uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline

In the unregister path we use __in_uprobe_trampoline check with
current->mm for the VMA lookup, which is wrong, because we are
in the tracer context, not the traced process.

Add mm_struct pointer argument to __in_uprobe_trampoline and
changing related callers to pass proper mm_struct pointer.

Fixes: ba2bfc97b462 ("uprobes/x86: Add support to optimize uprobes")
Reported-by: syzbot+61ce80689253f42e6d80@syzkaller.appspotmail.com
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Tested-by: syzbot+61ce80689253f42e6d80@syzkaller.appspotmail.com
Link: https://patch.msgid.link/20260701111337.53943-2-jolsa@kernel.org

diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index d74bb54543b608818b42c693042c236e74bd5ef9..3af979fb41d38d301ba62612c0c1fbd733e107cc 100644 (file)
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -761,9 +761,9 @@ void arch_uprobe_clear_state(struct mm_struct *mm)
                destroy_uprobe_trampoline(tramp);
 }
 
-static bool __in_uprobe_trampoline(unsigned long ip)
+static bool __in_uprobe_trampoline(struct mm_struct *mm, unsigned long ip)
 {
-       struct vm_area_struct *vma = vma_lookup(current->mm, ip);
+       struct vm_area_struct *vma = vma_lookup(mm, ip);
 
        return vma && vma_is_special_mapping(vma, &tramp_mapping);
 }
@@ -776,14 +776,14 @@ static bool in_uprobe_trampoline(unsigned long ip)
 
        rcu_read_lock();
        if (mmap_lock_speculate_try_begin(mm, &seq)) {
-               found = __in_uprobe_trampoline(ip);
+               found = __in_uprobe_trampoline(mm, ip);
                retry = mmap_lock_speculate_retry(mm, seq);
        }
        rcu_read_unlock();
 
        if (retry) {
                mmap_read_lock(mm);
-               found = __in_uprobe_trampoline(ip);
+               found = __in_uprobe_trampoline(mm, ip);
                mmap_read_unlock(mm);
        }
        return found;
@@ -1044,7 +1044,7 @@ static int copy_from_vaddr(struct mm_struct *mm, unsigned long vaddr, void *dst,
        return 0;
 }
 
-static bool __is_optimized(uprobe_opcode_t *insn, unsigned long vaddr)
+static bool __is_optimized(struct mm_struct *mm, uprobe_opcode_t *insn, unsigned long vaddr)
 {
        struct __packed __arch_relative_insn {
                u8 op;
@@ -1053,7 +1053,7 @@ static bool __is_optimized(uprobe_opcode_t *insn, unsigned long vaddr)
 
        if (!is_call_insn(insn))
                return false;
-       return __in_uprobe_trampoline(vaddr + 5 + call->raddr);
+       return __in_uprobe_trampoline(mm, vaddr + 5 + call->raddr);
 }
 
 static int is_optimized(struct mm_struct *mm, unsigned long vaddr)
@@ -1064,7 +1064,7 @@ static int is_optimized(struct mm_struct *mm, unsigned long vaddr)
        err = copy_from_vaddr(mm, vaddr, &insn, 5);
        if (err)
                return err;
-       return __is_optimized((uprobe_opcode_t *)&insn, vaddr);
+       return __is_optimized(mm, (uprobe_opcode_t *)&insn, vaddr);
 }
 
 static bool should_optimize(struct arch_uprobe *auprobe)