[for-next][PATCH 09/11] tracing: Fix syscall tracepoint use-after-free

[Steven Rostedt]

From: Mathieu Desnoyers <mathieu.desnoy...@efficios.com>

The grace period used internally within tracepoint.c:release_probes()
uses call_rcu() to batch waiting for quiescence of old probe arrays,
rather than using the tracepoint_synchronize_unregister() which blocks
while waiting for quiescence.

With the introduction of faultable syscall tracepoints, this causes
use-after-free issues reproduced with syzkaller.

Fix this by using the appropriate call_rcu() or call_rcu_tasks_trace()
before invoking the rcu_free_old_probes callback. This can be chosen
using the tracepoint_is_faultable() API.

A similar issue exists in bpf use of call_rcu(). Fixing this is left to
a separate change.

Reported-by: syzbot+b390c8062d8387b62...@syzkaller.appspotmail.com
Fixes: a363d27cdbc2 ("tracing: Allow system call tracepoints to handle page 
faults")
Tested-by: Jordan Rife <jr...@google.com>
Cc: Michael Jeanson <mjean...@efficios.com>
Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Masami Hiramatsu <mhira...@kernel.org>
Cc: Peter Zijlstra <pet...@infradead.org>
Cc: Alexei Starovoitov <a...@kernel.org>
Cc: Yonghong Song <y...@fb.com>
Cc: Paul E. McKenney <paul...@kernel.org>
Cc: Ingo Molnar <mi...@redhat.com>
Cc: Arnaldo Carvalho de Melo <a...@kernel.org>
Cc: Mark Rutland <mark.rutl...@arm.com>
Cc: Alexander Shishkin <alexander.shish...@linux.intel.com>
Cc: Namhyung Kim <namhy...@kernel.org>
Cc: Andrii Nakryiko <andrii.nakry...@gmail.com>
Cc: b...@vger.kernel.org
Cc: Joel Fernandes <j...@joelfernandes.org>
Cc: Jordan Rife <jr...@google.com>
Cc: linux-trace-kernel@vger.kernel.org
Link: 
https://lore.kernel.org/20241031152056.744137-4-mathieu.desnoy...@efficios.com
Signed-off-by: Mathieu Desnoyers <mathieu.desnoy...@efficios.com>
Signed-off-by: Steven Rostedt (Google) <rost...@goodmis.org>
---
 kernel/tracepoint.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index 5658dc92f5b5..1848ce7e2976 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -106,13 +106,16 @@ static void rcu_free_old_probes(struct rcu_head *head)
        kfree(container_of(head, struct tp_probes, rcu));
 }
 
-static inline void release_probes(struct tracepoint_func *old)
+static inline void release_probes(struct tracepoint *tp, struct 
tracepoint_func *old)
 {
        if (old) {
                struct tp_probes *tp_probes = container_of(old,
                        struct tp_probes, probes[0]);
 
-               call_rcu(&tp_probes->rcu, rcu_free_old_probes);
+               if (tracepoint_is_faultable(tp))
+                       call_rcu_tasks_trace(&tp_probes->rcu, 
rcu_free_old_probes);
+               else
+                       call_rcu(&tp_probes->rcu, rcu_free_old_probes);
        }
 }
 
@@ -334,7 +337,7 @@ static int tracepoint_add_func(struct tracepoint *tp,
                break;
        }
 
-       release_probes(old);
+       release_probes(tp, old);
        return 0;
 }
 
@@ -405,7 +408,7 @@ static int tracepoint_remove_func(struct tracepoint *tp,
                WARN_ON_ONCE(1);
                break;
        }
-       release_probes(old);
+       release_probes(tp, old);
        return 0;
 }
 
-- 
2.45.2