Hi Linus,
Probes fixes for v6.9-rc3:
- kprobes: Fix possible use-after-free issue on kprobe registration. Since
check_kprobe_address_safe() uses `is_module_text_address()` and
`__module_text_address()` separately, if the probe address is on an
unloading module, the first `is_module_text_address()` return true but
the second `__module_text_address()` returns NULL (module is unloaded
between them). Thus it expects the probe is on the kernel text, and
skips to get the module reference. In this case, when it arms a breakpoint
on the probe address, it may cause a use-after-free problem.
To fix this issue, we only use `__module_text_address()` once and tries
to get reference of the module, if it fails, reject the probe.
Please pull the latest probes-fixes-v6.9-rc3 tree, which can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
probes-fixes-v6.9-rc3
Tag SHA1: 67bbfb7d79488db2f7e80bc4442d090254127c3c
Head SHA1: 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8
Zheng Yejian (1):
kprobes: Fix possible use-after-free issue on kprobe registration
----
kernel/kprobes.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--
Masami Hiramatsu (Google) <[email protected]>
The pull request you sent on Thu, 11 Apr 2024 10:09:18 +0900:
> git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git probes-fixes-v6.9-rc3
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/e8c39d0f57f358950356a8e44ee5159f57f86ec5
Thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html