Masami Hiramatsu
d59fae6fea
tracing/kprobe: Fix NULL pointer access in trace_porbe_unlink()
Fix NULL pointer access in trace_probe_unlink() by initializing
trace_probe.list correctly in trace_probe_init().
In the error case of trace_probe_init(), it can call trace_probe_unlink()
before initializing trace_probe.list member. This causes NULL pointer
dereference at list_del_init() in trace_probe_unlink().
Syzbot reported :
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8633 Comm: syz-executor797 Not tainted 5.3.0-rc8-next-20190915
#0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:__list_del_entry_valid+0x85/0xf5 lib/list_debug.c:51
Code: 0f 84 e1 00 00 00 48 b8 22 01 00 00 00 00 ad de 49 39 c4 0f 84 e2 00
00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 75
53 49 8b 14 24 4c 39 f2 0f 85 99 00 00 00 49 8d 7d
RSP: 0018:ffff888090a7f9d8 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff88809b6f90c0 RCX: ffffffff817c0ca9
RDX: 0000000000000000 RSI: ffffffff817c0a73 RDI: ffff88809b6f90c8
RBP: ffff888090a7f9f0 R08: ffff88809a04e600 R09: ffffed1015d26aed
R10: ffffed1015d26aec R11: ffff8880ae935763 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88809b6f90c0 R15: ffff88809b6f90d0
FS: 0000555556f99880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006cc090 CR3: 00000000962b2000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry include/linux/list.h:131 [inline]
list_del_init include/linux/list.h:190 [inline]
trace_probe_unlink+0x1f/0x200 kernel/trace/trace_probe.c:959
trace_probe_cleanup+0xd3/0x110 kernel/trace/trace_probe.c:973
trace_probe_init+0x3f2/0x510 kernel/trace/trace_probe.c:1011
alloc_trace_uprobe+0x5e/0x250 kernel/trace/trace_uprobe.c:353
create_local_trace_uprobe+0x109/0x4a0 kernel/trace/trace_uprobe.c:1508
perf_uprobe_init+0x131/0x210 kernel/trace/trace_event_perf.c:314
perf_uprobe_event_init+0x106/0x1a0 kernel/events/core.c:8898
perf_try_init_event+0x135/0x590 kernel/events/core.c:10184
perf_init_event kernel/events/core.c:10228 [inline]
perf_event_alloc.part.0+0x1b89/0x33d0 kernel/events/core.c:10505
perf_event_alloc kernel/events/core.c:10887 [inline]
__do_sys_perf_event_open+0xa2d/0x2d00 kernel/events/core.c:10989
__se_sys_perf_event_open kernel/events/core.c:10871 [inline]
__x64_sys_perf_event_open+0xbe/0x150 kernel/events/core.c:10871
do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Link: http://lkml.kernel.org/r/156869709721.22406.5153754822203046939.stgit@devnote2
Reported-by: syzbot+2f807f4d3a2a4e87f18f@syzkaller.appspotmail.com
Fixes: ca89bc071d ("tracing/kprobe: Add multi-probe per event support")
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
|
2019-09-17 11:21:29 -04:00 |
| .. |
|
blktrace.c
|
blktrace: no need to check return value of debugfs_create functions
|
2019-06-03 15:39:39 +02:00 |
|
bpf_trace.c
|
bpf: fix compiler warning with CONFIG_MODULES=n
|
2019-06-26 14:44:07 +02:00 |
|
fgraph.c
|
tracing: Fix ftrace_graph_get_ret_stack() to use task and not current
|
2018-12-22 08:21:03 -05:00 |
|
ftrace.c
|
ftrace: Simplify ftrace hash lookup code in clear_func_from_hash()
|
2019-09-17 11:21:20 -04:00 |
|
ftrace_internal.h
|
ftrace: Create new ftrace_internal.h header
|
2018-12-08 20:54:06 -05:00 |
|
Kconfig
|
The main changes in this release include:
|
2019-07-18 11:51:00 -07:00 |
|
Makefile
|
tracing: Add unified dynamic event framework
|
2018-12-08 20:54:09 -05:00 |
|
power-traces.c
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
preemptirq_delay_test.c
|
tracing: Use trace_clock_local() for looping in preemptirq_delay_test.c
|
2018-10-17 15:35:33 -04:00 |
|
ring_buffer.c
|
ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS
|
2019-05-28 09:36:19 -04:00 |
|
ring_buffer_benchmark.c
|
ring-buffer: Fix mispelling of Calculate
|
2019-05-08 12:15:12 -04:00 |
|
rpm-traces.c
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
trace.c
|
tracing: Rename tracing_reset() to tracing_reset_cpu()
|
2019-08-31 12:19:40 -04:00 |
|
trace.h
|
tracing: Rename tracing_reset() to tracing_reset_cpu()
|
2019-08-31 12:19:40 -04:00 |
|
trace_benchmark.c
|
rcu: Rename cond_resched_rcu_qs() to cond_resched_tasks_rcu_qs()
|
2018-05-15 10:27:29 -07:00 |
|
trace_benchmark.h
|
tracing: Fix SPDX format headers to use C++ style comments
|
2018-08-16 19:08:06 -04:00 |
|
trace_branch.c
|
x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP
|
2019-04-03 11:02:24 +02:00 |
|
trace_clock.c
|
tracing: Add SPDX License format tags to tracing files
|
2018-08-16 19:08:06 -04:00 |
|
trace_dynevent.c
|
tracing/dynevent: Pass extra arguments to match operation
|
2019-08-31 12:19:38 -04:00 |
|
trace_dynevent.h
|
tracing/dynevent: Pass extra arguments to match operation
|
2019-08-31 12:19:38 -04:00 |
|
trace_entries.h
|
tracing: Change the function format to display function names by perf
|
2019-02-11 14:53:43 -05:00 |
|
trace_event_perf.c
|
tracing: Pass type into tracing_generic_entry_update()
|
2019-07-16 15:14:48 -04:00 |
|
trace_events.c
|
tracing: Make exported ftrace_set_clr_event non-static
|
2019-08-31 06:51:49 -04:00 |
|
trace_events_filter.c
|
The main changes in this release include:
|
2019-07-18 11:51:00 -07:00 |
|
trace_events_filter_test.h
|
tracing: Fix SPDX format headers to use C++ style comments
|
2018-08-16 19:08:06 -04:00 |
|
trace_events_hist.c
|
tracing: Make sure variable reference alias has correct var_ref_idx
|
2019-09-17 11:21:29 -04:00 |
|
trace_events_trigger.c
|
tracing: Add trace_array parameter to create_event_filter()
|
2019-04-08 09:22:28 -04:00 |
|
trace_export.c
|
tracing: Add trigger file for trace_markers tracefs/ftrace/print
|
2018-05-29 08:28:53 -04:00 |
|
trace_functions.c
|
tracing: Update stack trace skipping for ORC unwinder
|
2018-01-23 15:57:00 -05:00 |
|
trace_functions_graph.c
|
fgraph: Remove redundant ftrace_graph_notrace_addr() test
|
2019-07-30 21:50:03 -04:00 |
|
trace_hwlat.c
|
sched/core: Provide a pointer to the valid CPU mask
|
2019-06-03 11:49:37 +02:00 |
|
trace_irqsoff.c
|
The biggest change for this release is in the histogram code.
|
2019-03-11 17:01:32 -07:00 |
|
trace_kdb.c
|
tracing: Silence GCC 9 array bounds warning
|
2019-05-25 23:04:30 -04:00 |
|
trace_kprobe.c
|
tracing/probe: Add immediate string parameter support
|
2019-08-31 12:19:39 -04:00 |
|
trace_kprobe_selftest.c
|
selftest/ftrace: Move kprobe selftest function to separate compile unit
|
2018-07-30 18:41:04 -04:00 |
|
trace_kprobe_selftest.h
|
tracing: Fix SPDX format headers to use C++ style comments
|
2018-08-16 19:08:06 -04:00 |
|
trace_mmiotrace.c
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
trace_nop.c
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
trace_output.c
|
tracing: Be more clever when dumping hex in __print_hex()
|
2019-09-17 11:21:28 -04:00 |
|
trace_output.h
|
tracing: Fix SPDX format headers to use C++ style comments
|
2018-08-16 19:08:06 -04:00 |
|
trace_preemptirq.c
|
kprobes: Prohibit probing on hardirq tracers
|
2019-02-13 08:16:40 +01:00 |
|
trace_printk.c
|
tracing: Trivia spelling fix containerof() -> container_of()
|
2018-09-26 12:21:00 +03:00 |
|
trace_probe.c
|
tracing/kprobe: Fix NULL pointer access in trace_porbe_unlink()
|
2019-09-17 11:21:29 -04:00 |
|
trace_probe.h
|
tracing/probe: Add immediate string parameter support
|
2019-08-31 12:19:39 -04:00 |
|
trace_probe_tmpl.h
|
tracing/probe: Support user-space dereference
|
2019-05-25 23:04:42 -04:00 |
|
trace_sched_switch.c
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
trace_sched_wakeup.c
|
tracing: Add conditional snapshot
|
2019-02-20 13:51:06 -05:00 |
|
trace_selftest.c
|
function_graph: Have selftest also emulate tr->reset() as it did with tr->init()
|
2019-04-21 19:46:56 -04:00 |
|
trace_selftest_dynamic.c
|
ftrace: Mark function tracer test functions noinline/noclone
|
2018-01-23 15:57:29 -05:00 |
|
trace_seq.c
|
tracing: Add SPDX License format tags to tracing files
|
2018-08-16 19:08:06 -04:00 |
|
trace_stack.c
|
tracing: Document the stack trace algorithm in the comments
|
2019-08-31 12:19:40 -04:00 |
|
trace_stat.c
|
License cleanup: add SPDX GPL-2.0 license identifier to files with no license
|
2017-11-02 11:10:55 +01:00 |
|
trace_stat.h
|
tracing: Fix SPDX format headers to use C++ style comments
|
2018-08-16 19:08:06 -04:00 |
|
trace_syscalls.c
|
syscalls: Remove start and number from syscall_get_arguments() args
|
2019-04-05 09:26:43 -04:00 |
|
trace_uprobe.c
|
tracing/probe: Add immediate string parameter support
|
2019-08-31 12:19:39 -04:00 |
|
tracing_map.c
|
tracing: Add SPDX License format tags to tracing files
|
2018-08-16 19:08:06 -04:00 |
|
tracing_map.h
|
tracing: Fix SPDX format headers to use C++ style comments
|
2018-08-16 19:08:06 -04:00 |