git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From stable+bounces-185655-greg=kroah.com@vger.kernel.org Tue Oct 14 15:00:35 2025
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Tue, 14 Oct 2025 09:00:26 -0400
   4 Subject: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
   5 To: stable@vger.kernel.org
   6 Cc: Yuan Chen <chenyuan@kylinos.cn>, "Masami Hiramatsu (Google)" <mhiramat@kernel.org>, Sasha Levin <sashal@kernel.org>
   7 Message-ID: <20251014130026.12319-1-sashal@kernel.org>
   8
   9 From: Yuan Chen <chenyuan@kylinos.cn>
  10
  11 [ Upstream commit 9cf9aa7b0acfde7545c1a1d912576e9bab28dc6f ]
  12
  13 There is a critical race condition in kprobe initialization that can lead to
  14 NULL pointer dereference and kernel crash.
  15
  16 [1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000
  17 ...
  18 [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO)
  19 [1135630.269239] pc : kprobe_perf_func+0x30/0x260
  20 [1135630.277643] lr : kprobe_dispatcher+0x44/0x60
  21 [1135630.286041] sp : ffffaeff4977fa40
  22 [1135630.293441] x29: ffffaeff4977fa40 x28: ffffaf015340e400
  23 [1135630.302837] x27: 0000000000000000 x26: 0000000000000000
  24 [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528
  25 [1135630.321705] x23: ffffaeff4977fc50 x22: ffffaeff4977fc50
  26 [1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50
  27 [1135630.340586] x19: ffffaf015340e400 x18: 0000000000000000
  28 [1135630.349985] x17: 0000000000000000 x16: 0000000000000000
  29 [1135630.359285] x15: 0000000000000000 x14: 0000000000000000
  30 [1135630.368445] x13: 0000000000000000 x12: 0000000000000000
  31 [1135630.377473] x11: 0000000000000000 x10: 0000000000000000
  32 [1135630.386411] x9 : 0000000000000000 x8 : 0000000000000000
  33 [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000
  34 [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000
  35 [1135630.412545] x3 : 0000710a04630000 x2 : 0000000000000006
  36 [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000
  37 [1135630.429410] Call trace:
  38 [1135630.434828]  kprobe_perf_func+0x30/0x260
  39 [1135630.441661]  kprobe_dispatcher+0x44/0x60
  40 [1135630.448396]  aggr_pre_handler+0x70/0xc8
  41 [1135630.454959]  kprobe_breakpoint_handler+0x140/0x1e0
  42 [1135630.462435]  brk_handler+0xbc/0xd8
  43 [1135630.468437]  do_debug_exception+0x84/0x138
  44 [1135630.475074]  el1_dbg+0x18/0x8c
  45 [1135630.480582]  security_file_permission+0x0/0xd0
  46 [1135630.487426]  vfs_write+0x70/0x1c0
  47 [1135630.493059]  ksys_write+0x5c/0xc8
  48 [1135630.498638]  __arm64_sys_write+0x24/0x30
  49 [1135630.504821]  el0_svc_common+0x78/0x130
  50 [1135630.510838]  el0_svc_handler+0x38/0x78
  51 [1135630.516834]  el0_svc+0x8/0x1b0
  52
  53 kernel/trace/trace_kprobe.c: 1308
  54 0xffff3df8995039ec <kprobe_perf_func+0x2c>:     ldr     x21, [x24,#120]
  55 include/linux/compiler.h: 294
  56 0xffff3df8995039f0 <kprobe_perf_func+0x30>:     ldr     x1, [x21,x0]
  57
  58 kernel/trace/trace_kprobe.c
  59 1308: head = this_cpu_ptr(call->perf_events);
  60 1309: if (hlist_empty(head))
  61 1310:   return 0;
  62
  63 crash> struct trace_event_call -o
  64 struct trace_event_call {
  65   ...
  66   [120] struct hlist_head *perf_events;  //(call->perf_event)
  67   ...
  68 }
  69
  70 crash> struct trace_event_call ffffaf015340e528
  71 struct trace_event_call {
  72   ...
  73   perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0
  74   ...
  75 }
  76
  77 Race Condition Analysis:
  78
  79 The race occurs between kprobe activation and perf_events initialization:
  80
  81   CPU0                                    CPU1
  82   ====                                    ====
  83   perf_kprobe_init
  84     perf_trace_event_init
  85       tp_event->perf_events = list;(1)
  86       tp_event->class->reg (2)← KPROBE ACTIVE
  87                                           Debug exception triggers
  88                                           ...
  89                                           kprobe_dispatcher
  90                                             kprobe_perf_func (tk->tp.flags & TP_FLAG_PROFILE)
  91                                               head = this_cpu_ptr(call->perf_events)(3)
  92                                               (perf_events is still NULL)
  93
  94 Problem:
  95 1. CPU0 executes (1) assigning tp_event->perf_events = list
  96 2. CPU0 executes (2) enabling kprobe functionality via class->reg()
  97 3. CPU1 triggers and reaches kprobe_dispatcher
  98 4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed)
  99 5. CPU1 calls kprobe_perf_func() and crashes at (3) because
 100    call->perf_events is still NULL
 101
 102 CPU1 sees that kprobe functionality is enabled but does not see that
 103 perf_events has been assigned.
 104
 105 Add pairing read and write memory barriers to guarantee that if CPU1
 106 sees that kprobe functionality is enabled, it must also see that
 107 perf_events has been assigned.
 108
 109 Link: https://lore.kernel.org/all/20251001022025.44626-1-chenyuan_fl@163.com/
 110
 111 Fixes: 50d780560785 ("tracing/kprobes: Add probe handler dispatcher to support perf and ftrace concurrent use")
 112 Cc: stable@vger.kernel.org
 113 Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
 114 Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
 115 [ Dropped ftrace changes + context ]
 116 Signed-off-by: Sasha Levin <sashal@kernel.org>
 117 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 118 ---
 119  kernel/trace/trace_kprobe.c |   11 +++++++----
 120  kernel/trace/trace_probe.h  |    9 +++++++--
 121  kernel/trace/trace_uprobe.c |   12 ++++++++----
 122  3 files changed, 22 insertions(+), 10 deletions(-)
 123
 124 --- a/kernel/trace/trace_kprobe.c
 125 +++ b/kernel/trace/trace_kprobe.c
 126 @@ -1585,14 +1585,15 @@ static int kprobe_register(struct trace_
 127  static int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs)
 128  {
 129         struct trace_kprobe *tk = container_of(kp, struct trace_kprobe, rp.kp);
 130 +       unsigned int flags = trace_probe_load_flag(&tk->tp);
 131         int ret = 0;
 132
 133         raw_cpu_inc(*tk->nhit);
 134
 135 -       if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE))
 136 +       if (flags & TP_FLAG_TRACE)
 137                 kprobe_trace_func(tk, regs);
 138  #ifdef CONFIG_PERF_EVENTS
 139 -       if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE))
 140 +       if (flags & TP_FLAG_PROFILE)
 141                 ret = kprobe_perf_func(tk, regs);
 142  #endif
 143         return ret;
 144 @@ -1603,13 +1604,15 @@ static int
 145  kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs)
 146  {
 147         struct trace_kprobe *tk = container_of(ri->rp, struct trace_kprobe, rp);
 148 +       unsigned int flags;
 149
 150         raw_cpu_inc(*tk->nhit);
 151
 152 -       if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE))
 153 +       flags = trace_probe_load_flag(&tk->tp);
 154 +       if (flags & TP_FLAG_TRACE)
 155                 kretprobe_trace_func(tk, ri, regs);
 156  #ifdef CONFIG_PERF_EVENTS
 157 -       if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE))
 158 +       if (flags & TP_FLAG_PROFILE)
 159                 kretprobe_perf_func(tk, ri, regs);
 160  #endif
 161         return 0;       /* We don't tweek kernel, so just return 0 */
 162 --- a/kernel/trace/trace_probe.h
 163 +++ b/kernel/trace/trace_probe.h
 164 @@ -252,16 +252,21 @@ struct event_file_link {
 165         struct list_head                list;
 166  };
 167
 168 +static inline unsigned int trace_probe_load_flag(struct trace_probe *tp)
 169 +{
 170 +       return smp_load_acquire(&tp->event->flags);
 171 +}
 172 +
 173  static inline bool trace_probe_test_flag(struct trace_probe *tp,
 174                                          unsigned int flag)
 175  {
 176 -       return !!(tp->event->flags & flag);
 177 +       return !!(trace_probe_load_flag(tp) & flag);
 178  }
 179
 180  static inline void trace_probe_set_flag(struct trace_probe *tp,
 181                                         unsigned int flag)
 182  {
 183 -       tp->event->flags |= flag;
 184 +       smp_store_release(&tp->event->flags, tp->event->flags | flag);
 185  }
 186
 187  static inline void trace_probe_clear_flag(struct trace_probe *tp,
 188 --- a/kernel/trace/trace_uprobe.c
 189 +++ b/kernel/trace/trace_uprobe.c
 190 @@ -1465,6 +1465,7 @@ static int uprobe_dispatcher(struct upro
 191         struct uprobe_dispatch_data udd;
 192         struct uprobe_cpu_buffer *ucb;
 193         int dsize, esize;
 194 +       unsigned int flags;
 195         int ret = 0;
 196
 197
 198 @@ -1485,11 +1486,12 @@ static int uprobe_dispatcher(struct upro
 199         ucb = uprobe_buffer_get();
 200         store_trace_args(ucb->buf, &tu->tp, regs, esize, dsize);
 201
 202 -       if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
 203 +       flags = trace_probe_load_flag(&tu->tp);
 204 +       if (flags & TP_FLAG_TRACE)
 205                 ret |= uprobe_trace_func(tu, regs, ucb, dsize);
 206
 207  #ifdef CONFIG_PERF_EVENTS
 208 -       if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE))
 209 +       if (flags & TP_FLAG_PROFILE)
 210                 ret |= uprobe_perf_func(tu, regs, ucb, dsize);
 211  #endif
 212         uprobe_buffer_put(ucb);
 213 @@ -1503,6 +1505,7 @@ static int uretprobe_dispatcher(struct u
 214         struct uprobe_dispatch_data udd;
 215         struct uprobe_cpu_buffer *ucb;
 216         int dsize, esize;
 217 +       unsigned int flags;
 218
 219         tu = container_of(con, struct trace_uprobe, consumer);
 220
 221 @@ -1520,11 +1523,12 @@ static int uretprobe_dispatcher(struct u
 222         ucb = uprobe_buffer_get();
 223         store_trace_args(ucb->buf, &tu->tp, regs, esize, dsize);
 224
 225 -       if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
 226 +       flags = trace_probe_load_flag(&tu->tp);
 227 +       if (flags & TP_FLAG_TRACE)
 228                 uretprobe_trace_func(tu, func, regs, ucb, dsize);
 229
 230  #ifdef CONFIG_PERF_EVENTS
 231 -       if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE))
 232 +       if (flags & TP_FLAG_PROFILE)
 233                 uretprobe_perf_func(tu, func, regs, ucb, dsize);
 234  #endif
 235         uprobe_buffer_put(ucb);