] Call trace:
  38 [1135630.434828]  kprobe_perf_func+0x30/0x260
  39 [1135630.441661]  kprobe_dispatcher+0x44/0x60
  40 [1135630.448396]  aggr_pre_handler+0x70/0xc8
  41 [1135630.454959]  kprobe_breakpoint_handler+0x140/0x1e0
  42 [1135630.462435]  brk_handler+0xbc/0xd8
  43 [1135630.468437]  do_debug_exception+0x84/0x138
  44 [1135630.475074]  el1_dbg+0x18/0x8c
  45 [1135630.480582]  security_file_permission+0x0/0xd0
  46 [1135630.487426]  vfs_write+0x70/0x1c0
  47 [1135630.493059]  ksys_write+0x5c/0xc8
  48 [1135630.498638]  __arm64_sys_write+0x24/0x30
  49 [1135630.504821]  el0_svc_common+0x78/0x130
  50 [1135630.510838]  el0_svc_handler+0x38/0x78
  51 [1135630.516834]  el0_svc+0x8/0x1b0
  52
  53 kernel/trace/trace_kprobe.c: 1308
  54 0xffff3df8995039ec <kprobe_perf_func+0x2c>:     ldr     x21, [x24,#120]
  55 include/linux/compiler.h: 294
  56 0xffff3df8995039f0 <kprobe_perf_func+0x30>:     ldr     x1, [x21,x0]
  57
  58 kernel/trace/trace_kprobe.c
  59 1308: head = this_cpu_ptr(call->perf_events);
  60 1309: if (hlist_empty(head))
  61 1310:   return 0;
  62
  63 crash> struct trace_event_call -o
  64 struct trace_event_call {
  65   ...
  66   [120] struct hlist_head *perf_events;  //(call->perf_event)
  67   ...
  68 }
  69
  70 crash> struct trace_event_call ffffaf015340e528
  71 struct trace_event_call {
  72   ...
  73   perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0
  74   ...
  75 }
  76
  77 Race Condition Analysis:
  78
  79 The race occurs between kprobe activation and perf_events initialization:
  80
  81   CPU0                                    CPU1
  82   ====                                    ====
  83   perf_kprobe_init
  84     perf_trace_event_init
  85       tp_event->perf_events = list;(1)
  86       tp_event->class->reg (2)← KPROBE ACTIVE
  87                                           Debug exception triggers
  88                                           ...
  89                                           kprobe_dispatcher
  90                                             kprobe_perf_func (tk->tp.flags & TP_FLAG_PROFILE)
  91                                               head = this_cpu_ptr(call->perf_events)(3)
  92                                               (perf_events is still NULL)
  93
  94 Problem:
  95 1. CPU0 executes (1) assigning tp_event->perf_events = list
  96 2. CPU0 executes (2) enabling kprobe functionality via class->reg()
  97 3. CPU1 triggers and reaches kprobe_dispatcher
  98 4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed)
  99 5. CPU1 calls kprobe_perf_func() and crashes at (3) because
 100    call->perf_events is still NULL
 101
 102 CPU1 sees that kprobe functionality is enabled but does not see that
 103 perf_events has been assigned.
 104
 105 Add pairing read and write memory barriers to guarantee that if CPU1
 106 sees that kprobe functionality is enabled, it must also see that
 107 perf_events has been assigned.
 108
 109 Link: https://lore.kernel.org/all/20251001022025.44626-1-chenyuan_fl@163.com/
 110
 111 Fixes: 50d780560785 ("tracing/kprobes: Add probe handler dispatcher to support perf and ftrace concurrent use")
 112 Cc: stable@vger.kernel.org
 113 Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
 114 Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
 115 [ Adjust context ]
 116 Signed-off-by: Sasha Levin <sashal@kernel.org>
 117 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 118 ---
 119  kernel/trace/trace_fprobe.c |   11 +++++++----
 120  kernel/trace/trace_kprobe.c |   11 +++++++----
 121  kernel/trace/trace_probe.h  |    9 +++++++--
 122  kernel/trace/trace_uprobe.c |   12 ++++++++----
 123  4 files changed, 29 insertions(+), 14 deletions(-)
 124
 125 --- a/kernel/trace/trace_fprobe.c
 126 +++ b/kernel/trace/trace_fprobe.c
 127 @@ -343,12 +343,14 @@ static int fentry_dispatcher(struct fpro
 128                              void *entry_data)
 129  {
 130         struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp);
 131 +       unsigned int flags = trace_probe_load_flag(&tf->tp);
 132         int ret = 0;
 133
 134 -       if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE))
 135 +       if (flags & TP_FLAG_TRACE)
 136                 fentry_trace_func(tf, entry_ip, regs);
 137 +
 138  #ifdef CONFIG_PERF_EVENTS
 139 -       if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE))
 140 +       if (flags & TP_FLAG_PROFILE)
 141                 ret = fentry_perf_func(tf, entry_ip, regs);
 142  #endif
 143         return ret;
 144 @@ -360,11 +362,12 @@ static void fexit_dispatcher(struct fpro
 145                              void *entry_data)
 146  {
 147         struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp);
 148 +       unsigned int flags = trace_probe_load_flag(&tf->tp);
 149
 150 -       if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE))
 151 +       if (flags & TP_FLAG_TRACE)
 152                 fexit_trace_func(tf, entry_ip, ret_ip, regs, entry_data);
 153  #ifdef CONFIG_PERF_EVENTS
 154 -       if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE))
 155 +       if (flags & TP_FLAG_PROFILE)
 156                 fexit_perf_func(tf, entry_ip, ret_ip, regs, entry_data);
 157  #endif
 158  }
 159 --- a/kernel/trace/trace_kprobe.c
 160 +++ b/kernel/trace/trace_kprobe.c
 161 @@ -1799,14 +1799,15 @@ static int kprobe_register(struct trace_
 162  static int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs)
 163  {
 164         struct trace_kprobe *tk = container_of(kp, struct trace_kprobe, rp.kp);
 165 +       unsigned int flags = trace_probe_load_flag(&tk->tp);
 166         int ret = 0;
 167
 168         raw_cpu_inc(*tk->nhit);
 169
 170 -       if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE))
 171 +       if (flags & TP_FLAG_TRACE)
 172                 kprobe_trace_func(tk, regs);
 173  #ifdef CONFIG_PERF_EVENTS
 174 -       if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE))
 175 +       if (flags & TP_FLAG_PROFILE)
 176                 ret = kprobe_perf_func(tk, regs);
 177  #endif
 178         return ret;
 179 @@ -1818,6 +1819,7 @@ kretprobe_dispatcher(struct kretprobe_in
 180  {
 181         struct kretprobe *rp = get_kretprobe(ri);
 182         struct trace_kprobe *tk;
 183 +       unsigned int flags;
 184
 185         /*
 186          * There is a small chance that get_kretprobe(ri) returns NULL when
 187 @@ -1830,10 +1832,11 @@ kretprobe_dispatcher(struct kretprobe_in
 188         tk = container_of(rp, struct trace_kprobe, rp);
 189         raw_cpu_inc(*tk->nhit);
 190
 191 -       if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE))
 192 +       flags = trace_probe_load_flag(&tk->tp);
 193 +       if (flags & TP_FLAG_TRACE)
 194                 kretprobe_trace_func(tk, ri, regs);
 195  #ifdef CONFIG_PERF_EVENTS
 196 -       if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE))
 197 +       if (flags & TP_FLAG_PROFILE)
 198                 kretprobe_perf_func(tk, ri, regs);
 199  #endif
 200         return 0;       /* We don't tweak kernel, so just return 0 */
 201 --- a/kernel/trace/trace_probe.h
 202 +++ b/kernel/trace/trace_probe.h
 203 @@ -269,16 +269,21 @@ struct event_file_link {
 204         struct list_head                list;
 205  };
 206
 207 +static inline unsigned int trace_probe_load_flag(struct trace_probe *tp)
 208 +{
 209 +       return smp_load_acquire(&tp->event->flags);
 210 +}
 211 +
 212  static inline bool trace_probe_test_flag(struct trace_probe *tp,
 213                                          unsigned int flag)
 214  {
 215 -       return !!(tp->event->flags & flag);
 216 +       return !!(trace_probe_load_flag(tp) & flag);
 217  }
 218
 219  static inline void trace_probe_set_flag(struct trace_probe *tp,
 220                                         unsigned int flag)
 221  {
 222 -       tp->event->flags |= flag;
 223 +       smp_store_release(&tp->event->flags, tp->event->flags | flag);
 224  }
 225
 226  static inline void trace_probe_clear_flag(struct trace_probe *tp,
 227 --- a/kernel/trace/trace_uprobe.c
 228 +++ b/kernel/trace/trace_uprobe.c
 229 @@ -1531,6 +1531,7 @@ static int uprobe_dispatcher(struct upro
 230         struct trace_uprobe *tu;
 231         struct uprobe_dispatch_data udd;
 232         struct uprobe_cpu_buffer *ucb = NULL;
 233 +       unsigned int flags;
 234         int ret = 0;
 235
 236         tu = container_of(con, struct trace_uprobe, consumer);
 237 @@ -1545,11 +1546,12 @@ static int uprobe_dispatcher(struct upro
 238         if (WARN_ON_ONCE(!uprobe_cpu_buffer))
 239                 return 0;
 240
 241 -       if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
 242 +       flags = trace_probe_load_flag(&tu->tp);
 243 +       if (flags & TP_FLAG_TRACE)
 244                 ret |= uprobe_trace_func(tu, regs, &ucb);
 245
 246  #ifdef CONFIG_PERF_EVENTS
 247 -       if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE))
 248 +       if (flags & TP_FLAG_PROFILE)
 249                 ret |= uprobe_perf_func(tu, regs, &ucb);
 250  #endif
 251         uprobe_buffer_put(ucb);
 252 @@ -1562,6 +1564,7 @@ static int uretprobe_dispatcher(struct u
 253         struct trace_uprobe *tu;
 254         struct uprobe_dispatch_data udd;
 255         struct uprobe_cpu_buffer *ucb = NULL;
 256 +       unsigned int flags;
 257
 258         tu = container_of(con, struct trace_uprobe, consumer);
 259
 260 @@ -1573,11 +1576,12 @@ static int uretprobe_dispatcher(struct u
 261         if (WARN_ON_ONCE(!uprobe_cpu_buffer))
 262                 return 0;
 263
 264 -       if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
 265 +       flags = trace_probe_load_flag(&tu->tp);
 266 +       if (flags & TP_FLAG_TRACE)
 267                 uretprobe_trace_func(tu, func, regs, &ucb);
 268
 269  #ifdef CONFIG_PERF_EVENTS
 270 -       if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE))
 271 +       if (flags & TP_FLAG_PROFILE)
 272                 uretprobe_perf_func(tu, func, regs, &ucb);
 273  #endif
 274         uprobe_buffer_put(ucb);