From: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
To: <stable@vger.kernel.org>
Cc: <gregkh@linuxfoundation.org>, <sashal@kernel.org>,
<rostedt@goodmis.org>, <vmalik@redhat.com>, <jmarchan@redhat.com>,
<martin.kelly@crowdstrike.com>
Subject: [PATCH 6.6.y 00/27] ftrace/sorttable: Fix ftrace symbol table corruption with CONFIG_X86_KERNEL_IBT=y
Date: Thu, 18 Jun 2026 16:38:38 -0400 [thread overview]
Message-ID: <cover.1781814083.git.andrey.grodzovsky@crowdstrike.com> (raw)
This series backports the upstream fix for ftrace symbol table
corruption on kernels with CONFIG_X86_KERNEL_IBT=y. Weak overridden
functions corrupt the ftrace symbol table at boot, causing
non-deterministic hook attachment failures across all ftrace consumers
— most visibly fentry/trampoline-based hooks, but affecting any code
that relies on ftrace symbol lookups.
The fix was merged to mainline in Linux 6.15 via:
https://lore.kernel.org/all/20250218195918.255228630@goodmis.org/
The original backport request and bug description sent to stable:
https://lore.kernel.org/stable/CAOu3gNibeo3ov09CYpmzuqewB0EOsajB3hPU9pQmb_zoAUraHg@mail.gmail.com/
Red Hat independently backported this same set of patches to their
RHEL 10 kernel (6.12). Their work is at:
https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2689
The 27 patches are organized in four groups:
- Patches 01-14: sorttable.c rewrite (prereq, merged 6.14)
- Patch 15: function pointer struct cleanup (prereq, merged 6.14)
- Patches 16-21: the core IBT fix series (merged 6.15)
- Patches 22-27: post-merge correctness fixes for arm64 and s390
All patches applied cleanly to 6.6.y (at 6.6.142). Tested on x86_64
with CONFIG_X86_KERNEL_IBT=y:
grep __ftrace_invalid_address___ \
/sys/kernel/tracing/available_filter_functions | wc -l
Before: 562 After: 0
Direct test (bpftrace kprobe vs fentry on put_task_struct_rcu_user):
Unpatched: fentry=0, kprobe=46 (silent failure confirmed)
Patched: fentry=46, kprobe=46 (fixed)
ftrace kernel selftests (tools/testing/selftests/ftrace):
119 passed, 0 regressions introduced (2 pre-existing failures
unrelated to this series).
Guenter Roeck (1):
ftrace: Do not over-allocate ftrace memory
Steven Rostedt (25):
scripts/sorttable: Remove unused macro defines
scripts/sorttable: Remove unused write functions
scripts/sorttable: Remove unneeded Elf_Rel
scripts/sorttable: Have the ORC code use the _r() functions to read
scripts/sorttable: Make compare_extable() into two functions
scripts/sorttable: Convert Elf_Ehdr to union
scripts/sorttable: Replace Elf_Shdr Macro with a union
scripts/sorttable: Convert Elf_Sym MACRO over to a union
scripts/sorttable: Add helper functions for Elf_Ehdr
scripts/sorttable: Add helper functions for Elf_Shdr
scripts/sorttable: Add helper functions for Elf_Sym
scripts/sorttable: Use uint64_t for mcount sorting
scripts/sorttable: Move code from sorttable.h into sorttable.c
scripts/sorttable: Get start/stop_mcount_loc from ELF file directly
scripts/sorttable: Use a structure of function pointers for elf
helpers
arm64: scripts/sorttable: Implement sorting mcount_loc at boot for
arm64
scripts/sorttable: Have mcount rela sort use direct values
scripts/sorttable: Always use an array for the mcount_loc sorting
scripts/sorttable: Zero out weak functions in mcount_loc table
ftrace: Update the mcount_loc check of skipped entries
ftrace: Have ftrace pages output reflect freed pages
ftrace: Test mcount_loc addr before calling ftrace_call_addr()
ftrace: Check against is_kernel_text() instead of kaslr_offset()
scripts/sorttable: Use normal sort if theres no relocs in the mcount
section
scripts/sorttable: Allow matches to functions before function entry
Vasily Gorbik (1):
scripts/sorttable: Fix endianness handling in build-time mcount sort
arch/arm64/Kconfig | 1 +
kernel/trace/ftrace.c | 68 ++-
scripts/link-vmlinux.sh | 4 +-
scripts/sorttable.c | 1119 +++++++++++++++++++++++++++++++++++++--
scripts/sorttable.h | 500 -----------------
5 files changed, 1133 insertions(+), 559 deletions(-)
delete mode 100644 scripts/sorttable.h
--
2.34.1
next reply other threads:[~2026-06-18 20:39 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-18 20:38 Andrey Grodzovsky [this message]
2026-06-18 20:38 ` [PATCH 6.6.y 01/27] scripts/sorttable: Remove unused macro defines Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 02/27] scripts/sorttable: Remove unused write functions Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 03/27] scripts/sorttable: Remove unneeded Elf_Rel Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 04/27] scripts/sorttable: Have the ORC code use the _r() functions to read Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 05/27] scripts/sorttable: Make compare_extable() into two functions Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 06/27] scripts/sorttable: Convert Elf_Ehdr to union Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 07/27] scripts/sorttable: Replace Elf_Shdr Macro with a union Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 08/27] scripts/sorttable: Convert Elf_Sym MACRO over to " Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 09/27] scripts/sorttable: Add helper functions for Elf_Ehdr Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 10/27] scripts/sorttable: Add helper functions for Elf_Shdr Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 11/27] scripts/sorttable: Add helper functions for Elf_Sym Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 12/27] scripts/sorttable: Use uint64_t for mcount sorting Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 13/27] scripts/sorttable: Move code from sorttable.h into sorttable.c Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 14/27] scripts/sorttable: Get start/stop_mcount_loc from ELF file directly Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 15/27] scripts/sorttable: Use a structure of function pointers for elf helpers Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 16/27] arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 17/27] scripts/sorttable: Have mcount rela sort use direct values Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 18/27] scripts/sorttable: Always use an array for the mcount_loc sorting Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 19/27] scripts/sorttable: Zero out weak functions in mcount_loc table Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 20/27] ftrace: Update the mcount_loc check of skipped entries Andrey Grodzovsky
2026-06-18 20:38 ` [PATCH 6.6.y 21/27] ftrace: Have ftrace pages output reflect freed pages Andrey Grodzovsky
2026-06-18 20:39 ` [PATCH 6.6.y 22/27] ftrace: Do not over-allocate ftrace memory Andrey Grodzovsky
2026-06-18 20:39 ` [PATCH 6.6.y 23/27] ftrace: Test mcount_loc addr before calling ftrace_call_addr() Andrey Grodzovsky
2026-06-18 20:39 ` [PATCH 6.6.y 24/27] ftrace: Check against is_kernel_text() instead of kaslr_offset() Andrey Grodzovsky
2026-06-18 20:39 ` [PATCH 6.6.y 25/27] scripts/sorttable: Use normal sort if theres no relocs in the mcount section Andrey Grodzovsky
2026-06-18 20:39 ` [PATCH 6.6.y 26/27] scripts/sorttable: Allow matches to functions before function entry Andrey Grodzovsky
2026-06-18 20:39 ` [PATCH 6.6.y 27/27] scripts/sorttable: Fix endianness handling in build-time mcount sort Andrey Grodzovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1781814083.git.andrey.grodzovsky@crowdstrike.com \
--to=andrey.grodzovsky@crowdstrike.com \
--cc=gregkh@linuxfoundation.org \
--cc=jmarchan@redhat.com \
--cc=martin.kelly@crowdstrike.com \
--cc=rostedt@goodmis.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=vmalik@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox