Unverified Commit a9e021af authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9510 ftrace: Fix possible use-after-free issue in ftrace_location() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zheng Yejian <zhengyejian1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/WNAKUJHWKTAAWD73VWXCTVLILGSUXCFV/ 
 
https://gitee.com/src-openeuler/kernel/issues/IA6S5H 
 
Link:https://gitee.com/openeuler/kernel/pulls/9510

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 7381b6e9 2582d149

kernel/trace/ftrace.c

+23 −16
Original line number Diff line number Diff line
@@ -1595,12 +1595,15 @@ static struct dyn_ftrace *lookup_rec(unsigned long start, unsigned long end) 
unsigned long ftrace_location_range(unsigned long start, unsigned long end)

{

	struct dyn_ftrace *rec;

	unsigned long ip = 0;



	rcu_read_lock();

	rec = lookup_rec(start, end);

	if (rec)

		return rec->ip;

		ip = rec->ip;

	rcu_read_unlock();



	return 0;

	return ip;

}



/**
@@ -1613,25 +1616,22 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) 
 */

unsigned long ftrace_location(unsigned long ip)

{

	struct dyn_ftrace *rec;

	unsigned long loc;

	unsigned long offset;

	unsigned long size;



	rec = lookup_rec(ip, ip);

	if (!rec) {

	loc = ftrace_location_range(ip, ip);

	if (!loc) {

		if (!kallsyms_lookup_size_offset(ip, &size, &offset))

			goto out;



		/* map sym+0 to __fentry__ */

		if (!offset)

			rec = lookup_rec(ip, ip + size - 1);

			loc = ftrace_location_range(ip, ip + size - 1);

	}



	if (rec)

		return rec->ip;



out:

	return 0;

	return loc;

}



/**
@@ -6593,6 +6593,8 @@ static int ftrace_process_locs(struct module *mod, 
	/* We should have used all pages unless we skipped some */

	if (pg_unuse) {

		WARN_ON(!skipped);

		/* Need to synchronize with ftrace_location_range() */

		synchronize_rcu();

		ftrace_free_pages(pg_unuse);

	}

	return ret;
@@ -6806,6 +6808,9 @@ void ftrace_release_mod(struct module *mod) 
 out_unlock:

	mutex_unlock(&ftrace_lock);



	/* Need to synchronize with ftrace_location_range() */

	if (tmp_page)

		synchronize_rcu();

	for (pg = tmp_page; pg; pg = tmp_page) {



		/* Needs to be called outside of ftrace_lock */
@@ -7139,6 +7144,7 @@ void ftrace_free_mem(struct module *mod, void *start_ptr, void *end_ptr) 
	unsigned long start = (unsigned long)(start_ptr);

	unsigned long end = (unsigned long)(end_ptr);

	struct ftrace_page **last_pg = &ftrace_pages_start;

	struct ftrace_page *tmp_page = NULL;

	struct ftrace_page *pg;

	struct dyn_ftrace *rec;

	struct dyn_ftrace key;
@@ -7180,12 +7186,8 @@ void ftrace_free_mem(struct module *mod, void *start_ptr, void *end_ptr) 
		ftrace_update_tot_cnt--;

		if (!pg->index) {

			*last_pg = pg->next;

			if (pg->records) {

				free_pages((unsigned long)pg->records, pg->order);

				ftrace_number_of_pages -= 1 << pg->order;

			}

			ftrace_number_of_groups--;

			kfree(pg);

			pg->next = tmp_page;

			tmp_page = pg;

			pg = container_of(last_pg, struct ftrace_page, next);

			if (!(*last_pg))

				ftrace_pages = pg;
@@ -7202,6 +7204,11 @@ void ftrace_free_mem(struct module *mod, void *start_ptr, void *end_ptr) 
		clear_func_from_hashes(func);

		kfree(func);

	}

	/* Need to synchronize with ftrace_location_range() */

	if (tmp_page) {

		synchronize_rcu();

		ftrace_free_pages(tmp_page);

	}

}



void __init ftrace_free_init_mem(void)