user_event_enabler_exists() performs a plain traversal of the per-mm enabler list. Registration invokes it while holding the event group's reg_mutex, which serializes registration and unregister operations from that group.
However, deferred fault cleanup can remove an enabler asynchronously while holding event_mutex without holding the group reg_mutex. The plain list traversal can therefore race with list_del_rcu() despite the registration mutex being held. Take event_mutex around user_event_enabler_exists() so the traversal is serialized with all enabler removal paths. Pass the group into current_user_event_enabler_exists() and assert that its reg_mutex is already held. This preserves the established lock order of group->reg_mutex followed by event_mutex. Signed-off-by: Jeff Barnes <[email protected]> --- kernel/trace/trace_events_user.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c index f658c3a77aa7..24983f68d075 100644 --- a/kernel/trace/trace_events_user.c +++ b/kernel/trace/trace_events_user.c @@ -890,16 +890,21 @@ void user_event_mm_dup(struct task_struct *t, struct user_event_mm *old_mm) user_event_mm_destroy(mm); } -static bool current_user_event_enabler_exists(unsigned long uaddr, - unsigned char bit) +static bool +current_user_event_enabler_exists(struct user_event_group *group, + unsigned long uaddr, unsigned char bit) { struct user_event_mm *user_mm = current_user_event_mm(); bool exists; + lockdep_assert_held(&group->reg_mutex); + if (!user_mm) return false; + mutex_lock(&event_mutex); exists = user_event_enabler_exists(user_mm, uaddr, bit); + mutex_unlock(&event_mutex); user_event_mm_put(user_mm); @@ -2510,7 +2515,8 @@ static long user_events_ioctl_reg(struct user_event_file_info *info, * for user processes that is far easier to debug if this is explicitly * an error upon registering. */ - if (current_user_event_enabler_exists((unsigned long)reg.enable_addr, + if (current_user_event_enabler_exists(info->group, + (unsigned long)reg.enable_addr, reg.enable_bit)) return -EADDRINUSE; -- 2.43.0
