Skip to content

Commit

Permalink
uprobes: Ensure return_instance is detached from the list before freeing
Browse files Browse the repository at this point in the history
Ensure that by the time we call free_ret_instance() to clean up an
instance of struct return_instance it isn't reachable from
utask->return_instances anymore.

free_ret_instance() is called in a few different situations, all but one
of which already are fine w.r.t. return_instance visibility:

  - uprobe_free_utask() guarantees that ri_timer() won't be called
    (through timer_delete_sync() call), and so there is no need to
    unlink anything, because entire utask is being freed;
  - uprobe_handle_trampoline() is already unlinking to-be-freed
    return_instance with rcu_assign_pointer() before calling
    free_ret_instance().

Only cleanup_return_instances() violates this property, which so far is
not causing problems due to RCU-delayed freeing of return_instance,
which we'll change in the next patch. So make sure we unlink
return_instance before passing it into free_ret_instance(), as otherwise
reuse will be unsafe.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/r/20241206002417.3295533-4-andrii@kernel.org
  • Loading branch information
Andrii Nakryiko authored and Ingo Molnar committed Dec 9, 2024
1 parent 636666a commit 0cf981d
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion kernel/events/uprobes.c
Original file line number Diff line number Diff line change
Expand Up @@ -2116,12 +2116,12 @@ static void cleanup_return_instances(struct uprobe_task *utask, bool chained,

while (ri && !arch_uretprobe_is_alive(ri, ctx, regs)) {
ri_next = ri->next;
rcu_assign_pointer(utask->return_instances, ri_next);
utask->depth--;

free_ret_instance(ri, true /* cleanup_hprobe */);
ri = ri_next;
}
rcu_assign_pointer(utask->return_instances, ri);
}

static void prepare_uretprobe(struct uprobe *uprobe, struct pt_regs *regs,
Expand Down

0 comments on commit 0cf981d

Please sign in to comment.