Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

fprobe: Ensure running fprobe_exit_handler() finished before calling rethook_free()

Ensure running fprobe_exit_handler() has finished before
calling rethook_free() in the unregister_fprobe() so that caller can free
the fprobe right after unregister_fprobe().

unregister_fprobe() ensured that all running fprobe_entry/exit_handler()
have finished by calling unregister_ftrace_function() which synchronizes
RCU. But commit 5f81018753df ("fprobe: Release rethook after the ftrace_ops
is unregistered") changed to call rethook_free() after
unregister_ftrace_function(). So call rethook_stop() to make rethook
disabled before unregister_ftrace_function() and ensure it again.

Here is the possible code flow that can call the exit handler after
unregister_fprobe().

------
CPU1 CPU2
call unregister_fprobe(fp)
...
__fprobe_handler()
rethook_hook() on probed function
unregister_ftrace_function()
return from probed function
rethook hooks
find rh->handler == fprobe_exit_handler
call fprobe_exit_handler()
rethook_free():
set rh->handler = NULL;
return from unreigster_fprobe;
call fp->exit_handler() <- (*)
------

(*) At this point, the exit handler is called after returning from
unregister_fprobe().

This fixes it as following;
------
CPU1 CPU2
call unregister_fprobe()
...
rethook_stop():
set rh->handler = NULL;
__fprobe_handler()
rethook_hook() on probed function
unregister_ftrace_function()
return from probed function
rethook hooks
find rh->handler == NULL
return from rethook
rethook_free()
return from unreigster_fprobe;
------

Link: https://lore.kernel.org/all/168873859949.156157.13039240432299335849.stgit@devnote2/

Fixes: 5f81018753df ("fprobe: Release rethook after the ftrace_ops is unregistered")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>

+17
+1
include/linux/rethook.h
··· 59 59 }; 60 60 61 61 struct rethook *rethook_alloc(void *data, rethook_handler_t handler); 62 + void rethook_stop(struct rethook *rh); 62 63 void rethook_free(struct rethook *rh); 63 64 void rethook_add_node(struct rethook *rh, struct rethook_node *node); 64 65 struct rethook_node *rethook_try_get(struct rethook *rh);
+3
kernel/trace/fprobe.c
··· 366 366 fp->ops.saved_func != fprobe_kprobe_handler)) 367 367 return -EINVAL; 368 368 369 + if (fp->rethook) 370 + rethook_stop(fp->rethook); 371 + 369 372 ret = unregister_ftrace_function(&fp->ops); 370 373 if (ret < 0) 371 374 return ret;
+13
kernel/trace/rethook.c
··· 54 54 } 55 55 56 56 /** 57 + * rethook_stop() - Stop using a rethook. 58 + * @rh: the struct rethook to stop. 59 + * 60 + * Stop using a rethook to prepare for freeing it. If you want to wait for 61 + * all running rethook handler before calling rethook_free(), you need to 62 + * call this first and wait RCU, and call rethook_free(). 63 + */ 64 + void rethook_stop(struct rethook *rh) 65 + { 66 + WRITE_ONCE(rh->handler, NULL); 67 + } 68 + 69 + /** 57 70 * rethook_free() - Free struct rethook. 58 71 * @rh: the struct rethook to be freed. 59 72 *