Hi Jiri,
On Thu, 15 Jun 2023 13:52:36 +0200
Jiri Olsa <jolsa@xxxxxxxxxx> wrote:
> While running bpf selftests it's possible to get following fault:
>
> general protection fault, probably for non-canonical address \
> 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI
> ...
> Call Trace:
> <TASK>
> fprobe_handler+0xc1/0x270
> ? __pfx_bpf_testmod_init+0x10/0x10
> ? __pfx_bpf_testmod_init+0x10/0x10
> ? bpf_fentry_test1+0x5/0x10
> ? bpf_fentry_test1+0x5/0x10
> ? bpf_testmod_init+0x22/0x80
> ? do_one_initcall+0x63/0x2e0
> ? rcu_is_watching+0xd/0x40
> ? kmalloc_trace+0xaf/0xc0
> ? do_init_module+0x60/0x250
> ? __do_sys_finit_module+0xac/0x120
> ? do_syscall_64+0x37/0x90
> ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
> </TASK>
>
> In unregister_fprobe function we can't release fp->rethook while it's
> possible there are some of its users still running on another cpu.
Ah, OK. rethook_free() invoked call_rcu(rethook_free_rcu) to free the
rethook, and it is possible rethook_free_rcu() is called before disabling
all fprobe, then `rethook_try_get(fp->rethook)` will access fp->rethook
which has been freed.
>
> Moving rethook_free call after fp->ops is unregistered with
> unregister_ftrace_function call.
>
> Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support")
> Reviewed-by: Steven Rostedt (Google) <rostedt@xxxxxxxxxxx>
> Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
Acked-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
Thank you!
> ---
> kernel/trace/fprobe.c | 12 +++---------
> 1 file changed, 3 insertions(+), 9 deletions(-)
>
> diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
> index 18d36842faf5..0121e8c0d54e 100644
> --- a/kernel/trace/fprobe.c
> +++ b/kernel/trace/fprobe.c
> @@ -364,19 +364,13 @@ int unregister_fprobe(struct fprobe *fp)
> fp->ops.saved_func != fprobe_kprobe_handler))
> return -EINVAL;
>
> - /*
> - * rethook_free() starts disabling the rethook, but the rethook handlers
> - * may be running on other processors at this point. To make sure that all
> - * current running handlers are finished, call unregister_ftrace_function()
> - * after this.
> - */
> - if (fp->rethook)
> - rethook_free(fp->rethook);
> -
> ret = unregister_ftrace_function(&fp->ops);
> if (ret < 0)
> return ret;
>
> + if (fp->rethook)
> + rethook_free(fp->rethook);
> +
> ftrace_free_filter(&fp->ops);
>
> return ret;
> --
> 2.40.1
>
--
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
