fbcd0c2b56
commit 195b9cb5b288fec1c871ef89f78cc9a7461aad3a upstream.
Ensure running fprobe_exit_handler() has finished before
calling rethook_free() in the unregister_fprobe() so that caller can free
the fprobe right after unregister_fprobe().
unregister_fprobe() ensured that all running fprobe_entry/exit_handler()
have finished by calling unregister_ftrace_function() which synchronizes
RCU. But commit 5f81018753df ("fprobe: Release rethook after the ftrace_ops
is unregistered") changed to call rethook_free() after
unregister_ftrace_function(). So call rethook_stop() to make rethook
disabled before unregister_ftrace_function() and ensure it again.
Here is the possible code flow that can call the exit handler after
unregister_fprobe().
------
CPU1 CPU2
call unregister_fprobe(fp)
...
__fprobe_handler()
rethook_hook() on probed function
unregister_ftrace_function()
return from probed function
rethook hooks
find rh->handler == fprobe_exit_handler
call fprobe_exit_handler()
rethook_free():
set rh->handler = NULL;
return from unreigster_fprobe;
call fp->exit_handler() <- (*)
------
(*) At this point, the exit handler is called after returning from
unregister_fprobe().
This fixes it as following;
------
CPU1 CPU2
call unregister_fprobe()
...
rethook_stop():
set rh->handler = NULL;
__fprobe_handler()
rethook_hook() on probed function
unregister_ftrace_function()
return from probed function
rethook hooks
find rh->handler == NULL
return from rethook
rethook_free()
return from unreigster_fprobe;
------
Link: https://lore.kernel.org/all/168873859949.156157.13039240432299335849.stgit@devnote2/
Fixes: 5f81018753df ("fprobe: Release rethook after the ftrace_ops is unregistered")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
101 lines
3.1 KiB
C
101 lines
3.1 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Return hooking with list-based shadow stack.
|
|
*/
|
|
#ifndef _LINUX_RETHOOK_H
|
|
#define _LINUX_RETHOOK_H
|
|
|
|
#include <linux/compiler.h>
|
|
#include <linux/freelist.h>
|
|
#include <linux/kallsyms.h>
|
|
#include <linux/llist.h>
|
|
#include <linux/rcupdate.h>
|
|
#include <linux/refcount.h>
|
|
|
|
struct rethook_node;
|
|
|
|
typedef void (*rethook_handler_t) (struct rethook_node *, void *, struct pt_regs *);
|
|
|
|
/**
|
|
* struct rethook - The rethook management data structure.
|
|
* @data: The user-defined data storage.
|
|
* @handler: The user-defined return hook handler.
|
|
* @pool: The pool of struct rethook_node.
|
|
* @ref: The reference counter.
|
|
* @rcu: The rcu_head for deferred freeing.
|
|
*
|
|
* Don't embed to another data structure, because this is a self-destructive
|
|
* data structure when all rethook_node are freed.
|
|
*/
|
|
struct rethook {
|
|
void *data;
|
|
rethook_handler_t handler;
|
|
struct freelist_head pool;
|
|
refcount_t ref;
|
|
struct rcu_head rcu;
|
|
};
|
|
|
|
/**
|
|
* struct rethook_node - The rethook shadow-stack entry node.
|
|
* @freelist: The freelist, linked to struct rethook::pool.
|
|
* @rcu: The rcu_head for deferred freeing.
|
|
* @llist: The llist, linked to a struct task_struct::rethooks.
|
|
* @rethook: The pointer to the struct rethook.
|
|
* @ret_addr: The storage for the real return address.
|
|
* @frame: The storage for the frame pointer.
|
|
*
|
|
* You can embed this to your extended data structure to store any data
|
|
* on each entry of the shadow stack.
|
|
*/
|
|
struct rethook_node {
|
|
union {
|
|
struct freelist_node freelist;
|
|
struct rcu_head rcu;
|
|
};
|
|
struct llist_node llist;
|
|
struct rethook *rethook;
|
|
unsigned long ret_addr;
|
|
unsigned long frame;
|
|
};
|
|
|
|
struct rethook *rethook_alloc(void *data, rethook_handler_t handler);
|
|
void rethook_stop(struct rethook *rh);
|
|
void rethook_free(struct rethook *rh);
|
|
void rethook_add_node(struct rethook *rh, struct rethook_node *node);
|
|
struct rethook_node *rethook_try_get(struct rethook *rh);
|
|
void rethook_recycle(struct rethook_node *node);
|
|
void rethook_hook(struct rethook_node *node, struct pt_regs *regs, bool mcount);
|
|
unsigned long rethook_find_ret_addr(struct task_struct *tsk, unsigned long frame,
|
|
struct llist_node **cur);
|
|
|
|
/* Arch dependent code must implement arch_* and trampoline code */
|
|
void arch_rethook_prepare(struct rethook_node *node, struct pt_regs *regs, bool mcount);
|
|
void arch_rethook_trampoline(void);
|
|
|
|
/**
|
|
* is_rethook_trampoline() - Check whether the address is rethook trampoline
|
|
* @addr: The address to be checked
|
|
*
|
|
* Return true if the @addr is the rethook trampoline address.
|
|
*/
|
|
static inline bool is_rethook_trampoline(unsigned long addr)
|
|
{
|
|
return addr == (unsigned long)dereference_symbol_descriptor(arch_rethook_trampoline);
|
|
}
|
|
|
|
/* If the architecture needs to fixup the return address, implement it. */
|
|
void arch_rethook_fixup_return(struct pt_regs *regs,
|
|
unsigned long correct_ret_addr);
|
|
|
|
/* Generic trampoline handler, arch code must prepare asm stub */
|
|
unsigned long rethook_trampoline_handler(struct pt_regs *regs,
|
|
unsigned long frame);
|
|
|
|
#ifdef CONFIG_RETHOOK
|
|
void rethook_flush_task(struct task_struct *tk);
|
|
#else
|
|
#define rethook_flush_task(tsk) do { } while (0)
|
|
#endif
|
|
|
|
#endif
|
|
|