ftrace: Protect direct_functions in update_ftrace_direct_mod

Fix accessing the __rcu pointer direct_functions with RCU protection.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260730150411.88667-4-leon.hwang@linux.dev
Fixes: e93672f770d7 ("ftrace: Add update_ftrace_direct_mod function")
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 9ea39110927fa92a08a6876430692960f36e306c..414e425c2d8042d8576608eca8d341bc110d54ba 100644 (file)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -6617,6 +6617,7 @@ int update_ftrace_direct_mod(struct ftrace_ops *ops, struct ftrace_hash *hash, b
                .func           = ftrace_stub,
                .flags          = FTRACE_OPS_FL_STUB,
        };
+       struct ftrace_hash *direct_hash;
        struct ftrace_hash *orig_hash;
        unsigned long size, i;
        int err = -EINVAL;
@@ -6627,8 +6628,6 @@ int update_ftrace_direct_mod(struct ftrace_ops *ops, struct ftrace_hash *hash, b
                return -EINVAL;
        if (!(ops->flags & FTRACE_OPS_FL_ENABLED))
                return -EINVAL;
-       if (direct_functions == EMPTY_HASH)
-               return -EINVAL;
 
        /*
         * We can be called from within ops_func callback with direct_mutex
@@ -6636,6 +6635,12 @@ int update_ftrace_direct_mod(struct ftrace_ops *ops, struct ftrace_hash *hash, b
         */
        if (do_direct_lock)
                mutex_lock(&direct_mutex);
+       else
+               lockdep_assert_held_once(&direct_mutex);
+
+       direct_hash = rcu_dereference_protected(direct_functions, lockdep_is_held(&direct_mutex));
+       if (direct_hash == EMPTY_HASH)
+               goto unlock;
 
        orig_hash = ops->func_hash ? ops->func_hash->filter_hash : NULL;
        if (!orig_hash)
@@ -6667,7 +6672,7 @@ int update_ftrace_direct_mod(struct ftrace_ops *ops, struct ftrace_hash *hash, b
        size = 1 << hash->size_bits;
        for (i = 0; i < size; i++) {
                hlist_for_each_entry(entry, &hash->buckets[i], hlist) {
-                       tmp = __ftrace_lookup_ip(direct_functions, entry->ip);
+                       tmp = __ftrace_lookup_ip(direct_hash, entry->ip);
                        if (!tmp)
                                continue;
                        tmp->direct = entry->direct;