Re: [PATCH v2] samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch fixes an invalid pointer dereference resulting from a kthread_run() failure in ftrace-direct-multi-modify.c, but leaves the identical vulnerability unpatched in ftrace-direct-modify.c.
--

commit 7f181703b20421e482d5701113538a5a801d8141
Author: Haotian Zhang <vulab@iscas.ac.cn>

samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify

This commit fixes a bug in ftrace-direct-multi-modify.c where a failed
kthread_run() returns an error pointer that is later passed to kthread_stop()
during module unload. It adds proper error handling to unregister the direct
call and propagate the error.

> diff --git a/samples/ftrace/ftrace-direct-multi-modify.c b/samples/ftrace/ftrace-direct-multi-modify.c
> --- a/samples/ftrace/ftrace-direct-multi-modify.c
> +++ b/samples/ftrace/ftrace-direct-multi-modify.c
> @@ -364,9 +364,15 @@ static int __init ftrace_direct_multi_init(void)
>  
>  	ret = register_ftrace_direct(&direct, my_tramp);
>  
> -	if (!ret)
> -		simple_tsk = kthread_run(simple_thread, NULL, "event-sample-fn");
> -	return ret;
> +	if (ret)
> +		return ret;
> +	simple_tsk = kthread_run(simple_thread, NULL, "event-sample-fn");
> +	if (IS_ERR(simple_tsk)) {
> +		unregister_ftrace_direct(&direct, my_tramp, true);
> +		return PTR_ERR(simple_tsk);
> +	}
> +
> +	return 0;
>  }

[Severity: High]
This isn't a bug introduced by this patch, but does 
samples/ftrace/ftrace-direct-modify.c also need this exact same fix?

Looking at ftrace_direct_init() in samples/ftrace/ftrace-direct-modify.c, it
contains the identical unpatched pattern:

    if (!ret)
        simple_tsk = kthread_run(simple_thread, NULL, "event-sample-fn");
    return ret;

If kthread_run() fails under memory pressure, it returns an ERR_PTR. Because
the preceding ret is 0, the initialization function still returns success,
causing the module to load with simple_tsk holding an error pointer. 

When the module is unloaded, ftrace_direct_exit() will pass this ERR_PTR
directly to kthread_stop(), which can result in an invalid pointer
dereference and oops the kernel.

Should this same error handling update be applied to ftrace-direct-modify.c?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826015050.10772-1-vulab@iscas.ac.cn?part=1