linux-kernel - Re: [PATCH] tracing/fprobe: Fix to check whether fprobe is registered correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221024102230.6b02c978@gandalf.local.home>
Date:   Mon, 24 Oct 2022 10:22:30 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     "Masami Hiramatsu (Google)" <mhiramat@...nel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>,
        Jiri Olsa <jolsa@...nel.org>
Subject: Re: [PATCH] tracing/fprobe: Fix to check whether fprobe is
 registered correctly

On Sun, 23 Oct 2022 23:19:33 +0900
"Masami Hiramatsu (Google)" <mhiramat@...nel.org> wrote:

> From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
> 
> Since commit ab51e15d535e ("fprobe: Introduce FPROBE_FL_KPROBE_SHARED flag
> for fprobe") introduced fprobe_kprobe_handler() for fprobe::f_op::func,
> unregister_fprobe() fails to unregister the registered if user specifies
> FPROBE_FL_KPROBE_SHARED flag.
> To check it correctly, it should confirm the fprobe::f_op::func is either
> fprobe_handler() or fprobe_kprobe_handler().
> 
> Fixes: ab51e15d535e ("fprobe: Introduce FPROBE_FL_KPROBE_SHARED flag for fprobe")
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@...nel.org>
> ---
>  kernel/trace/fprobe.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
> index aac63ca9c3d1..9000d8ea6274 100644
> --- a/kernel/trace/fprobe.c
> +++ b/kernel/trace/fprobe.c
> @@ -301,7 +301,8 @@ int unregister_fprobe(struct fprobe *fp)
>  {
>  	int ret;
>  
> -	if (!fp || fp->ops.func != fprobe_handler)
> +	if (!fp || (fp->ops.func != fprobe_handler &&
> +		    fp->ops.func != fprobe_kprobe_handler))
>  		return -EINVAL;
>  
>  	/*

Should we make this more paranoid?

	if (!fp ||
	    (fprobe_shared_with_kprobes(fp) && fp->ops.func != fprobe_kprobe_handler) ||
	    (!fprobe_shared_with_kprobes(fp) && fp->ops.func != fprobe_handler))

Or is that over-kill?

-- Steve