[PATCH] tracing: fix CFI violation in probestub helper

[PATCH] tracing: fix CFI violation in probestub helper

[Eva Kurchatova]

When multiple callbacks are registered on the same tracepoint, probestub
will be indirectly called via traceiter helper.

Pointer to probestub callback resides in __tracepoints section, which is
excluded from ENDBR checks in objtool. Pointers to regfunc/unregfunc
callbacks reside in extended structure however, which is not affected.

Registering multiple callbacks will result in a #CP exception due to
missed ENDBR in __probestub helper on a CFI-enabled machine.

Fix this by adding CFI_NOSEAL annotation to probestub declaration.

Fixes: d5173f753750 ("objtool: Exclude __tracepoints data from ENDBR checks")
Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
---
 include/linux/tracepoint.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 583d962abcc3..5a32a709759c 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -19,6 +19,7 @@
 #include <linux/rcupdate.h>
 #include <linux/tracepoint-defs.h>
 #include <linux/static_call.h>
+#include <asm/cfi.h>
 
 struct module;
 struct tracepoint;
@@ -356,6 +357,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
 	void __probestub_##_name(void *__data, proto)			\
 	{								\
 	}								\
+	CFI_NOSEAL(__probestub_##_name);				\
 	DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);
 
 #define DEFINE_TRACE_FN(_name, _reg, _unreg, _proto, _args)		\
-- 
2.54.0

Re: [PATCH] tracing: fix CFI violation in probestub helper

[Steven Rostedt]

On Sun, 24 May 2026 18:43:01 +0300
Eva Kurchatova <eva.kurchatova@virtuozzo.com> wrote:

> When multiple callbacks are registered on the same tracepoint, probestub
> will be indirectly called via traceiter helper.
> 
> Pointer to probestub callback resides in __tracepoints section, which is
> excluded from ENDBR checks in objtool. Pointers to regfunc/unregfunc
> callbacks reside in extended structure however, which is not affected.
> 
> Registering multiple callbacks will result in a #CP exception due to
> missed ENDBR in __probestub helper on a CFI-enabled machine.
> 
> Fix this by adding CFI_NOSEAL annotation to probestub declaration.
> 
> Fixes: d5173f753750 ("objtool: Exclude __tracepoints data from ENDBR checks")
> Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>

Wait! The probestub is not in the __tracepoints section. At least it
shouldn't be. Are you sure there's not another issue here?

#define __DEFINE_TRACE_EXT(_name, _ext, proto, args)			\
	static const char __tpstrtab_##_name[]				\
	__section("__tracepoints_strings") = #_name;			\
	extern struct static_call_key STATIC_CALL_KEY(tp_func_##_name);	\
	int __traceiter_##_name(void *__data, proto);			\
	void __probestub_##_name(void *__data, proto);			\
	struct tracepoint __tracepoint_##_name	__used			\
	__section("__tracepoints") = {					\

 Here the structure __tracepoint_##name is in the __tracepoints section.

		.name = __tpstrtab_##_name,				\
		.key = STATIC_KEY_FALSE_INIT,				\
		.static_call_key = &STATIC_CALL_KEY(tp_func_##_name),	\
		.static_call_tramp = STATIC_CALL_TRAMP_ADDR(tp_func_##_name), \
		.iterator = &__traceiter_##_name,			\
		.probestub = &__probestub_##_name,			\
		.funcs = NULL,						\
		.ext = _ext,						\
	};								\
	__TRACEPOINT_ENTRY(_name);					\
	int __traceiter_##_name(void *__data, proto)			\
	{								\
		struct tracepoint_func *it_func_ptr;			\
		void *it_func;						\
									\
		it_func_ptr =						\
			rcu_dereference_raw((&__tracepoint_##_name)->funcs); \
		if (it_func_ptr) {					\
			do {						\
				it_func = READ_ONCE((it_func_ptr)->func); \
				__data = (it_func_ptr)->data;		\
				((void(*)(void *, proto))(it_func))(__data, args); \
			} while ((++it_func_ptr)->func);		\
		}							\
		return 0;						\
	}								\
	void __probestub_##_name(void *__data, proto)			\
	{								\
	}

But above, probestub is just a function defined wherever the tracepoint is
created.

In fact, it's just there for fprobes to work. It doesn't get called if you
add more than one callback to the tracepoint. So your explanation is totally
bogus.

Do you actually see a crash? Or is this just some AI slop that told you
this is a bug?

-- Steve



> ---
>  include/linux/tracepoint.h | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
> index 583d962abcc3..5a32a709759c 100644
> --- a/include/linux/tracepoint.h
> +++ b/include/linux/tracepoint.h
> @@ -19,6 +19,7 @@
>  #include <linux/rcupdate.h>
>  #include <linux/tracepoint-defs.h>
>  #include <linux/static_call.h>
> +#include <asm/cfi.h>
>  
>  struct module;
>  struct tracepoint;
> @@ -356,6 +357,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
>  	void __probestub_##_name(void *__data, proto)			\
>  	{								\
>  	}								\
> +	CFI_NOSEAL(__probestub_##_name);				\
>  	DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);
>  
>  #define DEFINE_TRACE_FN(_name, _reg, _unreg, _proto, _args)		\

Re: [PATCH] tracing: fix CFI violation in probestub helper

[Peter Zijlstra]

On Thu, May 28, 2026 at 04:49:02PM -0400, Steven Rostedt wrote:
> On Sun, 24 May 2026 18:43:01 +0300
> Eva Kurchatova <eva.kurchatova@virtuozzo.com> wrote:
> 
> > When multiple callbacks are registered on the same tracepoint, probestub
> > will be indirectly called via traceiter helper.
> > 
> > Pointer to probestub callback resides in __tracepoints section, which is
> > excluded from ENDBR checks in objtool. Pointers to regfunc/unregfunc
> > callbacks reside in extended structure however, which is not affected.
> > 
> > Registering multiple callbacks will result in a #CP exception due to
> > missed ENDBR in __probestub helper on a CFI-enabled machine.
> > 
> > Fix this by adding CFI_NOSEAL annotation to probestub declaration.
> > 
> > Fixes: d5173f753750 ("objtool: Exclude __tracepoints data from ENDBR checks")
> > Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
> 
> Wait! The probestub is not in the __tracepoints section. At least it
> shouldn't be. Are you sure there's not another issue here?
> 
> #define __DEFINE_TRACE_EXT(_name, _ext, proto, args)			\
> 	static const char __tpstrtab_##_name[]				\
> 	__section("__tracepoints_strings") = #_name;			\
> 	extern struct static_call_key STATIC_CALL_KEY(tp_func_##_name);	\
> 	int __traceiter_##_name(void *__data, proto);			\
> 	void __probestub_##_name(void *__data, proto);			\
> 	struct tracepoint __tracepoint_##_name	__used			\
> 	__section("__tracepoints") = {					\
> 
>  Here the structure __tracepoint_##name is in the __tracepoints section.
> 
> 		.name = __tpstrtab_##_name,				\
> 		.key = STATIC_KEY_FALSE_INIT,				\
> 		.static_call_key = &STATIC_CALL_KEY(tp_func_##_name),	\
> 		.static_call_tramp = STATIC_CALL_TRAMP_ADDR(tp_func_##_name), \
> 		.iterator = &__traceiter_##_name,			\
> 		.probestub = &__probestub_##_name,			\

                    ^^^^^^^^^^ this

> 		.funcs = NULL,						\
> 		.ext = _ext,						\
> 	};								\
> 	__TRACEPOINT_ENTRY(_name);					\
> 	int __traceiter_##_name(void *__data, proto)			\
> 	{								\
> 		struct tracepoint_func *it_func_ptr;			\
> 		void *it_func;						\
> 									\
> 		it_func_ptr =						\
> 			rcu_dereference_raw((&__tracepoint_##_name)->funcs); \
> 		if (it_func_ptr) {					\
> 			do {						\
> 				it_func = READ_ONCE((it_func_ptr)->func); \
> 				__data = (it_func_ptr)->data;		\
> 				((void(*)(void *, proto))(it_func))(__data, args); \
> 			} while ((++it_func_ptr)->func);		\
> 		}							\
> 		return 0;						\
> 	}								\
> 	void __probestub_##_name(void *__data, proto)			\
> 	{								\
> 	}
> 
> But above, probestub is just a function defined wherever the tracepoint is
> created.
> 
> In fact, it's just there for fprobes to work. It doesn't get called if you
> add more than one callback to the tracepoint. So your explanation is totally
> bogus.

The only place the function address lives is in that __tracepoint
section. Since that is explicitly excluded by objtool, it figures there
are no actual references to __probestub and the function goes on the
seal list and the kernel explicitly scribbles the ENDBR on boot.

Then, if it ever gets used on an IBT enabled host, *boom*.

I agree it would've perhaps been clearer if there was part of a splat in
the changelog, but the issue is real afaict.

Also, I do think this:

> > @@ -356,6 +357,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
> >  	void __probestub_##_name(void *__data, proto)			\
> >  	{								\
> >  	}								\
> > +	CFI_NOSEAL(__probestub_##_name);				\
> >  	DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);
> >  
> >  #define DEFINE_TRACE_FN(_name, _reg, _unreg, _proto, _args)		\

could do with a comment, explaining why it wants the NOSEAL.

Re: [PATCH] tracing: fix CFI violation in probestub helper

[Steven Rostedt]

On Fri, 29 May 2026 22:08:26 +0200
Peter Zijlstra <peterz@infradead.org> wrote:

> On Thu, May 28, 2026 at 04:49:02PM -0400, Steven Rostedt wrote:
> > On Sun, 24 May 2026 18:43:01 +0300
> > Eva Kurchatova <eva.kurchatova@virtuozzo.com> wrote:
> >   
> > > When multiple callbacks are registered on the same tracepoint, probestub
> > > will be indirectly called via traceiter helper.
> > > 
> > > Pointer to probestub callback resides in __tracepoints section, which is
> > > excluded from ENDBR checks in objtool. Pointers to regfunc/unregfunc
> > > callbacks reside in extended structure however, which is not affected.
> > > 
> > > Registering multiple callbacks will result in a #CP exception due to
> > > missed ENDBR in __probestub helper on a CFI-enabled machine.
> > > 
> > > Fix this by adding CFI_NOSEAL annotation to probestub declaration.
> > > 
> > > Fixes: d5173f753750 ("objtool: Exclude __tracepoints data from ENDBR checks")
> > > Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>  

> 
> The only place the function address lives is in that __tracepoint
> section. Since that is explicitly excluded by objtool, it figures there
> are no actual references to __probestub and the function goes on the
> seal list and the kernel explicitly scribbles the ENDBR on boot.
> 
> Then, if it ever gets used on an IBT enabled host, *boom*.

That makes much more sense.

> 
> I agree it would've perhaps been clearer if there was part of a splat in
> the changelog, but the issue is real afaict.
> 
> Also, I do think this:
> 
> > > @@ -356,6 +357,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
> > >  	void __probestub_##_name(void *__data, proto)			\
> > >  	{								\
> > >  	}								\
> > > +	CFI_NOSEAL(__probestub_##_name);				\
> > >  	DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);
> > >  
> > >  #define DEFINE_TRACE_FN(_name, _reg, _unreg, _proto, _args)		\  
> 
> could do with a comment, explaining why it wants the NOSEAL.

Yes.

Thus, the above change log is totally incorrect and should be updated to:

   tprobes uses a stub function of the tracepoint to allow fprobes to
   attach to the tracepoint call site and have access to its arguments.
   The stub function is called __probestub_##_name() and is only
   referenced as a pointer in the tracepoint structure so that the
   tprobe can have access to it.

   The issue is that the probstub function is only referenced in the
   __tracepoint section and objtool thinks nothing calls it. Since it
   explicitly excludes the __tracepoint section, objtool thinks there
   are no callers so it puts the probstub function into the seal list
   and then the kernel scrubs its ENDBR on boot.

   This becomes an issue if someone were to use a tprobe which will
   register the probestub as a callback to the tracepoint so that a
   fprobe may attach to it and get access to the arguments. Without the
   ENDBR it will make the kernel go BOOM!


Then have a comment in the patch with:

 void __probestub_##_name(void *__data, proto)			\
 {								\
 }								\
+/*								\
+ * The probestub is only used for tprobes and not referenced	\
+ * anywhere else. This causes objtool to think it's not called	\
+ * at all and will add it to the seal list which will remove	\
+ * the ENDBR causing issues if a tprobe is ever used.		\
+ */								\
+CFI_NOSEAL(__probestub_##_name);				\
 DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);


-- Steve

Re: [PATCH] tracing: fix CFI violation in probestub helper

[Masami Hiramatsu]

On Fri, 29 May 2026 19:51:34 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Fri, 29 May 2026 22:08:26 +0200
> Peter Zijlstra <peterz@infradead.org> wrote:
> 
> > On Thu, May 28, 2026 at 04:49:02PM -0400, Steven Rostedt wrote:
> > > On Sun, 24 May 2026 18:43:01 +0300
> > > Eva Kurchatova <eva.kurchatova@virtuozzo.com> wrote:
> > >   
> > > > When multiple callbacks are registered on the same tracepoint, probestub
> > > > will be indirectly called via traceiter helper.
> > > > 
> > > > Pointer to probestub callback resides in __tracepoints section, which is
> > > > excluded from ENDBR checks in objtool. Pointers to regfunc/unregfunc
> > > > callbacks reside in extended structure however, which is not affected.
> > > > 
> > > > Registering multiple callbacks will result in a #CP exception due to
> > > > missed ENDBR in __probestub helper on a CFI-enabled machine.
> > > > 
> > > > Fix this by adding CFI_NOSEAL annotation to probestub declaration.
> > > > 
> > > > Fixes: d5173f753750 ("objtool: Exclude __tracepoints data from ENDBR checks")
> > > > Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>  
> 
> > 
> > The only place the function address lives is in that __tracepoint
> > section. Since that is explicitly excluded by objtool, it figures there
> > are no actual references to __probestub and the function goes on the
> > seal list and the kernel explicitly scribbles the ENDBR on boot.
> > 
> > Then, if it ever gets used on an IBT enabled host, *boom*.
> 
> That makes much more sense.

Ah, I got it.

> 
> > 
> > I agree it would've perhaps been clearer if there was part of a splat in
> > the changelog, but the issue is real afaict.
> > 
> > Also, I do think this:
> > 
> > > > @@ -356,6 +357,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
> > > >  	void __probestub_##_name(void *__data, proto)			\
> > > >  	{								\
> > > >  	}								\
> > > > +	CFI_NOSEAL(__probestub_##_name);				\
> > > >  	DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);
> > > >  
> > > >  #define DEFINE_TRACE_FN(_name, _reg, _unreg, _proto, _args)		\  
> > 
> > could do with a comment, explaining why it wants the NOSEAL.
> 
> Yes.
> 
> Thus, the above change log is totally incorrect and should be updated to:
> 
>    tprobes uses a stub function of the tracepoint to allow fprobes to
>    attach to the tracepoint call site and have access to its arguments.
>    The stub function is called __probestub_##_name() and is only
>    referenced as a pointer in the tracepoint structure so that the
>    tprobe can have access to it.
> 
>    The issue is that the probstub function is only referenced in the
>    __tracepoint section and objtool thinks nothing calls it. Since it
>    explicitly excludes the __tracepoint section, objtool thinks there
>    are no callers so it puts the probstub function into the seal list
>    and then the kernel scrubs its ENDBR on boot.
> 
>    This becomes an issue if someone were to use a tprobe which will
>    register the probestub as a callback to the tracepoint so that a
>    fprobe may attach to it and get access to the arguments. Without the
>    ENDBR it will make the kernel go BOOM!
> 
> 
> Then have a comment in the patch with:
> 
>  void __probestub_##_name(void *__data, proto)			\
>  {								\
>  }								\
> +/*								\
> + * The probestub is only used for tprobes and not referenced	\
> + * anywhere else. This causes objtool to think it's not called	\
> + * at all and will add it to the seal list which will remove	\
> + * the ENDBR causing issues if a tprobe is ever used.		\
> + */								\
> +CFI_NOSEAL(__probestub_##_name);				\
>  DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);

This looks good to me. Eva, can you update the patch?

Thanks for fix.

> 
> 
> -- Steve


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH] tracing: fix CFI violation in probestub helper

[David Laight]

On Fri, 29 May 2026 19:51:34 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Fri, 29 May 2026 22:08:26 +0200
> Peter Zijlstra <peterz@infradead.org> wrote:
> 
> > On Thu, May 28, 2026 at 04:49:02PM -0400, Steven Rostedt wrote:  
> > > On Sun, 24 May 2026 18:43:01 +0300
> > > Eva Kurchatova <eva.kurchatova@virtuozzo.com> wrote:
> > >     
> > > > When multiple callbacks are registered on the same tracepoint, probestub
> > > > will be indirectly called via traceiter helper.
> > > > 
> > > > Pointer to probestub callback resides in __tracepoints section, which is
> > > > excluded from ENDBR checks in objtool. Pointers to regfunc/unregfunc
> > > > callbacks reside in extended structure however, which is not affected.
> > > > 
> > > > Registering multiple callbacks will result in a #CP exception due to
> > > > missed ENDBR in __probestub helper on a CFI-enabled machine.
> > > > 
> > > > Fix this by adding CFI_NOSEAL annotation to probestub declaration.
> > > > 
> > > > Fixes: d5173f753750 ("objtool: Exclude __tracepoints data from ENDBR checks")
> > > > Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>    
> 
> > 
> > The only place the function address lives is in that __tracepoint
> > section. Since that is explicitly excluded by objtool, it figures there
> > are no actual references to __probestub and the function goes on the
> > seal list and the kernel explicitly scribbles the ENDBR on boot.
> > 
> > Then, if it ever gets used on an IBT enabled host, *boom*.  
> 
> That makes much more sense.
> 
> > 
> > I agree it would've perhaps been clearer if there was part of a splat in
> > the changelog, but the issue is real afaict.
> > 
> > Also, I do think this:
> >   
> > > > @@ -356,6 +357,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
> > > >  	void __probestub_##_name(void *__data, proto)			\
> > > >  	{								\
> > > >  	}								\
> > > > +	CFI_NOSEAL(__probestub_##_name);				\
> > > >  	DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);
> > > >  
> > > >  #define DEFINE_TRACE_FN(_name, _reg, _unreg, _proto, _args)		\    
> > 
> > could do with a comment, explaining why it wants the NOSEAL.  
> 
> Yes.
> 
> Thus, the above change log is totally incorrect and should be updated to:
> 
>    tprobes uses a stub function of the tracepoint to allow fprobes to
>    attach to the tracepoint call site and have access to its arguments.
>    The stub function is called __probestub_##_name() and is only
>    referenced as a pointer in the tracepoint structure so that the
>    tprobe can have access to it.
> 
>    The issue is that the probstub function is only referenced in the
>    __tracepoint section and objtool thinks nothing calls it. Since it
>    explicitly excludes the __tracepoint section, objtool thinks there
>    are no callers so it puts the probstub function into the seal list
>    and then the kernel scrubs its ENDBR on boot.
> 
>    This becomes an issue if someone were to use a tprobe which will
>    register the probestub as a callback to the tracepoint so that a
>    fprobe may attach to it and get access to the arguments. Without the
>    ENDBR it will make the kernel go BOOM!
> 
> 
> Then have a comment in the patch with:
> 
>  void __probestub_##_name(void *__data, proto)			\
>  {								\
>  }								\
> +/*								\
> + * The probestub is only used for tprobes and not referenced	\
> + * anywhere else. This causes objtool to think it's not called	\
> + * at all and will add it to the seal list which will remove	\
> + * the ENDBR causing issues if a tprobe is ever used.		\
> + */								\

Isn't the sense of that all wrong?
Maybe:
	Annotate the protosub 'CFI_NOSEAL' to stop objtool requesting the
	kernel remove the ENDBR because the only references to the
	function are in the __tracepoint section that objtool doesn't scan.

-- David
 
> +CFI_NOSEAL(__probestub_##_name);				\
>  DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);
> 
> 
> -- Steve
> 

Re: [PATCH] tracing: fix CFI violation in probestub helper

[Steven Rostedt]

On Sat, 30 May 2026 22:19:21 +0100
David Laight <david.laight.linux@gmail.com> wrote:

> > +/*								\
> > + * The probestub is only used for tprobes and not referenced	\
> > + * anywhere else. This causes objtool to think it's not called	\
> > + * at all and will add it to the seal list which will remove	\
> > + * the ENDBR causing issues if a tprobe is ever used.		\
> > + */								\  
> 
> Isn't the sense of that all wrong?

The above is still correct. It just expresses what the probestub is
used for.

> Maybe:
> 	Annotate the protosub 'CFI_NOSEAL' to stop objtool requesting the
> 	kernel remove the ENDBR because the only references to the
> 	function are in the __tracepoint section that objtool doesn't scan.

I do agree that your version is a bit more concise.

Thanks,

-- Steve