From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org> mainline inclusion from mainline-v6.15-rc7 commit fd837de3c9cb1a162c69bc1fb1f438467fe7f2f5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID30XE Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Since the shared trace_probe_log variable can be accessed and modified via probe event create operation of kprobe_events, uprobe_events, and dynamic_events, it should be protected. In the dynamic_events, all operations are serialized by `dyn_event_ops_mutex`. But kprobe_events and uprobe_events interfaces are not serialized. To solve this issue, introduces dyn_event_create(), which runs create() operation under the mutex, for kprobe_events and uprobe_events. This also uses lockdep to check the mutex is held when using trace_probe_log* APIs. Link: https://lore.kernel.org/all/174684868120.551552.3068655787654268804.stgit@de... Reported-by: Paul Cacheux <paulcacheux@gmail.com> Closes: https://lore.kernel.org/all/20250510074456.805a16872b591e2971a4d221@kernel.o... Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events") Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Conflicts: kernel/trace/trace_dynevent.c kernel/trace/trace_dynevent.h kernel/trace/trace_kprobe.c kernel/trace/trace_uprobe.c kernel/trace/trace_probe.c [The pre-patch d262271d0483 ("tracing/dynevent: Delegate parsing to create function") modified a lot of code unrelated to this issue, and since the pre-patch is part of a patch set with interdependencies, applying it could introduce risks. Therefore, skip the pre-patch, and apply direct adaptation here.] Signed-off-by: Tengda Wu <wutengda2@huawei.com> --- kernel/trace/trace_dynevent.c | 16 +++++++++++++++- kernel/trace/trace_dynevent.h | 1 + kernel/trace/trace_kprobe.c | 2 +- kernel/trace/trace_probe.c | 9 +++++++++ kernel/trace/trace_uprobe.c | 2 +- 5 files changed, 27 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c index 36dff580c79a..33d7057d83b0 100644 --- a/kernel/trace/trace_dynevent.c +++ b/kernel/trace/trace_dynevent.c @@ -15,7 +15,7 @@ #include "trace.h" #include "trace_dynevent.h" -static DEFINE_MUTEX(dyn_event_ops_mutex); +DEFINE_MUTEX(dyn_event_ops_mutex); static LIST_HEAD(dyn_event_ops_list); int dyn_event_register(struct dyn_event_operations *ops) @@ -76,6 +76,20 @@ int dyn_event_release(int argc, char **argv, struct dyn_event_operations *type) return ret; } +/* + * Locked version of event creation. The event creation must be protected by + * dyn_event_ops_mutex because of protecting trace_probe_log. + */ +int dyn_event_create(int argc, char **argv, struct dyn_event_operations *type) +{ + int ret; + + mutex_lock(&dyn_event_ops_mutex); + ret = type->create(argc, (const char **)argv); + mutex_unlock(&dyn_event_ops_mutex); + return ret; +} + static int create_dyn_event(int argc, char **argv) { struct dyn_event_operations *ops; diff --git a/kernel/trace/trace_dynevent.h b/kernel/trace/trace_dynevent.h index d6857a254ede..890cc4418842 100644 --- a/kernel/trace/trace_dynevent.h +++ b/kernel/trace/trace_dynevent.h @@ -98,6 +98,7 @@ void *dyn_event_seq_next(struct seq_file *m, void *v, loff_t *pos); void dyn_event_seq_stop(struct seq_file *m, void *v); int dyn_events_release_all(struct dyn_event_operations *type); int dyn_event_release(int argc, char **argv, struct dyn_event_operations *type); +int dyn_event_create(int argc, char **argv, struct dyn_event_operations *type); /* * for_each_dyn_event - iterate over the dyn_event list diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index 7895b72d5b3c..557f92bcc7ff 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c @@ -928,7 +928,7 @@ static int create_or_delete_trace_kprobe(int argc, char **argv) if (argv[0][0] == '-') return dyn_event_release(argc, argv, &trace_kprobe_ops); - ret = trace_kprobe_create(argc, (const char **)argv); + ret = dyn_event_create(argc, argv, &trace_kprobe_ops); return ret == -ECANCELED ? -EINVAL : ret; } diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index b0b9a093dcce..3e020511885c 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -143,9 +143,12 @@ static const struct fetch_type *find_fetch_type(const char *type) } static struct trace_probe_log trace_probe_log; +extern struct mutex dyn_event_ops_mutex; void trace_probe_log_init(const char *subsystem, int argc, const char **argv) { + lockdep_assert_held(&dyn_event_ops_mutex); + trace_probe_log.subsystem = subsystem; trace_probe_log.argc = argc; trace_probe_log.argv = argv; @@ -154,11 +157,15 @@ void trace_probe_log_init(const char *subsystem, int argc, const char **argv) void trace_probe_log_clear(void) { + lockdep_assert_held(&dyn_event_ops_mutex); + memset(&trace_probe_log, 0, sizeof(trace_probe_log)); } void trace_probe_log_set_index(int index) { + lockdep_assert_held(&dyn_event_ops_mutex); + trace_probe_log.index = index; } @@ -167,6 +174,8 @@ void __trace_probe_log_err(int offset, int err_type) char *command, *p; int i, len = 0, pos = 0; + lockdep_assert_held(&dyn_event_ops_mutex); + if (!trace_probe_log.argv) return; diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c index e12913203aa5..8a4e6e782d22 100644 --- a/kernel/trace/trace_uprobe.c +++ b/kernel/trace/trace_uprobe.c @@ -728,7 +728,7 @@ static int create_or_delete_trace_uprobe(int argc, char **argv) if (argv[0][0] == '-') return dyn_event_release(argc, argv, &trace_uprobe_ops); - ret = trace_uprobe_create(argc, (const char **)argv); + ret = dyn_event_create(argc, argv, &trace_uprobe_ops); return ret == -ECANCELED ? -EINVAL : ret; } -- 2.34.1