Yang Jihong e4ae972959 ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ... commit c3b0f72e80 upstream. ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_function ftrace_startup __register_ftrace_function ... add_ftrace_ops(&ftrace_ops_list, ops) ... ... ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1 ... return 0 // ops is in the ftrace_ops_list. When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything: unregister_ftrace_function ftrace_shutdown if (unlikely(ftrace_disabled)) return -ENODEV; // return here, __unregister_ftrace_function is not executed, // as a result, ops is still in the ftrace_ops_list __unregister_ftrace_function ... If ops is dynamically allocated, it will be free later, in this case, is_ftrace_trampoline accesses NULL pointer: is_ftrace_trampoline ftrace_ops_trampoline do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL! Syzkaller reports as follows: [ 1203.506103] BUG: kernel NULL pointer dereference, address: 000000000000010b [ 1203.508039] #PF: supervisor read access in kernel mode [ 1203.508798] #PF: error_code(0x0000) - not-present page [ 1203.509558] PGD 800000011660b067 P4D 800000011660b067 PUD 130fb8067 PMD 0 [ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI [ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G B W 5.10.0 #8 [ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0 [ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00 [ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246 [ 1203.520092] RAX: 0000000000000000 RBX: 000000000000007b RCX: ffffffff8a331866 [ 1203.521469] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000000010b [ 1203.522583] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8df18b07 [ 1203.523550] R10: fffffbfff1be3160 R11: 0000000000000001 R12: 0000000000478399 [ 1203.524596] R13: 0000000000000000 R14: ffff888145088000 R15: 0000000000000008 [ 1203.525634] FS: 00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000 [ 1203.526801] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1203.527626] CR2: 000000000000010b CR3: 0000000170e1e001 CR4: 00000000003706e0 [ 1203.528611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1203.529605] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Therefore, when ftrace_startup_enable fails, we need to rollback registration process and remove ops from ftrace_ops_list. Link: https://lkml.kernel.org/r/20220818032659.56209-1-yangjihong1@huawei.com Suggested-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Yang Jihong <yangjihong1@huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-09-05 10:30:07 +02:00
..
bpf	bpf: Don't use tnum_range on array range checking for poke descriptors	2022-08-31 17:16:51 +02:00
cgroup	cgroup: Fix race condition at rebind_subsystems()	2022-08-31 17:16:33 +02:00
configs
debug	lockdown: also lock down previous kgdb use	2022-05-25 09:57:37 +02:00
dma	swiotlb: fail map correctly with failed io_tlb_default_mem	2022-08-17 14:24:07 +02:00
entry	signal: Replace force_fatal_sig with force_exit_sig when in doubt	2021-11-25 09:49:07 +01:00
events	perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()	2022-07-29 17:25:11 +02:00
gcov	Kconfig: Introduce ARCH_WANTS_NO_INSTR and CC_HAS_NO_PROFILE_FN_ATTR	2021-06-22 11:07:18 -07:00
irq	irqdomain: Report irq number for NOMAP domains	2022-08-17 14:23:14 +02:00
kcsan	LKMM updates:	2021-09-02 13:00:15 -07:00
livepatch	livepatch: Fix build failure on 32 bits processors	2022-04-08 14:23:29 +02:00
locking	locking/lockdep: Fix lockdep_init_map_*() confusion	2022-08-17 14:23:08 +02:00
power	PM: hibernate: defer device probing when resuming from hibernation	2022-08-17 14:23:04 +02:00
printk	printk: wake waiters for safe and NMI contexts	2022-06-09 10:22:49 +02:00
rcu	rcutorture: Fix ksoftirqd boosting timing and iteration	2022-08-17 14:23:23 +02:00
sched	sched/core: Do not requeue task on CPU excluded from cpus_mask	2022-08-17 14:24:15 +02:00
time	timekeeping: contribute wall clock to rng on time change	2022-08-17 14:24:24 +02:00
trace	ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead	2022-09-05 10:30:07 +02:00
.gitignore
acct.c	kernel/acct.c: use dedicated helper to access rlimit values	2021-09-08 11:50:26 -07:00
async.c	Revert "module, async: async_synchronize_full() on module init iff async is used"	2022-02-23 12:03:07 +01:00
audit_fsnotify.c	audit: fix potential double free on error path from fsnotify_add_inode_mark	2022-08-31 17:16:33 +02:00
audit_tree.c	audit: move put_tree() to avoid trim_trees refcount underflow and UAF	2021-08-24 18:52:36 -04:00
audit_watch.c
audit.c	audit: improve audit queue handling when "audit=1" on cmdline	2022-02-08 18:34:03 +01:00
audit.h	audit: log AUDIT_TIME_* records only from rules	2022-04-08 14:23:06 +02:00
auditfilter.c
auditsc.c	audit: log AUDIT_TIME_* records only from rules	2022-04-08 14:23:06 +02:00
backtracetest.c
bounds.c
capability.c
cfi.c	cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle	2022-06-22 14:22:04 +02:00
compat.c	arch: remove compat_alloc_user_space	2021-09-08 15:32:35 -07:00
configs.c
context_tracking.c
cpu_pm.c	PM: cpu: Make notifier chain use a raw_spinlock_t	2021-08-16 18:55:32 +02:00
cpu.c	random: clear fast pool, crng, and batches in cpuhp bring up	2022-05-30 09:29:09 +02:00
crash_core.c	kernel/crash_core: suppress unknown crashkernel parameter warning	2021-12-29 12:28:49 +01:00
crash_dump.c
cred.c	ucounts: Base set_cred_ucounts changes on the real user	2022-02-23 12:03:20 +01:00
delayacct.c
dma.c
exec_domain.c
exit.c	fix race between exit_itimers() and /proc/pid/timers	2022-07-21 21:24:11 +02:00
extable.c
fail_function.c
fork.c	sched: Fix yet more sched_fork() races	2022-03-08 19:12:49 +01:00
freezer.c
futex.c	futex: Remove unused variable 'vpid' in futex_proxy_trylock_atomic()	2021-09-03 23:00:22 +02:00
gen_kheaders.sh
groups.c
hung_task.c	Merge branch 'akpm' (patches from Andrew)	2021-07-02 12:08:10 -07:00
iomem.c
irq_work.c
jump_label.c	jump_label: Fix jump_label_text_reserved() vs __init	2021-07-05 10:46:20 +02:00
kallsyms.c	module: add printk formats to add module build ID to stacktraces	2021-07-08 11:48:22 -07:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks	locking/rwlock: Provide RT variant	2021-08-17 17:50:51 +02:00
Kconfig.preempt	sched/core: Disable CONFIG_SCHED_CORE by default	2021-06-28 22:43:05 +02:00
kcov.c
kexec_core.c	Merge branch 'rework/printk_safe-removal' into for-linus	2021-08-30 16:36:10 +02:00
kexec_elf.c
kexec_file.c	ima: force signature verification when CONFIG_KEXEC_SIG is configured	2022-07-21 21:24:29 +02:00
kexec_internal.h
kexec.c	kexec: avoid compat_alloc_user_space	2021-09-08 15:32:34 -07:00
kheaders.c
kmod.c
kprobes.c	kprobes: Forbid probing on trampoline and BPF code areas	2022-08-17 14:24:13 +02:00
ksysfs.c
kthread.c	Merge branch 'akpm' (patches from Andrew)	2021-06-29 17:29:11 -07:00
latencytop.c
Makefile	static_call: Don't make __static_call_return0 static	2022-04-13 20:59:28 +02:00
module_signature.c
module_signing.c
module-internal.h
module.c	module: fix [e_shstrndx].sh_size=0 OOB access	2022-07-12 16:35:09 +02:00
notifier.c	notifier: Remove atomic_notifier_call_chain_robust()	2021-08-16 18:55:32 +02:00
nsproxy.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
padata.c	padata: Remove repeated verbose license text	2021-08-27 16:30:18 +08:00
panic.c	Merge branch 'rework/printk_safe-removal' into for-linus	2021-08-30 16:36:10 +02:00
params.c	params: lift param_set_uint_minmax to common code	2021-08-16 14:42:22 +02:00
pid_namespace.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
pid.c	kernel/pid.c: implement additional checks upon pidfd_create() parameters	2021-08-10 12:53:07 +02:00
profile.c	profiling: fix shift too large makes kernel panic	2022-08-17 14:24:04 +02:00
ptrace.c	ptrace: Reimplement PTRACE_KILL by always sending SIGKILL	2022-06-09 10:22:29 +02:00
range.c
reboot.c
regset.c
relay.c
resource_kunit.c
resource.c	kernel/resource: fix kfree() of bootmem memory again	2022-04-08 14:23:43 +02:00
rseq.c	rseq: Remove broken uapi field layout on 32-bit little endian	2022-04-08 14:23:10 +02:00
scftorture.c	scftorture: Fix distribution of short handler delays	2022-06-09 10:22:46 +02:00
scs.c	scs: Release kasan vmalloc poison in scs_free process	2021-11-18 19:16:29 +01:00
seccomp.c	seccomp: Invalidate seccomp mode to catch death failures	2022-02-16 12:56:38 +01:00
signal.c	signal handling: don't use BUG_ON() for debugging	2022-07-21 21:24:42 +02:00
smp.c	locking/csd_lock: Change csdlock_debug from early_param to __setup	2022-08-17 14:24:24 +02:00
smpboot.c	smpboot: Replace deprecated CPU-hotplug functions.	2021-08-10 14:57:42 +02:00
smpboot.h
softirq.c	genirq: Change force_irqthreads to a static key	2021-08-10 22:50:07 +02:00
stackleak.c	gcc-plugins/stackleak: Use noinstr in favor of notrace	2022-02-23 12:03:07 +01:00
stacktrace.c	stacktrace: move filter_irq_stacks() to kernel/stacktrace.c	2022-04-13 20:59:28 +02:00
static_call_inline.c	static_call: Don't make __static_call_return0 static	2022-04-13 20:59:28 +02:00
static_call.c	static_call: Don't make __static_call_return0 static	2022-04-13 20:59:28 +02:00
stop_machine.c
sys_ni.c	kernel/sys_ni: add compat entry for fadvise64_64	2022-08-31 17:16:33 +02:00
sys.c	ucounts: Move RLIMIT_NPROC handling after set_user	2022-02-23 12:03:20 +01:00
sysctl-test.c	kernel/sysctl-test: Remove some casts which are no-longer required	2021-06-23 16:41:24 -06:00
sysctl.c	sysctl: move some boundary constants from sysctl.c to sysctl_vals	2022-07-29 17:25:11 +02:00
task_work.c
taskstats.c
test_kprobes.c
torture.c	torture: Replace deprecated CPU-hotplug functions.	2021-08-10 10:48:07 -07:00
tracepoint.c	tracepoint: Fix kerneldoc comments	2021-08-16 11:39:51 -04:00
tsacct.c	taskstats: Cleanup the use of task->exit_code	2022-01-27 11:05:35 +01:00
ucount.c	ucounts: Handle wrapping in is_ucounts_overlimit	2022-02-23 12:03:20 +01:00
uid16.c
uid16.h
umh.c
up.c
user_namespace.c	ucounts: Fix systemd LimitNPROC with private users regression	2022-03-08 19:12:42 +01:00
user-return-notifier.c
user.c	fs/epoll: use a per-cpu counter for user's watches count	2021-09-08 11:50:27 -07:00
usermode_driver.c	Merge branch 'work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2021-07-03 11:41:14 -07:00
utsname_sysctl.c
utsname.c
watch_queue.c	watch_queue: Fix missing locking in add_watch_to_object()	2022-08-03 12:03:43 +02:00
watchdog_hld.c
watchdog.c	watchdog: export lockup_detector_reconfigure	2022-08-25 11:40:43 +02:00
workqueue_internal.h	workqueue: Assign a color to barrier work items	2021-08-17 07:49:10 -10:00
workqueue.c	workqueue: Fix unbind_workers() VS wq_worker_running() race	2022-01-16 09:12:41 +01:00