Re: [RFC PATCH v2 11/13] mm/kwatch: add debugfs control plane

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Use-After-Free in kwatch context pool due to delayed kretprobe exit handlers
--

--- Patch [11]: [RFC PATCH v2 11/13] mm/kwatch: add debugfs control plane ---
commit 7abbeb0e0111172be94e0f025440e5d06358c7a1
Author: Jinchao Wang <wangjinchao600@gmail.com>

mm/kwatch: add debugfs control plane
    
Wire the pieces together behind a single debugfs file.
Add the Kconfig entry and hook mm/kwatch into the mm build.

> diff --git a/mm/kwatch/core.c b/mm/kwatch/core.c
> new file mode 100644
> index 0000000000000..d8526d5aae5cd
> --- /dev/null
> +++ b/mm/kwatch/core.c
[ ... ]
> @@ -0,0 +1,324 @@
> +static void kwatch_stop_watching(void)
> +{
> +	watching_active = false;
> +
> +	kwatch_anchor_stop();
> +	/* after kthread_stop: the dead thread cannot re-mark expiry */
> +	kwatch_anchor_clear_expired();
> +
> +	kwatch_probe_stop();
> +	synchronize_rcu();
> +	kwatch_tsk_ctx_release_wps();
> +	/*
> +	 * Waits for disarm IPIs and unregisters breakpoints: no #DB can
> +	 * reach the ctx pool once this returns.
> +	 */
> +	kwatch_hwbp_free();
> +	kwatch_tsk_ctx_free();

[Severity: Critical]
Is it possible for a sleeping task to access the context pool after it gets
freed here?

If a task enters a watched function that can sleep, it triggers the kretprobe
entry handler and goes to sleep. When the user stops watching, this code
unregisters the probe and calls synchronize_rcu(). Since the sleeping task is
not in an RCU read-side critical section, synchronize_rcu() can return without
waiting for the task to wake up.

The kwatch_ctx_pool is then freed. When the sleeping task eventually wakes up
and returns from the watched function, its kretprobe exit trampoline executes
kwatch_lifecycle_exit(). That exit handler calls kwatch_tsk_ctx_get(), which
dereferences the freed pool, resulting in a use-after-free regression.

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260717125023.1895892-1-wangjinchao600@gmail.com?part=11