Commit 1a7d0890 authored by Stephen Brennan's avatar Stephen Brennan Committed by Masami Hiramatsu (Google)
Browse files

kprobe/ftrace: bail out if ftrace was killed 

If an error happens in ftrace, ftrace_kill() will prevent disarming
kprobes. Eventually, the ftrace_ops associated with the kprobes will be
freed, yet the kprobes will still be active, and when triggered, they
will use the freed memory, likely resulting in a page fault and panic.

This behavior can be reproduced quite easily, by creating a kprobe and
then triggering a ftrace_kill(). For simplicity, we can simulate an
ftrace error with a kernel module like [1]:

[1]: https://github.com/brenns10/kernel_stuff/tree/master/ftrace_killer

  sudo perf probe --add commit_creds
  sudo perf trace -e probe:commit_creds
  # In another terminal
  make
  sudo insmod ftrace_killer.ko  # calls ftrace_kill(), simulating bug
  # Back to perf terminal
  # ctrl-c
  sudo perf probe --del commit_creds

After a short period, a page fault and panic would occur as the kprobe
continues to execute and uses the freed ftrace_ops. While ftrace_kill()
is supposed to be used only in extreme circumstances, it is invoked in
FTRACE_WARN_ON() and so there are many places where an unexpected bug
could be triggered, yet the system may continue operating, possibly
without the administrator noticing. If ftrace_kill() does not panic the
system, then we should do everything we can to continue operating,
rather than leave a ticking time bomb.

Link: https://lore.kernel.org/all/20240501162956.229427-1-stephen.s.brennan@oracle.com/



Signed-off-by: default avatarStephen Brennan <stephen.s.brennan@oracle.com>
Acked-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: default avatarGuo Ren <guoren@kernel.org>
Reviewed-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
parent b7bd96ec

arch/csky/kernel/probes/ftrace.c

+3 −0
Original line number Diff line number Diff line
@@ -12,6 +12,9 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip, 
	struct kprobe_ctlblk *kcb;

	struct pt_regs *regs;



	if (unlikely(kprobe_ftrace_disabled))

		return;



	bit = ftrace_test_recursion_trylock(ip, parent_ip);

	if (bit < 0)

		return;

arch/loongarch/kernel/ftrace_dyn.c

+3 −0
Original line number Diff line number Diff line
@@ -287,6 +287,9 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip, 
	struct kprobe *p;

	struct kprobe_ctlblk *kcb;



	if (unlikely(kprobe_ftrace_disabled))

		return;



	bit = ftrace_test_recursion_trylock(ip, parent_ip);

	if (bit < 0)

		return;

arch/parisc/kernel/ftrace.c

+3 −0
Original line number Diff line number Diff line
@@ -206,6 +206,9 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip, 
	struct kprobe *p;

	int bit;



	if (unlikely(kprobe_ftrace_disabled))

		return;



	bit = ftrace_test_recursion_trylock(ip, parent_ip);

	if (bit < 0)

		return;

arch/powerpc/kernel/kprobes-ftrace.c

+3 −0
Original line number Diff line number Diff line
@@ -21,6 +21,9 @@ void kprobe_ftrace_handler(unsigned long nip, unsigned long parent_nip, 
	struct pt_regs *regs;

	int bit;



	if (unlikely(kprobe_ftrace_disabled))

		return;



	bit = ftrace_test_recursion_trylock(nip, parent_nip);

	if (bit < 0)

		return;

arch/riscv/kernel/probes/ftrace.c

+3 −0
Original line number Diff line number Diff line
@@ -11,6 +11,9 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip, 
	struct kprobe_ctlblk *kcb;

	int bit;



	if (unlikely(kprobe_ftrace_disabled))

		return;



	bit = ftrace_test_recursion_trylock(ip, parent_ip);

	if (bit < 0)

		return;