[PATCH v2 1/3] tracing/user_events: Serialize duplicate enabler lookup with event removal

[Jeff Barnes]

user_event_enabler_exists() performs a plain traversal of the per-mm
enabler list. Registration invokes it while holding the event group's
reg_mutex, which serializes registration and unregister operations from
that group.

However, deferred fault cleanup can remove an enabler asynchronously
while holding event_mutex without holding the group reg_mutex. The plain
list traversal can therefore race with list_del_rcu() despite the
registration mutex being held.

Take event_mutex around user_event_enabler_exists() so the traversal is
serialized with all enabler removal paths. Pass the group into
current_user_event_enabler_exists() and assert that its reg_mutex is
already held.

This preserves the established lock order of group->reg_mutex followed
by event_mutex.

Signed-off-by: Jeff Barnes <jeffbarnes@xxxxxxxxxxxxxxxxxxx>
---
 kernel/trace/trace_events_user.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c
index f658c3a77aa7..24983f68d075 100644
--- a/kernel/trace/trace_events_user.c
+++ b/kernel/trace/trace_events_user.c
@@ -890,16 +890,21 @@ void user_event_mm_dup(struct task_struct *t, struct user_event_mm *old_mm)
 	user_event_mm_destroy(mm);
 }
 
-static bool current_user_event_enabler_exists(unsigned long uaddr,
-					      unsigned char bit)
+static bool
+current_user_event_enabler_exists(struct user_event_group *group,
+				  unsigned long uaddr, unsigned char bit)
 {
 	struct user_event_mm *user_mm = current_user_event_mm();
 	bool exists;
 
+	lockdep_assert_held(&group->reg_mutex);
+
 	if (!user_mm)
 		return false;
 
+	mutex_lock(&event_mutex);
 	exists = user_event_enabler_exists(user_mm, uaddr, bit);
+	mutex_unlock(&event_mutex);
 
 	user_event_mm_put(user_mm);
 
@@ -2510,7 +2515,8 @@ static long user_events_ioctl_reg(struct user_event_file_info *info,
 	 * for user processes that is far easier to debug if this is explicitly
 	 * an error upon registering.
 	 */
-	if (current_user_event_enabler_exists((unsigned long)reg.enable_addr,
+	if (current_user_event_enabler_exists(info->group,
+					      (unsigned long)reg.enable_addr,
 					      reg.enable_bit))
 		return -EADDRINUSE;
 
-- 
2.43.0