Re: Race condition in __modify_ftrace_direct() between tmp_ops registration and direct_functions hash update

[Steven Rostedt <rostedt@goodmis.org>]

Added Jiri as he works on this code.

On Sun, 17 May 2026 06:24:11 +0000
Afi0 <capyenglishlite@gmail.com> wrote:

> Hi list,
> 
> Apologies for initially sending only to Greg. Resending to the full list as
> requested.
> ------------------------------
> 
> Component: kernel/trace/ftrace.c Function: __modify_ftrace_direct()
> Affected versions: Linux kernel 5.15+ Type: TOCTOU / Race condition CVSS
> 3.1: AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - 7.8 (High)
> 
> SUMMARY
> 
> A race condition exists in __modify_ftrace_direct() between the
> registration of tmp_ops into ftrace_ops_list and the subsequent update of
> direct_functions hash entries. During this window, concurrent CPUs
> executing traced functions will read the stale direct call address via
> ftrace_find_rec_direct() and jump to it, while the caller may have already
> invalidated or freed the old trampoline memory.

What the above doesn't describe is how the direct was stale to begin
with. Before the assignment, it should be NULL and not a problem, and
if was being modified, the current trampoline that direct points to
should *NOT* be freed before calling this. Otherwise, that itself is a
bug.

-- Steve


> 
> VULNERABLE CODE
> 
> err = register_ftrace_function_nolock(&tmp_ops);[race window:
> ftrace_ops_list_func now active, direct_functions not yet
> updated]mutex_lock(&ftrace_lock);entry->direct = addr;   /* update
> happens here, too late */mutex_unlock(&ftrace_lock);
> 
> IMPACT
> 
> CPU executing traced function reads stale direct_functions entry during the
> race window. arch_ftrace_set_direct_caller() redirects execution to
> potentially freed or invalidated trampoline memory. Use-after-free in
> executable code context on SMP systems.
> 
> TRIGGER
> 
> Requires CAP_PERFMON or CAP_SYS_ADMIN directly. Also reachable via BPF
> trampolines (kernel/bpf/trampoline.c calls __modify_ftrace_direct()
> internally) with CAP_BPF + CAP_PERFMON, default in many CI/CD container
> runtimes. Live patching via klp_patch_func() also goes through this path.
> 
> SUGGESTED FIX
> 
> Update entry->direct under ftrace_lock BEFORE registering tmp_ops. Add
> smp_wmb() between the store and registration to ensure ordering on
> weakly-ordered architectures.
> 
> Patch attached as 0001-ftrace-fix-race-in-__modify_ftrace_direct.patch
> 
> Fixes: 0567d6809440 ("ftrace: Add modify_ftrace_direct()")
> 
> Thanks,
> 
>  Afi0