linux-kernel - Re: [PATCHv2 bpf-next 4/8] ftrace: Add update_ftrace_direct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <367c6cc9ffa12937ce18f37fc1271e3d17a3f7aa6ea6d1152cc8a41539994865@mail.kernel.org>
Date: Thu, 13 Nov 2025 13:02:21 +0000 (UTC)
From: bot+bpf-ci@...nel.org
To: jolsa@...nel.org,rostedt@...nel.org,revest@...gle.com,mark.rutland@....com
Cc: bpf@...r.kernel.org,linux-kernel@...r.kernel.org,linux-trace-kernel@...r.kernel.org,linux-arm-kernel@...ts.infradead.org,ast@...nel.org,daniel@...earbox.net,andrii@...nel.org,menglong8.dong@...il.com,song@...nel.org,ast@...nel.org,andrii@...nel.org,daniel@...earbox.net,martin.lau@...nel.org,eddyz87@...il.com,yonghong.song@...ux.dev,clm@...a.com,ihor.solodrai@...ux.dev
Subject: Re: [PATCHv2 bpf-next 4/8] ftrace: Add update_ftrace_direct_del function

> diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
> index ded3a306a..433c36c3a 100644
> --- a/include/linux/ftrace.h
> +++ b/include/linux/ftrace.h
> @@ -543,6 +543,7 @@ int modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr);
>  int modify_ftrace_direct_nolock(struct ftrace_ops *ops, unsigned long addr);
>
>  int update_ftrace_direct_add(struct ftrace_ops *ops, struct ftrace_hash *hash);
> +int update_ftrace_direct_del(struct ftrace_ops *ops, struct ftrace_hash *hash);
>
>  void ftrace_stub_direct_tramp(void);

[ ... ]

> diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
> index 311ce6406..345f3fdd2 100644
> --- a/kernel/trace/ftrace.c
> +++ b/kernel/trace/ftrace.c

[ ... ]

> +int update_ftrace_direct_del(struct ftrace_ops *ops, struct ftrace_hash *hash)
> +{
> +	struct ftrace_hash *new_hash = NULL, *filter_hash = NULL, *free_hash = NULL;
> +	struct ftrace_func_entry *del, *entry;
> +	unsigned long size, i;
> +	int err = -EINVAL;
> +
> +	if (!hash_count(hash))
> +		return 0;
> +	if (check_direct_multi(ops))
> +		return -EINVAL;
> +	if (!(ops->flags & FTRACE_OPS_FL_ENABLED))
> +		return -EINVAL;
> +	if (direct_functions == EMPTY_HASH)
> +		return -EINVAL;
> +
> +	mutex_lock(&direct_mutex);
> +
> +	/* Make sure requested entries are already registered. */
> +	size = 1 << hash->size_bits;
> +	for (i = 0; i < size; i++) {
> +		hlist_for_each_entry(entry, &hash->buckets[i], hlist) {
> +			del = __ftrace_lookup_ip(direct_functions, entry->ip);
> +			if (!del || del->direct != entry->direct)
> +				goto out_unlock;
> +		}
> +	}
> +
> +	err = -ENOMEM;
> +	filter_hash = hash_sub(ops->func_hash->filter_hash, hash);
> +	if (!filter_hash)
> +		goto out_unlock;
> +
> +	new_hash = hash_sub(direct_functions, hash);
> +	if (!new_hash)
> +		goto out_unlock;

Can this leak new_hash?  If hash_sub() succeeds for both filter_hash
and new_hash, but then either unregister_ftrace_function() or
ftrace_update_ops() fails below, we goto out_unlock without freeing
new_hash.  The cleanup code only frees filter_hash:

> +
> +	/* If there's nothing left, we need to unregister the ops. */
> +	if (ftrace_hash_empty(filter_hash)) {
> +		err = unregister_ftrace_function(ops);
> +		/* cleanup for possible another register call */
> +		ops->func = NULL;
> +		ops->trampoline = 0;
> +		ftrace_free_filter(ops);
> +		ops->func_hash->filter_hash = NULL;
> +	} else {
> +		err = ftrace_update_ops(ops, filter_hash, EMPTY_HASH);
> +	}
> +
> +	if (!err) {
> +		free_hash = direct_functions;
> +		rcu_assign_pointer(direct_functions, new_hash);
> +	}
> +
> + out_unlock:
> +	mutex_unlock(&direct_mutex);
> +
> +	if (free_hash && free_hash != EMPTY_HASH)
> +		call_rcu_tasks(&free_hash->rcu, register_ftrace_direct_cb);
> +	if (filter_hash)
> +		free_ftrace_hash(filter_hash);
> +
> +	return err;
> +}

If err != 0, new_hash remains allocated but is never freed.  Should the
cleanup code add free_ftrace_hash(new_hash) when it's non-NULL?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19332026793