Re: [PATCH v5 0/3] tracing/fprobe: Fix fprobe_ip_table related bugs

[Masami Hiramatsu (Google) <mhiramat@kernel.org>]

On Mon, 13 Apr 2026 17:39:26 +0900
"Masami Hiramatsu (Google)" <mhiramat@kernel.org> wrote:

> Here is the 5th series of patches to fix bugs in fprobe.
> The previous version is here.
> 
> https://lore.kernel.org/all/177584108931.388483.11311214679686745474.stgit@devnote2/
> 
> This version fixes to remove fprobe_hash_node forcibly when fprobe
> registration failed [1/3] and skips updating ftrace_ops when fails
> to allocate memory in module unloading [2/3].

Hmm, Sashiko pointed out some issues in fprobe, which seems not introduced
this series but existing UAF cases.

https://sashiko.dev/#/patchset/177606956628.929411.17392736689322577701.stgit%40devnote2

Especially,

> In fprobe_return(), the code traverses the fprobe_table which contains
> RCU-protected struct fprobe_hlist nodes. These nodes are freed using
> kfree_rcu(hlist_array, rcu) in unregister_fprobe_nolock().
>
> To safely traverse this RCU-protected list, readers must hold the RCU read
> lock. However, fprobe_return() only calls preempt_disable_notrace(). While
> disabling preemption acts as an RCU-sched read-side critical section on
> non-RT kernels, it does not prevent regular RCU grace periods from
> completing on PREEMPT_RT. Thus, kfree_rcu() can free the hlist_array while
> fprobe_return() is actively iterating over it.

I would like to ask Steve a comment about this. Is fgraph return handler
context RCU safe?

Thanks,

> 
> Thanks,
> ---
> 
> Masami Hiramatsu (Google) (3):
>       tracing/fprobe: Remove fprobe from hash in failure path
>       tracing/fprobe: Avoid kcalloc() in rcu_read_lock section
>       tracing/fprobe: Check the same type fprobe on table as the unregistered one
> 
> 
>  kernel/trace/fprobe.c |  251 +++++++++++++++++++++++++++++--------------------
>  1 file changed, 147 insertions(+), 104 deletions(-)
> 
> --
> Masami Hiramatsu (Google) <mhiramat@kernel.org>


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>