qiurui/Centos-kernel-stream-10
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git synced 2026-09-09 00:07:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

tracing: Fix race condition in kprobe initialization causing NULL pointer dereference

Browse Source 
JIRA: https://issues.redhat.com/browse/RHEL-151695

CVE: CVE-2025-40042

Conflicts: Context change from missing commit 0566cefe73b9a
("tracing/fprobe: Enable fprobe events with
CONFIG_DYNAMIC_FTRACE_WITH_ARGS")

commit 9cf9aa7b0acfde7545c1a1d912576e9bab28dc6f
Author: Yuan Chen <chenyuan@kylinos.cn>
Date:   Wed Oct 1 03:20:25 2025 +0100

    tracing: Fix race condition in kprobe initialization causing NULL pointer dereference

    There is a critical race condition in kprobe initialization that can lead to
    NULL pointer dereference and kernel crash.

    [1135630.084782] Unable to handle kernel paging request at virtual address 0000710a04630000
    ...
    [1135630.260314] pstate: 404003c9 (nZcv DAIF +PAN -UAO)
    [1135630.269239] pc : kprobe_perf_func+0x30/0x260
    [1135630.277643] lr : kprobe_dispatcher+0x44/0x60
    [1135630.286041] sp : ffffaeff4977fa40
    [1135630.293441] x29: ffffaeff4977fa40 x28: ffffaf015340e400
    [1135630.302837] x27: 0000000000000000 x26: 0000000000000000
    [1135630.312257] x25: ffffaf029ed108a8 x24: ffffaf015340e528
    [1135630.321705] x23: ffffaeff4977fc50 x22: ffffaeff4977fc50
    [1135630.331154] x21: 0000000000000000 x20: ffffaeff4977fc50
    [1135630.340586] x19: ffffaf015340e400 x18: 0000000000000000
    [1135630.349985] x17: 0000000000000000 x16: 0000000000000000
    [1135630.359285] x15: 0000000000000000 x14: 0000000000000000
    [1135630.368445] x13: 0000000000000000 x12: 0000000000000000
    [1135630.377473] x11: 0000000000000000 x10: 0000000000000000
    [1135630.386411] x9 : 0000000000000000 x8 : 0000000000000000
    [1135630.395252] x7 : 0000000000000000 x6 : 0000000000000000
    [1135630.403963] x5 : 0000000000000000 x4 : 0000000000000000
    [1135630.412545] x3 : 0000710a04630000 x2 : 0000000000000006
    [1135630.421021] x1 : ffffaeff4977fc50 x0 : 0000710a04630000
    [1135630.429410] Call trace:
    [1135630.434828]  kprobe_perf_func+0x30/0x260
    [1135630.441661]  kprobe_dispatcher+0x44/0x60
    [1135630.448396]  aggr_pre_handler+0x70/0xc8
    [1135630.454959]  kprobe_breakpoint_handler+0x140/0x1e0
    [1135630.462435]  brk_handler+0xbc/0xd8
    [1135630.468437]  do_debug_exception+0x84/0x138
    [1135630.475074]  el1_dbg+0x18/0x8c
    [1135630.480582]  security_file_permission+0x0/0xd0
    [1135630.487426]  vfs_write+0x70/0x1c0
    [1135630.493059]  ksys_write+0x5c/0xc8
    [1135630.498638]  __arm64_sys_write+0x24/0x30
    [1135630.504821]  el0_svc_common+0x78/0x130
    [1135630.510838]  el0_svc_handler+0x38/0x78
    [1135630.516834]  el0_svc+0x8/0x1b0

    kernel/trace/trace_kprobe.c: 1308
    0xffff3df8995039ec <kprobe_perf_func+0x2c>:     ldr     x21, [x24,#120]
    include/linux/compiler.h: 294
    0xffff3df8995039f0 <kprobe_perf_func+0x30>:     ldr     x1, [x21,x0]

    kernel/trace/trace_kprobe.c
    1308: head = this_cpu_ptr(call->perf_events);
    1309: if (hlist_empty(head))
    1310: 	return 0;

    crash> struct trace_event_call -o
    struct trace_event_call {
      ...
      [120] struct hlist_head *perf_events;  //(call->perf_event)
      ...
    }

    crash> struct trace_event_call ffffaf015340e528
    struct trace_event_call {
      ...
      perf_events = 0xffff0ad5fa89f088, //this value is correct, but x21 = 0
      ...
    }

    Race Condition Analysis:

    The race occurs between kprobe activation and perf_events initialization:

      CPU0                                    CPU1
      ====                                    ====
      perf_kprobe_init
        perf_trace_event_init
          tp_event->perf_events = list;(1)
          tp_event->class->reg (2)← KPROBE ACTIVE
                                              Debug exception triggers
                                              ...
                                              kprobe_dispatcher
                                                kprobe_perf_func (tk->tp.flags & TP_FLAG_PROFILE)
                                                  head = this_cpu_ptr(call->perf_events)(3)
                                                  (perf_events is still NULL)

    Problem:
    1. CPU0 executes (1) assigning tp_event->perf_events = list
    2. CPU0 executes (2) enabling kprobe functionality via class->reg()
    3. CPU1 triggers and reaches kprobe_dispatcher
    4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed)
    5. CPU1 calls kprobe_perf_func() and crashes at (3) because
       call->perf_events is still NULL

    CPU1 sees that kprobe functionality is enabled but does not see that
    perf_events has been assigned.

    Add pairing read and write memory barriers to guarantee that if CPU1
    sees that kprobe functionality is enabled, it must also see that
    perf_events has been assigned.

    Link: https://lore.kernel.org/all/20251001022025.44626-1-chenyuan_fl@163.com/

    Fixes: 50d7805607 ("tracing/kprobes: Add probe handler dispatcher to support perf and ftrace concurrent use")
    Cc: stable@vger.kernel.org
    Signed-off-by: Yuan Chen <chenyuan@kylinos.cn>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
This commit is contained in:
Jerome Marchand
2026-03-06 09:25:55 +01:00
parent 69233ab08d
commit ed74fd87d3
4 changed files with 29 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/trace/trace_fprobe.c
+7 -4
View File
@@ -343,12 +343,14 @@ static int fentry_dispatcher(struct fprobe *fp, unsigned long entry_ip,
void *entry_data)
{
struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp);
unsigned int flags = trace_probe_load_flag(&tf->tp);
int ret = 0;
if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE))
if (flags & TP_FLAG_TRACE)
fentry_trace_func(tf, entry_ip, regs);
#ifdef CONFIG_PERF_EVENTS
if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE))
if (flags & TP_FLAG_PROFILE)
ret = fentry_perf_func(tf, entry_ip, regs);
#endif
return ret;
@@ -360,11 +362,12 @@ static void fexit_dispatcher(struct fprobe *fp, unsigned long entry_ip,
void *entry_data)
{
struct trace_fprobe *tf = container_of(fp, struct trace_fprobe, fp);
unsigned int flags = trace_probe_load_flag(&tf->tp);
if (trace_probe_test_flag(&tf->tp, TP_FLAG_TRACE))
if (flags & TP_FLAG_TRACE)
fexit_trace_func(tf, entry_ip, ret_ip, regs, entry_data);
#ifdef CONFIG_PERF_EVENTS
if (trace_probe_test_flag(&tf->tp, TP_FLAG_PROFILE))
if (flags & TP_FLAG_PROFILE)
fexit_perf_func(tf, entry_ip, ret_ip, regs, entry_data);
#endif
}
kernel/trace/trace_kprobe.c
+7 -4
View File
@@ -1801,14 +1801,15 @@ static int kprobe_register(struct trace_event_call *event,
static int kprobe_dispatcher(struct kprobe *kp, struct pt_regs *regs)
{
struct trace_kprobe *tk = container_of(kp, struct trace_kprobe, rp.kp);
unsigned int flags = trace_probe_load_flag(&tk->tp);
int ret = 0;
raw_cpu_inc(*tk->nhit);
if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE))
if (flags & TP_FLAG_TRACE)
kprobe_trace_func(tk, regs);
#ifdef CONFIG_PERF_EVENTS
if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE))
if (flags & TP_FLAG_PROFILE)
ret = kprobe_perf_func(tk, regs);
#endif
return ret;
@@ -1820,6 +1821,7 @@ kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs)
{
struct kretprobe *rp = get_kretprobe(ri);
struct trace_kprobe *tk;
unsigned int flags;
/*
* There is a small chance that get_kretprobe(ri) returns NULL when
@@ -1832,10 +1834,11 @@ kretprobe_dispatcher(struct kretprobe_instance *ri, struct pt_regs *regs)
tk = container_of(rp, struct trace_kprobe, rp);
raw_cpu_inc(*tk->nhit);
if (trace_probe_test_flag(&tk->tp, TP_FLAG_TRACE))
flags = trace_probe_load_flag(&tk->tp);
if (flags & TP_FLAG_TRACE)
kretprobe_trace_func(tk, ri, regs);
#ifdef CONFIG_PERF_EVENTS
if (trace_probe_test_flag(&tk->tp, TP_FLAG_PROFILE))
if (flags & TP_FLAG_PROFILE)
kretprobe_perf_func(tk, ri, regs);
#endif
return 0; /* We don't tweak kernel, so just return 0 */
kernel/trace/trace_probe.h
+7 -2
View File
@@ -269,16 +269,21 @@ struct event_file_link {
struct list_head list;
};
static inline unsigned int trace_probe_load_flag(struct trace_probe *tp)
{
return smp_load_acquire(&tp->event->flags);
}
static inline bool trace_probe_test_flag(struct trace_probe *tp,
unsigned int flag)
{
return !!(tp->event->flags & flag);
return !!(trace_probe_load_flag(tp) & flag);
}
static inline void trace_probe_set_flag(struct trace_probe *tp,
unsigned int flag)
{
tp->event->flags |= flag;
smp_store_release(&tp->event->flags, tp->event->flags | flag);
}
static inline void trace_probe_clear_flag(struct trace_probe *tp,
kernel/trace/trace_uprobe.c
+8 -4
View File
@@ -1534,6 +1534,7 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs,
struct trace_uprobe *tu;
struct uprobe_dispatch_data udd;
struct uprobe_cpu_buffer *ucb = NULL;
unsigned int flags;
int ret = 0;
tu = container_of(con, struct trace_uprobe, consumer);
@@ -1548,11 +1549,12 @@ static int uprobe_dispatcher(struct uprobe_consumer *con, struct pt_regs *regs,
if (WARN_ON_ONCE(!uprobe_cpu_buffer))
return 0;
if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
flags = trace_probe_load_flag(&tu->tp);
if (flags & TP_FLAG_TRACE)
ret |= uprobe_trace_func(tu, regs, &ucb);
#ifdef CONFIG_PERF_EVENTS
if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE))
if (flags & TP_FLAG_PROFILE)
ret |= uprobe_perf_func(tu, regs, &ucb);
#endif
uprobe_buffer_put(ucb);
@@ -1566,6 +1568,7 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con,
struct trace_uprobe *tu;
struct uprobe_dispatch_data udd;
struct uprobe_cpu_buffer *ucb = NULL;
unsigned int flags;
tu = container_of(con, struct trace_uprobe, consumer);
@@ -1577,11 +1580,12 @@ static int uretprobe_dispatcher(struct uprobe_consumer *con,
if (WARN_ON_ONCE(!uprobe_cpu_buffer))
return 0;
if (trace_probe_test_flag(&tu->tp, TP_FLAG_TRACE))
flags = trace_probe_load_flag(&tu->tp);
if (flags & TP_FLAG_TRACE)
uretprobe_trace_func(tu, func, regs, &ucb);
#ifdef CONFIG_PERF_EVENTS
if (trace_probe_test_flag(&tu->tp, TP_FLAG_PROFILE))
if (flags & TP_FLAG_PROFILE)
uretprobe_perf_func(tu, func, regs, &ucb);
#endif
uprobe_buffer_put(ucb);