linux-kernel - Re: [PATCH v2] tracing: Fix race condition in kprobe initialization causing NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250930175826.52b58b7a502b215e3d226f9b@kernel.org>
Date: Tue, 30 Sep 2025 17:58:26 +0900
From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
To: Peter Zijlstra <peterz@...radead.org>
Cc: John Ogness <john.ogness@...utronix.de>, Steven Rostedt
 <rostedt@...dmis.org>, chenyuan_fl@....com, mhiramat@...nel.org,
 mathieu.desnoyers@...icios.com, linux-kernel@...r.kernel.org,
 linux-trace-kernel@...r.kernel.org, Yuan Chen <chenyuan@...inos.cn>,
 Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Subject: Re: [PATCH v2] tracing: Fix race condition in kprobe initialization
 causing NULL pointer dereference

On Mon, 29 Sep 2025 12:12:59 +0200
Peter Zijlstra <peterz@...radead.org> wrote:

> On Mon, Sep 29, 2025 at 11:38:08AM +0206, John Ogness wrote:
> 
> > >> Problem:
> > >> 1. CPU0 executes (1) assigning tp_event->perf_events = list
> > 
> > smp_wmb()
> > 
> > >> 2. CPU0 executes (2) enabling kprobe functionality via class->reg()
> > >> 3. CPU1 triggers and reaches kprobe_dispatcher
> > >> 4. CPU1 checks TP_FLAG_PROFILE - condition passes (step 2 completed)
> > 
> > smp_rmb()
> > 
> > >> 5. CPU1 calls kprobe_perf_func() and crashes at (3) because
> > >>    call->perf_events is still NULL
> > >> 
> > >> The issue: Assignment in step 1 may not be visible to CPU1 due to
> > >> missing memory barriers before step 2 sets TP_FLAG_PROFILE flag.
> > 
> > A better explanation of the issue would be: CPU1 sees that kprobe
> > functionality is enabled but does not see that perf_events has been
> > assigned.
> > 
> > Add pairing read and write memory barriers to guarantee that if CPU1
> > sees that kprobe functionality is enabled, it must also see that
> > perf_events has been assigned.
> > 
> > Note that this could also be done more efficiently using a store_release
> > when setting the flag (in step 2) and a load_acquire when loading the
> > flag (in step 4).
> 
> The RELEASE+ACQUIRE is a better pattern for these cases. 
> 
> And I'll argue the barrier should be in 2 not 1, since it is 2 that sets
> the flag checked in 4.  Any store before that flag might be affected,
> not just the ->perf_events list.

RELEASE+ACQUIRE ensures the memory ordering on the `same` CPU, so do we still need smp_rmb() and smp_wmb()? e.g.

perf_trace_event_init()
-----
tp_event->perf_events = list
/*(1)*/
smp_store_release(&tp->event->flags, newflag);
-----

kprobe_dispatcher()
-----
smp_load_acquire(&tk->tp.flags);
/*(2)*/
this_cpu_ptr(call->perf_events);
-----

This ensures
 - the flags update is shown on other CPUs
 - perf_events update is done before the flags update on the same CPU
 - perf_events load is done after the flags load on the same CPU

But we are still not sure the perf_events update is shown on other CPUs?

To ensure that we still need smp_wmb() and smp_rmb() at (1) and (2).

Or we don't need smp_*mb()?

Thank you,

-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>