Re: [RFC PATCH] tracing: Fix syscall tracepoint use-after-free

[Steven Rostedt]

On Wed, 23 Oct 2024 11:19:40 -0400
Mathieu Desnoyers <mathieu.desnoyers@xxxxxxxxxxxx> wrote:
> 
> > Looks like Mathieu patch broke bpf program contract somewhere.  
> 
> My patch series introduced this in the probe:
> 
> #define __BPF_DECLARE_TRACE_SYSCALL(call, proto, args)                  \
> static notrace void                                                     \
> __bpf_trace_##call(void *__data, proto)                                 \
> {                                                                       \
>          might_fault();                                                  \
>          preempt_disable_notrace();                                      \

Is the problem that we can call this function *after* the prog has been
freed? That is, the preempt_disable_notrace() here is meaningless.

Is there a way to add something here to make sure the program is still
valid? Like set a flag in the link structure?

(I don't know how BPF works well enough to know what is involved here,
so excuse me if this is totally off)

-- Steve


>          CONCATENATE(bpf_trace_run, COUNT_ARGS(args))(__data, CAST_TO_U64(args));        \
>          preempt_enable_notrace();                                       \
> }
>