Commit c8b186a8 authored by Alexey Kardashevskiy's avatar Alexey Kardashevskiy Committed by Steven Rostedt (VMware)
Browse files

tracepoint: Fix race between tracing and removing tracepoint 

When executing a tracepoint, the tracepoint's func is dereferenced twice -
in __DO_TRACE() (where the returned pointer is checked) and later on in
__traceiter_##_name where the returned pointer is dereferenced without
checking which leads to races against tracepoint_removal_sync() and
crashes.

This adds a check before referencing the pointer in tracepoint_ptr_deref.

Link: https://lkml.kernel.org/r/20210202072326.120557-1-aik@ozlabs.ru



Cc: stable@vger.kernel.org
Fixes: d25e37d8 ("tracepoint: Optimize using static_call()")
Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: default avatarAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
parent 0188b878

include/linux/tracepoint.h

+7 −5
Original line number Diff line number Diff line
@@ -307,11 +307,13 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p) 
									\

		it_func_ptr =						\

			rcu_dereference_raw((&__tracepoint_##_name)->funcs); \

		if (it_func_ptr) {					\

			do {						\

				it_func = (it_func_ptr)->func;		\

				__data = (it_func_ptr)->data;		\

				((void(*)(void *, proto))(it_func))(__data, args); \

			} while ((++it_func_ptr)->func);		\

		}							\

		return 0;						\

	}								\

	DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);