Petr Pavlu c0591b1ccc tracing: Fix a possible race when disabling buffered events ... Function trace_buffered_event_disable() is responsible for freeing pages backing buffered events and this process can run concurrently with trace_event_buffer_lock_reserve(). The following race is currently possible: * Function trace_buffered_event_disable() is called on CPU 0. It increments trace_buffered_event_cnt on each CPU and waits via synchronize_rcu() for each user of trace_buffered_event to complete. * After synchronize_rcu() is finished, function trace_buffered_event_disable() has the exclusive access to trace_buffered_event. All counters trace_buffered_event_cnt are at 1 and all pointers trace_buffered_event are still valid. * At this point, on a different CPU 1, the execution reaches trace_event_buffer_lock_reserve(). The function calls preempt_disable_notrace() and only now enters an RCU read-side critical section. The function proceeds and reads a still valid pointer from trace_buffered_event[CPU1] into the local variable "entry". However, it doesn't yet read trace_buffered_event_cnt[CPU1] which happens later. * Function trace_buffered_event_disable() continues. It frees trace_buffered_event[CPU1] and decrements trace_buffered_event_cnt[CPU1] back to 0. * Function trace_event_buffer_lock_reserve() continues. It reads and increments trace_buffered_event_cnt[CPU1] from 0 to 1. This makes it believe that it can use the "entry" that it already obtained but the pointer is now invalid and any access results in a use-after-free. Fix the problem by making a second synchronize_rcu() call after all trace_buffered_event values are set to NULL. This waits on all potential users in trace_event_buffer_lock_reserve() that still read a previous pointer from trace_buffered_event. Link: https://lore.kernel.org/all/20231127151248.7232-2-petr.pavlu@suse.com/ Link: https://lkml.kernel.org/r/20231205161736.19663-4-petr.pavlu@suse.com Cc: stable@vger.kernel.org Fixes: 0fc1b09ff1 ("tracing: Use temp buffer when filtering events") Signed-off-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>		2023-12-05 17:17:00 -05:00
..
bpf	bpf: Do not allocate percpu memory at init stage	2023-11-15 07:51:06 -08:00
cgroup	sched: psi: fix unprivileged polling against cgroups	2023-11-14 22:27:00 +01:00
configs	hardening: Provide Kconfig fragments for basic options	2023-09-22 09:50:55 -07:00
debug	kdb: Corrects comment for kdballocenv	2023-11-06 17:13:55 +00:00
dma	swiotlb: fix out-of-bounds TLB allocations with CONFIG_SWIOTLB_DYNAMIC	2023-11-08 16:27:05 +01:00
entry	entry: Remove empty addr_limit_user_check()	2023-08-23 10:32:39 +02:00
events	perf/core: Fix cpuctx refcounting	2023-11-15 04:18:31 +01:00
futex	futex: Fix hardcoded flags	2023-11-15 04:02:25 +01:00
gcov	gcov: annotate struct gcov_iterator with __counted_by	2023-10-18 14:43:22 -07:00
irq	As usual, lots of singleton and doubleton patches all over the tree and	2023-11-02 20:53:31 -10:00
kcsan	mm: delete checks for xor_unlock_is_negative_byte()	2023-10-18 14:34:17 -07:00
livepatch	livepatch: Fix missing newline character in klp_resolve_symbols()	2023-09-20 11:24:18 +02:00
locking	RCU pull request for v6.7	2023-10-30 18:01:41 -10:00
module	This update includes the following changes:	2023-11-02 16:15:30 -10:00
power	Power management updates for 6.7-rc1	2023-10-31 15:38:12 -10:00
printk	TTY/Serial changes for 6.7-rc1	2023-11-03 15:44:25 -10:00
rcu	RCU fixes for v6.7	2023-11-08 09:47:52 -08:00
sched	sched/fair: Fix the decision for load balance	2023-11-14 22:27:01 +01:00
time	- Do the push of pending hrtimers away from a CPU which is being	2023-11-19 13:35:07 -08:00
trace	tracing: Fix a possible race when disabling buffered events	2023-12-05 17:17:00 -05:00
.gitignore
acct.c	fs: rename __mnt_{want,drop}_write*() helpers	2023-09-11 15:05:50 +02:00
async.c
audit_fsnotify.c
audit_tree.c	As usual, lots of singleton and doubleton patches all over the tree and	2023-11-02 20:53:31 -10:00
audit_watch.c	audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()	2023-11-14 17:34:27 -05:00
audit.c	audit: move trailing statements to next line	2023-08-15 18:16:14 -04:00
audit.h	audit: correct audit_filter_inodes() definition	2023-07-21 12:17:25 -04:00
auditfilter.c	audit: move trailing statements to next line	2023-08-15 18:16:14 -04:00
auditsc.c	audit,io_uring: io_uring openat triggers audit reference count underflow	2023-10-13 18:34:46 +02:00
backtracetest.c
bounds.c
capability.c	lsm: constify the 'target' parameter in security_capget()	2023-08-08 16:48:47 -04:00
cfi.c
compat.c	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized	2023-03-14 19:32:38 -07:00
configs.c
context_tracking.c	locking/atomic: treewide: use raw_atomic*_<op>()	2023-06-05 09:57:20 +02:00
cpu_pm.c	cpuidle, cpu_pm: Remove RCU fiddling from cpu_pm_{enter,exit}()	2023-01-13 11:48:15 +01:00
cpu.c	- Do the push of pending hrtimers away from a CPU which is being	2023-11-19 13:35:07 -08:00
crash_core.c	crash_core.c: remove unneeded functions	2023-10-04 10:41:58 -07:00
crash_dump.c
cred.c	lsm/stable-6.7 PR 20231030	2023-10-30 20:13:17 -10:00
delayacct.c	delayacct: track delays from IRQ/SOFTIRQ	2023-04-18 16:39:34 -07:00
dma.c
exec_domain.c
exit.c	As usual, lots of singleton and doubleton patches all over the tree and	2023-11-02 20:53:31 -10:00
exit.h	exit: add internal include file with helpers	2023-09-21 12:03:50 -06:00
extable.c
fail_function.c	kernel/fail_function: fix memory leak with using debugfs_lookup()	2023-02-08 13:36:22 +01:00
fork.c	As usual, lots of singleton and doubleton patches all over the tree and	2023-11-02 20:53:31 -10:00
freezer.c	freezer,sched: Use saved_state to reduce some spurious wakeups	2023-09-18 08:14:36 +02:00
gen_kheaders.sh	Revert "kheaders: substituting --sort in archive creation"	2023-05-28 16:20:21 +09:00
groups.c	groups: Convert group_info.usage to refcount_t	2023-09-29 11:28:39 -07:00
hung_task.c	kernel/hung_task.c: set some hung_task.c variables storage-class-specifier to static	2023-04-08 13:45:37 -07:00
iomem.c	kernel/iomem.c: remove __weak ioremap_cache helper	2023-08-21 13:37:28 -07:00
irq_work.c	trace: Add trace_ipi_send_cpu()	2023-03-24 11:01:29 +01:00
jump_label.c	jump_label: Prevent key->enabled int overflow	2022-12-01 15:53:05 -08:00
kallsyms_internal.h
kallsyms_selftest.c	Modules changes for v6.6-rc1	2023-08-29 17:32:32 -07:00
kallsyms_selftest.h
kallsyms.c	kallsyms: Change func signature for cleanup_symbol_name()	2023-08-25 15:00:36 -07:00
kcmp.c	file: convert to SLAB_TYPESAFE_BY_RCU	2023-10-19 11:02:48 +02:00
Kconfig.freezer
Kconfig.hz
Kconfig.kexec	docs: fix link s390/zfcpdump.rst	2023-10-04 10:41:56 -07:00
Kconfig.locks
Kconfig.preempt
kcov.c	kcov: add prototypes for helper functions	2023-06-09 17:44:17 -07:00
kexec_core.c	crash_core: move crashk_*res definition into crash_core.c	2023-10-04 10:41:58 -07:00
kexec_elf.c
kexec_file.c	integrity-v6.6	2023-08-30 09:16:56 -07:00
kexec_internal.h
kexec.c	kernel: kexec: copy user-array safely	2023-10-09 16:59:47 +10:00
kheaders.c	kheaders: Use array declaration instead of char	2023-03-24 20:10:59 -07:00
kprobes.c	kprobes: kretprobe scalability improvement	2023-10-18 23:59:54 +09:00
ksyms_common.c	kallsyms: make kallsyms_show_value() as generic function	2023-06-08 12:27:20 -07:00
ksysfs.c	crash: hotplug support for kexec_load()	2023-08-24 16:25:14 -07:00
kthread.c	As usual, lots of singleton and doubleton patches all over the tree and	2023-11-02 20:53:31 -10:00
latencytop.c
Makefile	v6.5-rc1-modules-next	2023-06-28 15:51:08 -07:00
module_signature.c
notifier.c	notifiers: add tracepoints to the notifiers infrastructure	2023-04-08 13:45:38 -07:00
nsproxy.c	nsproxy: Convert nsproxy.count to refcount_t	2023-08-21 11:29:12 -07:00
padata.c	padata: Fix refcnt handling in padata_free_shell()	2023-10-27 18:04:24 +08:00
panic.c	panic: use atomic_try_cmpxchg in panic() and nmi_panic()	2023-10-04 10:41:56 -07:00
params.c	kernel: params: Remove unnecessary ‘0’ values from err	2023-07-10 12:47:01 -07:00
pid_namespace.c	pid: pid_ns_ctl_handler: remove useless comment	2023-10-04 10:41:57 -07:00
pid_sysctl.h	memfd: replace ratcheting feature from vm.memfd_noexec with hierarchy	2023-08-21 13:37:59 -07:00
pid.c	pidfd: prevent a kernel-doc warning	2023-09-19 13:21:33 -07:00
profile.c
ptrace.c	mm: make __access_remote_vm() static	2023-10-18 14:34:15 -07:00
range.c
reboot.c	kernel/reboot: Add device to sys_off_handler	2023-07-28 11:33:09 +01:00
regset.c
relay.c	kernel: relay: remove unnecessary NULL values from relay_open_buf	2023-08-18 10:18:55 -07:00
resource_kunit.c
resource.c	resource: Unify next_resource() and next_resource_skip_children()	2023-10-05 13:58:07 +02:00
rseq.c	rseq: Extend struct rseq with per-memory-map concurrency ID	2022-12-27 12:52:12 +01:00
scftorture.c	scftorture: Pause testing after memory-allocation failure	2023-07-14 15:02:57 -07:00
scs.c
seccomp.c	seccomp: Add missing kerndoc notations	2023-08-17 12:32:15 -07:00
signal.c	As usual, lots of singleton and doubleton patches all over the tree and	2023-11-02 20:53:31 -10:00
smp.c	CSD lock commits for v6.7	2023-10-30 17:56:53 -10:00
smpboot.c	kthread: add kthread_stop_put	2023-10-04 10:41:57 -07:00
smpboot.h
softirq.c	sched/core: introduce sched_core_idle_cpu()	2023-07-13 15:21:50 +02:00
stackleak.c	stackleak: allow to specify arch specific stackleak poison function	2023-04-20 11:36:35 +02:00
stacktrace.c	stacktrace: Export stack_trace_save_tsk	2023-09-11 23:59:47 -04:00
static_call_inline.c
static_call.c
stop_machine.c
sys_ni.c	asm-generic updates for v6.7	2023-11-01 15:28:33 -10:00
sys.c	prctl: Disable prctl(PR_SET_MDWE) on parisc	2023-11-18 19:35:31 +01:00
sysctl-test.c
sysctl.c	asm-generic updates for v6.7	2023-11-01 15:28:33 -10:00
task_work.c	task_work: add kerneldoc annotation for 'data' argument	2023-09-19 13:21:32 -07:00
taskstats.c	taskstats: fill_stats_for_tgid: use for_each_thread()	2023-10-04 10:41:57 -07:00
torture.c	torture: Print out torture module parameters	2023-09-24 17:24:01 +02:00
tracepoint.c	tracepoint: Allow livepatch module add trace event	2023-02-18 14:34:36 -05:00
tsacct.c
ucount.c	sysctl: Add size to register_sysctl	2023-08-15 15:26:17 -07:00
uid16.c
uid16.h
umh.c	sysctl: fix unused proc_cap_handler() function warning	2023-06-29 15:19:43 -07:00
up.c	smp: Change function signatures to use call_single_data_t	2023-09-13 14:59:24 +02:00
user_namespace.c	As usual, lots of singleton and doubleton patches all over the tree and	2023-11-02 20:53:31 -10:00
user-return-notifier.c
user.c	binfmt_misc: enable sandboxed mounts	2023-10-11 08:46:01 -07:00
usermode_driver.c
utsname_sysctl.c	utsname: simplify one-level sysctl registration for uts_kern_table	2023-04-13 11:49:35 -07:00
utsname.c
vhost_task.c	vhost: Fix worker hangs due to missed wake up calls	2023-06-08 15:43:09 -04:00
watch_queue.c	kernel: watch_queue: copy user-array safely	2023-10-09 16:59:48 +10:00
watchdog_buddy.c	watchdog/hardlockup: move SMP barriers from common code to buddy code	2023-06-19 16:25:28 -07:00
watchdog_perf.c	watchdog/perf: add a weak function for an arch to detect if perf can use NMIs	2023-06-09 17:44:21 -07:00
watchdog.c	watchdog: move softlockup_panic back to early_param	2023-11-01 12:10:02 -07:00
workqueue_internal.h	workqueue: Drop the special locking rule for worker->flags and worker_pool->flags	2023-08-07 15:57:22 -10:00
workqueue.c	As usual, lots of singleton and doubleton patches all over the tree and	2023-11-02 20:53:31 -10:00