ftrace_direct_init() assigns kthread_run()'s return value to simple_tsk
without an IS_ERR() check. When kthread_run() fails it returns
ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with
simple_tsk holding an error pointer. On unload, ftrace_direct_exit()
then passes that ERR_PTR to kthread_stop(), leading to a
null-pointer-dereference.
Check the return value of kthread_run() with IS_ERR(); on failure,
unregister the ftrace direct call and propagate the error code.
Fixes: ae0cc3b7e7f5 ("ftrace/samples: Add a sample module that implements
modify_ftrace_direct()")
Signed-off-by: Haotian Zhang <[email protected]>
---
samples/ftrace/ftrace-direct-modify.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/samples/ftrace/ftrace-direct-modify.c
b/samples/ftrace/ftrace-direct-modify.c
index da3a9f2091f5..2795ea12cdf9 100644
--- a/samples/ftrace/ftrace-direct-modify.c
+++ b/samples/ftrace/ftrace-direct-modify.c
@@ -320,8 +320,13 @@ static int __init ftrace_direct_init(void)
ftrace_set_filter_ip(&direct, (unsigned long) my_ip, 0, 0);
ret = register_ftrace_direct(&direct, my_tramp);
- if (!ret)
+ if (!ret) {
simple_tsk = kthread_run(simple_thread, NULL,
"event-sample-fn");
+ if (IS_ERR(simple_tsk)) {
+ unregister_ftrace_direct(&direct, my_tramp, true);
+ ret = PTR_ERR(simple_tsk);
+ }
+ }
return ret;
}
--
2.43.0
