Re: [PATCH v5 0/3] tracing/fprobe: Fix fprobe_ip_table related bugs

Masami Hiramatsu
2026-04-14T01:19:17Z

On Mon, 13 Apr 2026 17:39:26 +0900
"Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:

> Here is the 5th series of patches to fix bugs in fprobe.
> The previous version is here.
>
> https://lore.kernel.org/all/177584108931.388483.11311214679686745474.stgit@devnote2/
>
> This version fixes to remove fprobe_hash_node forcibly when fprobe
> registration failed [1/3] and skips updating ftrace_ops when fails
> to allocate memory in module unloading [2/3].

Hmm, Sashiko pointed out some issues in fprobe, which seems not introduced
this series but existing UAF cases.

https://sashiko.dev/#/patchset/177606956628.929411.17392736689322577701.stgit%40devnote2

Especially,

> In fprobe_return(), the code traverses the fprobe_table which contains
> RCU-protected struct fprobe_hlist nodes. These nodes are freed using
> kfree_rcu(hlist_array, rcu) in unregister_fprobe_nolock().
>
> To safely traverse this RCU-protected list, readers must hold the RCU read
> lock. However, fprobe_return() only calls preempt_disable_notrace(). While
> disabling preemption acts as an RCU-sched read-side critical section on
> non-RT kernels, it does not prevent regular RCU grace periods from
> completing on PREEMPT_RT. Thus, kfree_rcu() can free the hlist_array while
> fprobe_return() is actively iterating over it.

I would like to ask Steve a comment about this. Is fgraph return handler
context RCU safe?

Thanks,

>
> Thanks,
> ---
>
> Masami Hiramatsu (Google) (3):
> tracing/fprobe: Remove fprobe from hash in failure path
> tracing/fprobe: Avoid kcalloc() in rcu_read_lock section
> tracing/fprobe: Check the same type fprobe on table as the unregistered one
>
>
> kernel/trace/fprobe.c | 251 +++++++++++++++++++++++++++++--------------------
> 1 file changed, 147 insertions(+), 104 deletions(-)
>
> --
> Masami Hiramatsu (Google) <mhiramat@kernel.org>

--
Masami Hiramatsu (Google) <mhiramat@kernel.org>