The following sequence may leads race between event_define_fields()
and update_event_fields():
CPU0 (module A, pri=1 notifier) CPU1 (module B, pri=0 notifier)
=============================== ===============================
event_define_fields(call_A) trace_event_update_all()
for each f: list_for_each_entry(...,
list_add(&f->link, &ftrace_events)
&class->fields) -> finds call_A
f->link.next = next; (2)
update_event_fields(call_A)
WRITE_ONCE(class->fields->next,
&f->link); (4)
list_for_each_entry(field,
&class->fields, link)
-> field = class->fields->next
= &f->link
= f (offset 0)
-> arm64 weak ordering:
(4) visible before (2)
field->link.next == 0
-> next iteration:
field = (void *)0 = NULL
-> crash at NULL->type (0x18)
This produces the following panic:
Unable to handle kernel access ... at virtual address 0000000000000018
pc : update_event_fields+0xf8/0x368
Call trace:
update_event_fields+0xf8/0x368
trace_event_update_all+0x7c/0x2b4
trace_module_notify+0x4c/0x1dc
notifier_call_chain+0x84/0x168
blocking_notifier_call_chain_robust+0x64/0xd4
load_module+0x10c8/0x123c
__arm64_sys_finit_module+0x230/0x31c
Fix by taking event_mutex in trace_event_update_all() before
trace_event_sem.
Fixes: b3bc8547d3be ("tracing: Have TRACE_DEFINE_ENUM affect trace event types
as well")
Cc: [email protected]
Signed-off-by: Michael Wu <[email protected]>
---
kernel/trace/trace_events.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 956692856fa8..9632788da5af 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -3566,6 +3566,7 @@ void trace_event_update_all(struct trace_eval_map **map,
int len)
int last_i;
int i;
+ mutex_lock(&event_mutex);
down_write(&trace_event_sem);
list_for_each_entry_safe(call, p, &ftrace_events, list) {
/* events are usually grouped together with systems */
@@ -3604,6 +3605,7 @@ void trace_event_update_all(struct trace_eval_map **map,
int len)
cond_resched();
}
up_write(&trace_event_sem);
+ mutex_unlock(&event_mutex);
}
static bool event_in_systems(struct trace_event_call *call,
--
2.29.0
