Re: [PATCH v1] uprobe: Assign session ID before publishing consumer

[sashiko-bot@kernel.org]

> consumer_add() publishes a consumer on uprobe->consumers
> before assigning its session ID.  handler_chain() traverses the consumer
> list under the trace RCU read-side critical section and can therefore
> observe the new consumer while uc->id still contains its initial value.
> 
> The race is reachable when an uprobe at the same inode:offset is already
> active and a task hits its entry breakpoint while another CPU registers a
> second session consumer.  handler_chain() may store the stale ID in the
> return_instance consumer array.  By the time the function returns,
> uc->id has been assigned a nonzero value, so return_consumer_find() fails
> to match the saved ID and the session ret_handler is incorrectly skipped.
> 
> consumer_rwsem does not close this window because handler_chain() is an RCU
> reader and does not take that rwsem.  Assign the ID before list_add_rcu()
> publishes the consumer; the release publish of the list node then orders
> the initialized ID before readers that traverse the list.
> 
> Found during a static-analysis-assisted audit: candidate sites were
> surfaced by a Coccinelle rule, and the reader/writer paths were
> confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
> not observed at runtime; it is identified by code inspection only.
> 
> Fixes: 4d756095d399 ("uprobe: Add support for session consumer")
> Signed-off-by: Binbin Deng <18983559317@163.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019080709.477548-1-18983559317@163.com?part=1