android/android_kernel_samsung_sm8650
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
c3b0f72e80
android_kernel_samsung_sm8650/kernel/trace
History
Yang Jihong c3b0f72e80 ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead 
ftrace_startup does not remove ops from ftrace_ops_list when
ftrace_startup_enable fails:

register_ftrace_function
  ftrace_startup
    __register_ftrace_function
      ...
      add_ftrace_ops(&ftrace_ops_list, ops)
      ...
    ...
    ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1
    ...
  return 0 // ops is in the ftrace_ops_list.

When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:
unregister_ftrace_function
  ftrace_shutdown
    if (unlikely(ftrace_disabled))
            return -ENODEV;  // return here, __unregister_ftrace_function is not executed,
                             // as a result, ops is still in the ftrace_ops_list
    __unregister_ftrace_function
    ...

If ops is dynamically allocated, it will be free later, in this case,
is_ftrace_trampoline accesses NULL pointer:

is_ftrace_trampoline
  ftrace_ops_trampoline
    do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!

Syzkaller reports as follows:
[ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b
[ 1203.508039] #PF: supervisor read access in kernel mode
[ 1203.508798] #PF: error_code(0x0000) - not-present page
[ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0
[ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI
[ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G    B   W         5.10.0 #8
[ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0
[ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00
[ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246
[ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866
[ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b
[ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07
[ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399
[ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008
[ 1203.525634] FS:  00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000
[ 1203.526801] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0
[ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Therefore, when ftrace_startup_enable fails, we need to rollback registration
process and remove ops from ftrace_ops_list.

Link: https://lkml.kernel.org/r/20220818032659.56209-1-yangjihong1@huawei.com

Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2022-08-21 15:56:07 -04:00
..
rv rv: Unlock on error path in rv_unregister_reactor() 2022-08-04 22:49:17 -04:00
blktrace.c block: serialize all debugfs operations using q->debugfs_mutex 2022-06-17 07:31:05 -06:00
bpf_trace.c bpf: Force cookies array to follow symbols sorting 2022-06-16 19:42:21 -07:00
bpf_trace.h bpf: Use dedicated bpf_trace_printk event instead of trace_printk() 2020-07-13 16:55:49 -07:00
error_report-traces.c tracing: add error_report_end trace point 2021-02-26 09:41:02 -08:00
fgraph.c arm64 fixes for 5.19-rc1: 2022-06-03 14:05:34 -07:00
fprobe.c fprobe: Resolve symbols with ftrace_lookup_symbols 2022-05-10 14:42:06 -07:00
ftrace_internal.h x86/ftrace: Have ftrace trampolines turn read-only at the end of system boot up 2020-05-12 18:24:34 -04:00
ftrace.c ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead 2022-08-21 15:56:07 -04:00
Kconfig rv: Add Runtime Verification (RV) interface 2022-07-30 14:01:28 -04:00
kprobe_event_gen_test.c tracing: Add kprobe event command generation test module 2020-01-30 09:46:28 -05:00
Makefile rv: Add Runtime Verification (RV) interface 2022-07-30 14:01:28 -04:00
pid_list.c tracing: Cleanup double word in comment 2022-04-26 17:58:50 -04:00
pid_list.h tracing: Create a sparse bitmask for pid filtering 2021-10-05 17:38:45 -04:00
power-traces.c
preemptirq_delay_test.c kernel: trace: preemptirq_delay_test: add cpu affinity 2021-02-02 17:02:07 -05:00
rethook.c rethook: Reject getting a rethook if RCU is not watching 2022-06-17 21:53:35 +02:00
ring_buffer_benchmark.c sched,tracing: Convert to sched_set_fifo() 2020-07-29 11:43:53 +02:00
ring_buffer.c ring-buffer: Have 32 bit time stamps use all 64 bits 2022-04-27 17:19:30 -04:00
rpm-traces.c
synth_event_gen_test.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_benchmark.c tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00
trace_benchmark.h
trace_boot.c tracing: Initialize integer variable to prevent garbage return value 2022-05-26 21:13:00 -04:00
trace_branch.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_clock.c tracing: Do no increment trace_clock_global() by one 2021-06-18 09:10:00 -04:00
trace_dynevent.c tracing: Auto generate event name when creating a group of events 2022-07-24 19:11:17 -04:00
trace_dynevent.h tracing: Add DYNAMIC flag for dynamic events 2021-08-18 18:10:32 -04:00
trace_entries.h trace: Add timerlat tracer 2021-06-25 19:57:24 -04:00
trace_eprobe.c tracing: React to error return from traceprobe_parse_event_name() 2022-08-21 15:56:07 -04:00
trace_event_perf.c tracing/perf: Fix double put of trace event when init fails 2022-08-21 15:56:07 -04:00
trace_events_filter_test.h
trace_events_filter.c tracing: Fix comments of create_filter() 2022-05-26 21:13:01 -04:00
trace_events_hist.c tracing/histograms: Simplify create_hist_fields() 2022-07-12 17:35:11 -04:00
trace_events_inject.c tracing: Support __rel_loc relative dynamic data location attribute 2021-12-06 15:37:21 -05:00
trace_events_synth.c tracing: Fix strncpy warning in trace_events_synth.c 2022-03-11 11:49:24 -05:00
trace_events_trigger.c tracing: Fix comments for event_trigger_separate_filter() 2022-05-26 22:03:52 -04:00
trace_events_user.c tracing/user_events: Fix syntax errors in comments 2022-07-12 17:35:11 -04:00
trace_events.c tracing updates for 5.19: 2022-05-29 10:31:36 -07:00
trace_export.c tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00
trace_functions_graph.c tracing: in_irq() cleanup 2021-10-13 18:19:41 -04:00
trace_functions.c ftrace: disable preemption when recursion locked 2021-10-27 11:21:49 -04:00
trace_hwlat.c trace/hwlat: make use of the helper function kthread_run_on_cpu() 2022-01-15 16:30:24 +02:00
trace_irqsoff.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_kdb.c kdb: Rename members of struct kdbtab_t 2021-07-27 17:05:06 +01:00
trace_kprobe_selftest.c
trace_kprobe_selftest.h
trace_kprobe.c tracing: Auto generate event name when creating a group of events 2022-07-24 19:11:17 -04:00
trace_mmiotrace.c tracing: Remove definition of DEBUG in trace_mmiotrace.c 2021-02-02 17:02:07 -05:00
trace_nop.c
trace_osnoise.c tracing updates for 5.19: 2022-05-29 10:31:36 -07:00
trace_output.c tracing: Remove usage of list iterator after the loop body 2022-04-27 17:19:30 -04:00
trace_output.h ftrace: Add recording of functions that caused recursion 2020-11-06 08:42:26 -05:00
trace_preemptirq.c lockdep: Fix -Wunused-parameter for _THIS_IP_ 2022-04-05 10:24:34 +02:00
trace_printk.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_probe_tmpl.h tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs 2021-08-19 09:09:03 -04:00
trace_probe.c tracing: Auto generate event name when creating a group of events 2022-07-24 19:11:17 -04:00
trace_probe.h tracing/eprobe: Show syntax error logs in error_log file 2022-08-02 15:22:55 -04:00
trace_recursion_record.c tracing: Use trace_create_file() to simplify creation of tracefs entries 2022-05-26 21:12:52 -04:00
trace_sched_switch.c sched/tracing: Append prev_state to tp args instead 2022-05-12 00:37:11 +02:00
trace_sched_wakeup.c sched/tracing: Append prev_state to tp args instead 2022-05-12 00:37:11 +02:00
trace_selftest_dynamic.c
trace_selftest.c tracing: Reset the function filter after completing trampoline/graph selftest 2022-05-25 16:57:37 -04:00
trace_seq.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_stack.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_stat.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_stat.h tracing: Use generic type for comparator function 2019-11-14 13:15:11 -05:00
trace_synth.h tracing: synth events: increase max fields count 2021-09-08 15:29:16 -04:00
trace_syscalls.c tracing: Make tp_printk work on syscall tracepoints 2022-04-26 17:58:52 -04:00
trace_uprobe.c tracing: Auto generate event name when creating a group of events 2022-07-24 19:11:17 -04:00
trace.c tracing: Use free_trace_buffer() in allocate_trace_buffers() 2022-08-02 15:13:19 -04:00
trace.h rv: Add Runtime Verification (RV) interface 2022-07-30 14:01:28 -04:00
tracing_map.c tracing: Fix tracing_map_sort_entries() kernel-doc comment 2022-04-26 17:58:51 -04:00
tracing_map.h tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00