Yang Jihong
dbd8c8fc60
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead
commit c3b0f72e805f0801f05fa2aa52011c4bfc694c44 upstream.
ftrace_startup does not remove ops from ftrace_ops_list when
ftrace_startup_enable fails:
register_ftrace_function
ftrace_startup
__register_ftrace_function
...
add_ftrace_ops(&ftrace_ops_list, ops)
...
...
ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1
...
return 0 // ops is in the ftrace_ops_list.
When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:
unregister_ftrace_function
ftrace_shutdown
if (unlikely(ftrace_disabled))
return -ENODEV; // return here, __unregister_ftrace_function is not executed,
// as a result, ops is still in the ftrace_ops_list
__unregister_ftrace_function
...
If ops is dynamically allocated, it will be free later, in this case,
is_ftrace_trampoline accesses NULL pointer:
is_ftrace_trampoline
ftrace_ops_trampoline
do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!
Syzkaller reports as follows:
[ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b
[ 1203.508039] #PF: supervisor read access in kernel mode
[ 1203.508798] #PF: error_code(0x0000) - not-present page
[ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0
[ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI
[ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8
[ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0
[ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00
[ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246
[ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866
[ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b
[ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07
[ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399
[ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008
[ 1203.525634] FS: 00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000
[ 1203.526801] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0
[ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Therefore, when ftrace_startup_enable fails, we need to rollback registration
process and remove ops from ftrace_ops_list.
Link: https://lkml.kernel.org/r/20220818032659.56209-1-yangjihong1@huawei.com
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-05 10:28:56 +02:00
..
2022-08-31 17:15:24 +02:00
2022-08-21 15:16:12 +02:00
2020-04-07 10:43:42 -07:00
2022-05-30 09:33:22 +02:00
2022-06-22 14:13:20 +02:00
2021-10-06 15:55:49 +02:00
2022-07-29 17:19:11 +02:00
2021-04-14 08:41:58 +02:00
2022-08-21 15:15:28 +02:00
2021-05-26 12:06:54 +02:00
2022-04-08 14:40:15 +02:00
2022-08-21 15:15:33 +02:00
2022-08-21 15:15:31 +02:00
2022-04-08 14:40:08 +02:00
2022-06-09 10:20:51 +02:00
2022-08-21 15:16:26 +02:00
2022-08-21 15:16:20 +02:00
2022-09-05 10:28:56 +02:00
2021-05-11 14:47:37 +02:00
2020-10-16 11:11:19 -07:00
2022-02-23 12:01:00 +01:00
2022-08-31 17:15:13 +02:00
2021-09-03 10:09:31 +02:00
2020-12-30 11:54:18 +01:00
2022-02-08 18:30:34 +01:00
2022-04-08 14:40:00 +02:00
2020-08-23 17:36:59 -05:00
2022-04-08 14:40:00 +02:00
2020-07-30 11:15:58 -07:00
2020-10-13 09:17:34 -07:00
2020-08-23 17:36:59 -05:00
2020-06-11 15:14:36 +02:00
2021-09-15 09:50:40 +02:00
2022-05-30 09:33:36 +02:00
2021-06-23 14:42:52 +02:00
2020-04-15 11:21:54 +02:00
2021-09-08 08:49:00 +02:00
2022-07-21 21:19:59 +02:00
2020-04-07 10:43:42 -07:00
2020-11-19 11:58:16 -08:00
2022-02-23 12:01:08 +01:00
2021-04-07 15:00:14 +02:00
2021-06-30 08:47:29 -04:00
2020-06-06 23:42:01 +09:00
2020-10-13 09:17:34 -07:00
2020-11-02 12:14:19 -08:00
2020-05-28 10:54:15 +02:00
2021-07-20 16:05:58 +02:00
2020-10-25 14:51:49 -07:00
2021-01-09 13:46:24 +01:00
2020-08-12 10:58:02 -07:00
2021-02-03 23:28:37 +01:00
2022-07-21 21:20:11 +02:00
2020-10-05 13:37:03 +02:00
2020-08-12 10:58:01 -07:00
2022-08-21 15:16:11 +02:00
2021-09-03 10:09:31 +02:00
2020-04-27 02:07:40 -04:00
2021-05-11 14:47:37 +02:00
2021-03-25 09:04:11 +01:00
2021-03-25 09:04:11 +01:00
2022-05-25 09:18:02 +02:00
2020-09-01 09:58:03 +02:00
2020-07-08 11:14:22 +02:00
2020-09-04 17:51:55 +10:00
2020-11-14 11:26:04 -08:00
2020-10-29 17:22:59 -05:00
2021-09-18 13:40:36 +02:00
2021-01-09 13:46:24 +01:00
2022-08-21 15:16:05 +02:00
2022-06-09 10:20:49 +02:00
2020-10-16 11:11:19 -07:00
2020-11-14 11:26:03 -08:00
2020-07-27 14:31:12 -04:00
2020-10-16 11:11:22 -07:00
2021-05-19 10:13:09 +02:00
2022-04-08 14:40:03 +02:00
2022-06-09 10:21:01 +02:00
2020-08-07 11:33:25 -07:00
2021-08-18 08:59:06 +02:00
2022-07-21 21:20:18 +02:00
2022-04-20 09:23:29 +02:00
2021-07-14 16:55:50 +02:00
2020-09-16 15:18:56 +02:00
2022-02-23 12:01:00 +01:00
2020-09-18 14:24:16 +01:00
2021-09-08 08:49:00 +02:00
2020-10-26 12:12:27 +01:00
2022-08-31 17:15:13 +02:00
2021-09-26 14:08:57 +02:00
2022-07-21 21:20:13 +02:00
2020-10-17 15:05:30 -06:00
2020-10-02 19:11:12 -07:00
2020-06-29 12:01:45 -07:00
2021-09-03 10:09:30 +02:00
2022-01-27 10:54:33 +01:00
2021-09-08 08:49:00 +02:00
2020-10-06 10:31:52 -07:00
2021-05-14 09:50:46 +02:00
2021-09-08 08:49:00 +02:00
2020-06-04 19:06:24 -07:00
2021-03-30 14:32:03 +02:00
2020-04-27 02:07:40 -04:00
2020-05-09 13:57:12 +02:00
2022-08-03 12:00:44 +02:00
2022-08-25 11:38:20 +02:00
2022-01-16 09:14:22 +01:00