Unverified Commit 499cde97 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10112 ftrace: Fix use-after-free for dynamic ftrace_ops 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zheng Yejian <zhengyejian1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5GKBX4J7ZIFX4I55SJXWGTMIJDHQSOAN/ 
 
https://gitee.com/openeuler/kernel/issues/IADOMV 
 
Link:https://gitee.com/openeuler/kernel/pulls/10112

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 85b58143 d3f87056

kernel/trace/ftrace.c

+3 −13
Original line number Diff line number Diff line
@@ -2802,18 +2802,8 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command) 
		command |= FTRACE_UPDATE_TRACE_FUNC;

	}



	if (!command || !ftrace_enabled) {

		/*

		 * If these are dynamic or per_cpu ops, they still

		 * need their data freed. Since, function tracing is

		 * not currently active, we can just free them

		 * without synchronizing all CPUs.

		 */

		if (ops->flags & FTRACE_OPS_FL_DYNAMIC)

			goto free_ops;



		return 0;

	}

	if (!command || !ftrace_enabled)

		goto out;



	/*

	 * If the ops uses a trampoline, then it needs to be
@@ -2850,6 +2840,7 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command) 
	removed_ops = NULL;

	ops->flags &= ~FTRACE_OPS_FL_REMOVING;



out:

	/*

	 * Dynamic ops may be freed, we must make sure that all

	 * callers are done before leaving this function.
@@ -2877,7 +2868,6 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command) 
		if (IS_ENABLED(CONFIG_PREEMPT))

			synchronize_rcu_tasks();



 free_ops:

		arch_ftrace_trampoline_free(ops);

	}