Probes fixes for v7.2-rc5:

- tracing/probes: Reject $arg0 in meta argument expansion
   Reject $arg0 during meta-argument expansion to prevent negative index
   calculation and out-of-bounds reading of traceprobe parameters.
 
 - tracing/fprobe: Roll back on enable_trace_fprobe() failure
   Add a rollback cleanup path when __register_trace_fprobe() fails
   partway through to unregister registered probes and clear flags or
   file links.
 
 - fprobe: Fix module reference count leak on error in register_fprobe()
   Ensure the module_put() cleanup loop runs even when get_ips_from_filter()
   returns an error, preventing module reference count leaks.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmpqCOQbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bL3MIAIDcYue5MYMYlTUAq2TF
 QIj0DszmO/moCiClZx4MjqG6I/saSYjxb6JND+FB+q5x7JHBJFzfe4Fu+rfHwXNU
 Z45nX2q8ccFhFEa2mvJvC8y5XvYCMgz3uZC4FGdXNFbOhM5wXGr+Gp4AgpCUd6LX
 PDoC164NaIodIEZ9rxHv3nulLNNLmM7ZmWZXNmHNLWL8YcJADiluVQbmx5b0b8IO
 j7ce+RHdtkhuHkQ093A+CkzineS9Zo7BhcFiphse6WoXOm1OFP46Dc5S/w3o3Mn+
 4dVHbbPOD6icLATzyH3LQn9xkRC1jgjZnINDFjszogHDUu23czrtjgpTVeUpoX5t
 5p0=
 =t4dL
 -----END PGP SIGNATURE-----

Merge tag 'probes-fixes-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull probes fixes from Masami Hiramatsu:

 - Reject $arg0 during meta-argument expansion to prevent negative index
   calculation and out-of-bounds reading of traceprobe parameters

 - Roll back on enable_trace_fprobe() failure

   Add a rollback cleanup path when __register_trace_fprobe() fails
   partway through to unregister registered probes and clear flags or
   file links

 - Fix module reference count leak on error in register_fprobe()

   Ensure the module_put() cleanup loop still runs even when
   get_ips_from_filter() returns an error, preventing module
   reference count leaks

* tag 'probes-fixes-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  fprobe: Fix module reference count leak on error in register_fprobe()
  tracing/fprobe: Roll back on enable_trace_fprobe() failure
  tracing/probes: Reject $arg0 in meta argument expansion
This commit is contained in:
Linus Torvalds 2026-07-29 17:02:11 -07:00
commit 11028ab628
3 changed files with 18 additions and 6 deletions

View File

@ -961,10 +961,8 @@ int register_fprobe(struct fprobe *fp, const char *filter, const char *notfilter
return -ENOMEM;
ret = get_ips_from_filter(filter, notfilter, addrs, mods, num);
if (ret < 0)
return ret;
ret = register_fprobe_ips(fp, addrs, ret);
if (ret >= 0)
ret = register_fprobe_ips(fp, addrs, ret);
for (int i = 0; i < num; i++) {
if (mods[i])

View File

@ -1481,11 +1481,21 @@ static int enable_trace_fprobe(struct trace_event_call *call,
list_for_each_entry(tf, trace_probe_probe_list(tp), tp.list) {
ret = __register_trace_fprobe(tf);
if (ret < 0)
return ret;
goto err;
}
}
return 0;
err:
/* Failed to enable one of them. Roll back all */
list_for_each_entry(tf, trace_probe_probe_list(tp), tp.list)
__unregister_trace_fprobe(tf);
if (file)
trace_probe_remove_file(tp, file);
else
trace_probe_clear_flag(tp, TP_FLAG_PROFILE);
return ret;
}
/*

View File

@ -1901,7 +1901,11 @@ const char **traceprobe_expand_meta_args(int argc, const char *argv[],
trace_probe_log_err(0, BAD_VAR);
return ERR_PTR(-ENOENT);
}
/* Note: $argN starts from $arg1 */
/* Note: $argN starts from $arg1, so $arg0 is invalid. */
if (n == 0) {
trace_probe_log_err(0, BAD_ARG_NUM);
return ERR_PTR(-EINVAL);
}
ret = sprint_nth_btf_arg(n - 1, type, buf + used,
bufsize - used, ctx);
if (ret < 0)