Added Jiri as he works on this code.
On Sun, 17 May 2026 06:24:11 +0000 Afi0 <[email protected]> wrote: > Hi list, > > Apologies for initially sending only to Greg. Resending to the full list as > requested. > ------------------------------ > > Component: kernel/trace/ftrace.c Function: __modify_ftrace_direct() > Affected versions: Linux kernel 5.15+ Type: TOCTOU / Race condition CVSS > 3.1: AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - 7.8 (High) > > SUMMARY > > A race condition exists in __modify_ftrace_direct() between the > registration of tmp_ops into ftrace_ops_list and the subsequent update of > direct_functions hash entries. During this window, concurrent CPUs > executing traced functions will read the stale direct call address via > ftrace_find_rec_direct() and jump to it, while the caller may have already > invalidated or freed the old trampoline memory. What the above doesn't describe is how the direct was stale to begin with. Before the assignment, it should be NULL and not a problem, and if was being modified, the current trampoline that direct points to should *NOT* be freed before calling this. Otherwise, that itself is a bug. -- Steve > > VULNERABLE CODE > > err = register_ftrace_function_nolock(&tmp_ops);[race window: > ftrace_ops_list_func now active, direct_functions not yet > updated]mutex_lock(&ftrace_lock);entry->direct = addr; /* update > happens here, too late */mutex_unlock(&ftrace_lock); > > IMPACT > > CPU executing traced function reads stale direct_functions entry during the > race window. arch_ftrace_set_direct_caller() redirects execution to > potentially freed or invalidated trampoline memory. Use-after-free in > executable code context on SMP systems. > > TRIGGER > > Requires CAP_PERFMON or CAP_SYS_ADMIN directly. Also reachable via BPF > trampolines (kernel/bpf/trampoline.c calls __modify_ftrace_direct() > internally) with CAP_BPF + CAP_PERFMON, default in many CI/CD container > runtimes. Live patching via klp_patch_func() also goes through this path. > > SUGGESTED FIX > > Update entry->direct under ftrace_lock BEFORE registering tmp_ops. Add > smp_wmb() between the store and registration to ensure ordering on > weakly-ordered architectures. > > Patch attached as 0001-ftrace-fix-race-in-__modify_ftrace_direct.patch > > Fixes: 0567d6809440 ("ftrace: Add modify_ftrace_direct()") > > Thanks, > > Afi0
