linux-kernel - [tip: perf/core] uprobes: Ensure return_instance is detached from the list before freeing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <173374033102.412.8428117769218808923.tip-bot2@tip-bot2>
Date: Mon, 09 Dec 2024 10:32:11 -0000
From: "tip-bot2 for Andrii Nakryiko" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: Andrii Nakryiko <andrii@...nel.org>, Ingo Molnar <mingo@...nel.org>,
 Masami Hiramatsu <mhiramat@...nel.org>, Peter Zijlstra <peterz@...radead.org>,
 Oleg Nesterov <oleg@...hat.com>, x86@...nel.org, linux-kernel@...r.kernel.org
Subject: [tip: perf/core] uprobes: Ensure return_instance is detached from the
 list before freeing

The following commit has been merged into the perf/core branch of tip:

Commit-ID:     4621928fabc474d0ccab9e91f13b6f9f344e8248
Gitweb:        https://git.kernel.org/tip/4621928fabc474d0ccab9e91f13b6f9f344e8248
Author:        Andrii Nakryiko <andrii@...nel.org>
AuthorDate:    Thu, 05 Dec 2024 16:24:16 -08:00
Committer:     Peter Zijlstra <peterz@...radead.org>
CommitterDate: Mon, 09 Dec 2024 11:18:08 +01:00

uprobes: Ensure return_instance is detached from the list before freeing

Ensure that by the time we call free_ret_instance() to clean up an
instance of struct return_instance it isn't reachable from
utask->return_instances anymore.

free_ret_instance() is called in a few different situations, all but one
of which already are fine w.r.t. return_instance visibility:

  - uprobe_free_utask() guarantees that ri_timer() won't be called
    (through timer_delete_sync() call), and so there is no need to
    unlink anything, because entire utask is being freed;
  - uprobe_handle_trampoline() is already unlinking to-be-freed
    return_instance with rcu_assign_pointer() before calling
    free_ret_instance().

Only cleanup_return_instances() violates this property, which so far is
not causing problems due to RCU-delayed freeing of return_instance,
which we'll change in the next patch. So make sure we unlink
return_instance before passing it into free_ret_instance(), as otherwise
reuse will be unsafe.

Signed-off-by: Andrii Nakryiko <andrii@...nel.org>
Signed-off-by: Ingo Molnar <mingo@...nel.org>
Cc: Masami Hiramatsu <mhiramat@...nel.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Oleg Nesterov <oleg@...hat.com>
Link: https://lore.kernel.org/r/20241206002417.3295533-4-andrii@kernel.org
---
 kernel/events/uprobes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index cca1fe4..2345aeb 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -2116,12 +2116,12 @@ static void cleanup_return_instances(struct uprobe_task *utask, bool chained,
 
 	while (ri && !arch_uretprobe_is_alive(ri, ctx, regs)) {
 		ri_next = ri->next;
+		rcu_assign_pointer(utask->return_instances, ri_next);
 		utask->depth--;
 
 		free_ret_instance(ri, true /* cleanup_hprobe */);
 		ri = ri_next;
 	}
-	rcu_assign_pointer(utask->return_instances, ri);
 }
 
 static void prepare_uretprobe(struct uprobe *uprobe, struct pt_regs *regs,