github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
fd89b0be55
linux/kernel/trace
History
Michael Wu c3730b8373 tracing: Fix race between update_event_fields and, event_define_fields 
The following sequence may leads race between event_define_fields()
and update_event_fields():

 CPU0 (loads module A)                      CPU1 (loads module B)
 ===============================            ===============================
 load_module(A)                             load_module(B)
   notifier_call_chain                        notifier_call_chain
     trace_module_notify                        trace_module_notify
       mutex_lock(&event_mutex)                   trace_event_update_all()
         trace_module_add_events(A)                 down_write(&trace_event_sem)
            __register_event(call_A)
              __add_event_to_tracers(call_A)
                event_define_fields(call_A)
                  for each f:                         list_for_each_entry(field,
                    list_add(&f->link,                                    &class->fields, link)
                             &class->fields)            field = class->fields->next;

Where access to the class->fields is not protected by the event_mutex in
trace_event_update_all().

This produces the following panic:
   Unable to handle kernel access ... at virtual address 0000000000000018
   pc : update_event_fields+0xf8/0x368
   Call trace:
    update_event_fields+0xf8/0x368
    trace_event_update_all+0x7c/0x2b4
    trace_module_notify+0x4c/0x1dc
    notifier_call_chain+0x84/0x168
    blocking_notifier_call_chain_robust+0x64/0xd4
    load_module+0x10c8/0x123c
    __arm64_sys_finit_module+0x230/0x31c

Fix by taking event_mutex in trace_event_update_all() before
trace_event_sem.

Cc: stable@vger.kernel.org
Fixes: b3bc8547d3 ("tracing: Have TRACE_DEFINE_ENUM affect trace event types as well")
Link: https://patch.msgid.link/2e5730d2-c631-da41-3a3a-ae35bb4895f3@allwinnertech.com
Signed-off-by: Michael Wu <michael@allwinnertech.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-08-13 15:38:25 -04:00
..
rv rv: Use 0 to check preemption enabled in opid 2026-06-03 12:33:25 +02:00
blktrace.c block-7.0-20260305 2026-03-06 08:36:18 -08:00
bpf_trace.c bpf: Add missing access_ok call to copy_user_syms 2026-06-21 18:01:33 -07:00
bpf_trace.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
error_report-traces.c
fgraph.c fgraph: Do not call handlers direct when not using ftrace_ops 2026-02-19 15:21:22 -05:00
fprobe.c fprobe: Fix module reference count leak on error in register_fprobe() 2026-07-29 22:50:02 +09:00
ftrace_internal.h function_graph: Make fgraph_update_pid_func() a stub for !DYNAMIC_FTRACE 2024-06-10 18:08:23 -04:00
ftrace.c ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() 2026-08-08 22:22:41 -04:00
Kconfig ring-buffer: Add persistent ring buffer invalid-page inject test 2026-05-28 22:40:51 -04:00
kprobe_event_gen_test.c
Makefile tracing: Updates for v7.2: 2026-06-18 20:53:00 -07:00
pid_list.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pid_list.h trace/pid_list: optimize pid_list->lock contention 2025-11-13 15:15:54 -05:00
power-traces.c PM: cpufreq: powernv/tracing: Move powernv_throttle trace event 2025-07-21 16:40:56 -04:00
preemptirq_delay_test.c kernel: trace: preemptirq_delay_test: use offstack cpu mask 2025-07-08 18:17:38 -04:00
remote_test_events.h tracing: Add a trace remote module for testing 2026-03-09 12:33:55 -04:00
remote_test.c tracing: Fix desc in error path for the trace remote test module 2026-05-16 16:11:04 -04:00
rethook.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ring_buffer_benchmark.c tracing: Fix typo in ring_buffer_benchmark.c 2025-12-05 15:43:40 -05:00
ring_buffer.c ring-buffer: Fix crash passing ERR_PTR to kthread_stop() 2026-08-08 22:26:30 -04:00
rpm-traces.c
simple_ring_buffer.c tracing: Fix unload_page for simple_ring_buffer init rollback 2026-05-21 08:26:22 -04:00
synth_event_gen_test.c
trace_benchmark.c tracing: Improve benchmark test performance by using do_div() 2024-05-13 20:00:57 -04:00
trace_benchmark.h
trace_boot.c tracing: Make the backup instance non-reusable 2026-04-02 13:20:38 -04:00
trace_branch.c tracing/branch: Use pr_warn() instead of printk(KERN_WARNING) 2026-05-21 18:03:08 -04:00
trace_btf.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_btf.h
trace_clock.c tracing: Use atomic64_inc_return() in trace_clock_counter() 2024-10-09 19:59:49 -04:00
trace_dynevent.c tracing: Report wrong dynamic event command 2025-11-10 19:26:14 -05:00
trace_dynevent.h tracing: probes: Fix a possible race in trace_probe_log APIs 2025-05-13 22:23:34 +09:00
trace_entries.h tracing: Fix ftrace event field alignments 2026-02-05 09:47:11 -05:00
trace_eprobe.c tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() 2026-07-21 10:23:21 +09:00
trace_event_perf.c perf/ftrace: Fix WARNING in __unregister_ftrace_function 2026-05-29 11:27:40 -04:00
trace_events_filter_test.h
trace_events_filter.c tracing/filters: Fix false positive match in regex_match_full() 2026-07-29 14:32:11 -04:00
trace_events_hist.c tracing: Fix use-after-free freeing trigger private data 2026-07-24 18:49:51 -04:00
trace_events_inject.c tracing: Have format file honor EVENT_FILE_FL_FREED 2024-08-07 18:12:46 -04:00
trace_events_synth.c tracing/synthetic: Free type string on error path 2026-07-07 13:59:55 -04:00
trace_events_trigger.c tracing: Delay module ref count for "enable_event" trigger 2026-07-24 18:49:51 -04:00
trace_events_user.c tracing/user_events: Fix use-after-free in user_event_mm_dup() 2026-07-07 13:59:35 -04:00
trace_events.c tracing: Fix race between update_event_fields and, event_define_fields 2026-08-13 15:38:25 -04:00
trace_export.c tracing: Fix ftrace event field alignments 2026-02-05 09:47:11 -05:00
trace_fprobe.c tracing/fprobe: Roll back on enable_trace_fprobe() failure 2026-07-29 00:27:52 +09:00
trace_functions_graph.c fgraph: Fix thresh_return nosleeptime double-adjust 2026-03-03 22:11:20 -05:00
trace_functions.c tracing: Fix NULL pointer dereference in func_set_flag() 2026-07-07 10:42:28 -04:00
trace_hwlat.c tracing: Fix false sharing in hwlat get_sample() 2026-02-10 03:36:39 -05:00
trace_irqsoff.c tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_kdb.c tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_kprobe_selftest.c
trace_kprobe_selftest.h
trace_kprobe.c tracing updates for v7.1: 2026-04-17 09:43:12 -07:00
trace_mmiotrace.c tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions 2026-07-29 14:27:55 -04:00
trace_nop.c
trace_osnoise.c tracing/osnoise: Call synchronize_rcu() when unregistering 2026-07-06 14:56:18 -04:00
trace_output.c tracing updates for v7.1: 2026-04-17 09:43:12 -07:00
trace_output.h tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_pid.c tracing: Move pid filtering into trace_pid.c 2026-02-08 21:01:13 -05:00
trace_preemptirq.c tracing: Add a no-rcu-check version of trace_##event##_enabled() 2026-07-07 10:42:29 -04:00
trace_printk.c tracing: move __printf() attribute on __ftrace_vbprintk() 2026-03-23 20:16:45 -04:00
trace_probe_kernel.h
trace_probe_tmpl.h tracing/fprobe: Enable fprobe events with CONFIG_DYNAMIC_FTRACE_WITH_ARGS 2024-12-26 10:50:04 -05:00
trace_probe.c tracing/probes: Reject $arg0 in meta argument expansion 2026-07-28 23:58:31 +09:00
trace_probe.h tracing: probes: fix typo in a log message 2026-06-25 08:34:45 +09:00
trace_recursion_record.c tracing: Switch trace_recursion_record.c code over to use guard() 2026-05-21 18:03:07 -04:00
trace_remote.c tracing: Propagate errors from remote event bulk updates 2026-07-23 12:30:07 -04:00
trace_sched_switch.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_sched_wakeup.c tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_selftest_dynamic.c
trace_selftest.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_seq.c tracing: Add bitmask-list option for human-readable bitmask display 2026-01-26 17:00:50 -05:00
trace_snapshot.c tracing: Remove duplicate latency_fsnotify() stub 2026-03-31 14:58:39 -04:00
trace_stack.c tracing updates for v6.16: 2025-05-29 21:04:36 -07:00
trace_stat.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_stat.h
trace_synth.h
trace_syscalls.c tracing: perf: Fix stale head for perf syscall tracing 2026-07-24 22:57:56 -04:00
trace_uprobe.c tracing: Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions 2026-06-01 23:35:21 +09:00
trace.c ftrace: Drop extra comma in trace_buffered_event_enable 2026-08-08 11:21:32 -04:00
trace.h tracing: Fix use-after-free freeing trigger private data 2026-07-24 18:49:51 -04:00
tracing_map.c tracing: Simplify pages allocation for tracing_map logic 2026-05-21 18:12:10 -04:00
tracing_map.h tracing: Simplify pages allocation for tracing_map logic 2026-05-21 18:12:10 -04:00
undefsyms_base.c tracing: Make undefsyms_base.c a first-class citizen 2026-04-22 11:24:41 -04:00