github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-29 04:22:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fprobe: Terminate the fgraph_data list when the reservation is not filled

Browse Source 
fprobe_fgraph_entry() reserves shadow stack space for every fprobe with
an exit handler, but only fills it for those whose entry handler returns
0. fgraph_reserve_data() does not clear the area, so fprobe_return()
parses the unused tail as headers left over from an earlier call, and an
exit handler can run twice or despite its entry handler asking to skip
it.

Write a zero word after the last entry to terminate the walk. A zeroed
slot does not decode to a NULL fprobe on the arches that encode the
header into one unsigned long, since arch_decode_fprobe_header_fp() ORs
in FPROBE_HEADER_MSB_PATTERN, so make read_fprobe_header() return NULL
for a zeroed slot.

Link: https://lore.kernel.org/all/20260917212407.384468-1-devnexen@gmail.com/

Fixes: e0a384434a ("tracing: fprobe: do not zero out unused fgraph_data")
Cc: stable@vger.kernel.org
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
This commit is contained in:
David Carlier 2026-09-17 22:24:07 +01:00 committed by Masami Hiramatsu (Google)
parent d22c3e0088
commit 1d653a1839
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
kernel/trace/fprobe.c
View File

@ -171,6 +171,11 @@ static inline bool write_fprobe_header(unsigned long *stack,
static inline void read_fprobe_header(unsigned long *stack,
struct fprobe **fp, unsigned int *size_words)
{
if (!*stack) {
*fp = NULL;
*size_words = 0;
return;
}
*fp = arch_decode_fprobe_header_fp(*stack);
*size_words = arch_decode_fprobe_header_size(*stack);
}
@ -203,6 +208,12 @@ static inline void read_fprobe_header(unsigned long *stack,
{
struct __fprobe_header *fph = (struct __fprobe_header *)stack;
if (!*stack) {
*fp = NULL;
*size_words = 0;
return;
}
*fp = fph->fp;
*size_words = fph->size_words;
}
@ -635,6 +646,10 @@ static int fprobe_fgraph_entry(struct ftrace_graph_ent *trace, struct fgraph_ops
}
}
/* Terminate the list, fgraph_reserve_data() does not clear it. */
if (used && used < reserved_words)
fgraph_data[used] = 0;
/* If any exit_handler is set, data must be used. */
return used != 0;
}