tracing: Have trace_event_file have ref counters

The following can crash the kernel:

 # cd /sys/kernel/tracing
 # echo 'p:sched schedule' > kprobe_events
 # exec 5>>events/kprobes/sched/enable
 # > kprobe_events
 # exec 5>&-

The above commands:

 1. Change directory to the tracefs directory
 2. Create a kprobe event (doesn't matter what one)
 3. Open bash file descriptor 5 on the enable file of the kprobe event
 4. Delete the kprobe event (removes the files too)
 5. Close the bash file descriptor 5

The above causes a crash!

 BUG: kernel NULL pointer dereference, address: 0000000000000028
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 [#1] PREEMPT SMP PTI
 CPU: 6 PID: 877 Comm: bash Not tainted 6.5.0-rc4-test-00008-g2c6b6b1029d4-dirty #186
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
 RIP: 0010:tracing_release_file_tr+0xc/0x50

What happens here is that the kprobe event creates a trace_event_file
"file" descriptor that represents the file in tracefs to the event. It
maintains state of the event (is it enabled for the given instance?).
Opening the "enable" file gets a reference to the event "file" descriptor
via the open file descriptor. When the kprobe event is deleted, the file is
also deleted from the tracefs system which also frees the event "file"
descriptor.

But as the tracefs file is still opened by user space, it will not be
totally removed until the final dput() is called on it. But this is not
true with the event "file" descriptor that is already freed. If the user
does a write to or simply closes the file descriptor it will reference the
event "file" descriptor that was just freed, causing a use-after-free bug.

To solve this, add a ref count to the event "file" descriptor as well as a
new flag called "FREED". The "file" will not be freed until the last
reference is released. But the FREE flag will be set when the event is
removed to prevent any more modifications to that event from happening,
even if there's still a reference to the event "file" descriptor.

Link: https://lore.kernel.org/linux-trace-kernel/20231031000031.1e705592@gandalf.local.home/
Link: https://lore.kernel.org/linux-trace-kernel/20231031122453.7a48b923@gandalf.local.home
Cc: stable@vger.kernel.org
Cc: Mark Rutland <mark.rutland@arm.com>
Fixes: f5ca233e2e66d ("tracing: Increase trace array ref count on enable and filter files")
Reported-by: Beau Belgrave <beaub@linux.microsoft.com>
Tested-by: Beau Belgrave <beaub@linux.microsoft.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index 12207dc6722d1d4c3842fc24d9d546fbbd3856ac..696f8dc4aa53c14a70c9da93f8851b60ae1712bc 100644 (file)
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -492,6 +492,7 @@ enum {
        EVENT_FILE_FL_TRIGGER_COND_BIT,
        EVENT_FILE_FL_PID_FILTER_BIT,
        EVENT_FILE_FL_WAS_ENABLED_BIT,
+       EVENT_FILE_FL_FREED_BIT,
 };
 
 extern struct trace_event_file *trace_get_event_file(const char *instance,
@@ -630,6 +631,7 @@ extern int __kprobe_event_add_fields(struct dynevent_cmd *cmd, ...);
  *  TRIGGER_COND  - When set, one or more triggers has an associated filter
  *  PID_FILTER    - When set, the event is filtered based on pid
  *  WAS_ENABLED   - Set when enabled to know to clear trace on module removal
+ *  FREED         - File descriptor is freed, all fields should be considered invalid
  */
 enum {
        EVENT_FILE_FL_ENABLED           = (1 << EVENT_FILE_FL_ENABLED_BIT),
@@ -643,6 +645,7 @@ enum {
        EVENT_FILE_FL_TRIGGER_COND      = (1 << EVENT_FILE_FL_TRIGGER_COND_BIT),
        EVENT_FILE_FL_PID_FILTER        = (1 << EVENT_FILE_FL_PID_FILTER_BIT),
        EVENT_FILE_FL_WAS_ENABLED       = (1 << EVENT_FILE_FL_WAS_ENABLED_BIT),
+       EVENT_FILE_FL_FREED             = (1 << EVENT_FILE_FL_FREED_BIT),
 };
 
 struct trace_event_file {
@@ -671,6 +674,7 @@ struct trace_event_file {
         * caching and such. Which is mostly OK ;-)
         */
        unsigned long           flags;
+       atomic_t                ref;    /* ref count for opened files */
        atomic_t                sm_ref; /* soft-mode reference counter */
        atomic_t                tm_ref; /* trigger-mode reference counter */
 };

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 2539cfc20a976b7039022d3daab3a6bd9f1609a7..9aebf904ff9738137a314a78ead0092c009c4d38 100644 (file)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4978,6 +4978,20 @@ int tracing_open_file_tr(struct inode *inode, struct file *filp)
        if (ret)
                return ret;
 
+       mutex_lock(&event_mutex);
+
+       /* Fail if the file is marked for removal */
+       if (file->flags & EVENT_FILE_FL_FREED) {
+               trace_array_put(file->tr);
+               ret = -ENODEV;
+       } else {
+               event_file_get(file);
+       }
+
+       mutex_unlock(&event_mutex);
+       if (ret)
+               return ret;
+
        filp->private_data = inode->i_private;
 
        return 0;
@@ -4988,6 +5002,7 @@ int tracing_release_file_tr(struct inode *inode, struct file *filp)
        struct trace_event_file *file = inode->i_private;
 
        trace_array_put(file->tr);
+       event_file_put(file);
 
        return 0;
 }

diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 0e1405abf4f75b61c973c3cb1f57c36b06b148af..b7f4ea25a19431d1a78c5f21e15298dea3c51897 100644 (file)
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1669,6 +1669,9 @@ extern void event_trigger_unregister(struct event_command *cmd_ops,
                                     char *glob,
                                     struct event_trigger_data *trigger_data);
 
+extern void event_file_get(struct trace_event_file *file);
+extern void event_file_put(struct trace_event_file *file);
+
 /**
  * struct event_trigger_ops - callbacks for trace event triggers
  *

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index f9e3e24d87961437e20788cd3c0b57da5a6018dc..f29e815ca5b2e9bb7146f24817cc5c5b9aa78009 100644 (file)
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -990,13 +990,35 @@ static void remove_subsystem(struct trace_subsystem_dir *dir)
        }
 }
 
+void event_file_get(struct trace_event_file *file)
+{
+       atomic_inc(&file->ref);
+}
+
+void event_file_put(struct trace_event_file *file)
+{
+       if (WARN_ON_ONCE(!atomic_read(&file->ref))) {
+               if (file->flags & EVENT_FILE_FL_FREED)
+                       kmem_cache_free(file_cachep, file);
+               return;
+       }
+
+       if (atomic_dec_and_test(&file->ref)) {
+               /* Count should only go to zero when it is freed */
+               if (WARN_ON_ONCE(!(file->flags & EVENT_FILE_FL_FREED)))
+                       return;
+               kmem_cache_free(file_cachep, file);
+       }
+}
+
 static void remove_event_file_dir(struct trace_event_file *file)
 {
        eventfs_remove_dir(file->ei);
        list_del(&file->list);
        remove_subsystem(file->system);
        free_event_filter(file->filter);
-       kmem_cache_free(file_cachep, file);
+       file->flags |= EVENT_FILE_FL_FREED;
+       event_file_put(file);
 }
 
 /*
@@ -1369,7 +1391,7 @@ event_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
                flags = file->flags;
        mutex_unlock(&event_mutex);
 
-       if (!file)
+       if (!file || flags & EVENT_FILE_FL_FREED)
                return -ENODEV;
 
        if (flags & EVENT_FILE_FL_ENABLED &&
@@ -1403,7 +1425,7 @@ event_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
                ret = -ENODEV;
                mutex_lock(&event_mutex);
                file = event_file_data(filp);
-               if (likely(file)) {
+               if (likely(file && !(file->flags & EVENT_FILE_FL_FREED))) {
                        ret = tracing_update_buffers(file->tr);
                        if (ret < 0) {
                                mutex_unlock(&event_mutex);
@@ -1683,7 +1705,7 @@ event_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
 
        mutex_lock(&event_mutex);
        file = event_file_data(filp);
-       if (file)
+       if (file && !(file->flags & EVENT_FILE_FL_FREED))
                print_event_filter(file, s);
        mutex_unlock(&event_mutex);
 
@@ -2902,6 +2924,7 @@ trace_create_new_event(struct trace_event_call *call,
        atomic_set(&file->tm_ref, 0);
        INIT_LIST_HEAD(&file->triggers);
        list_add(&file->list, &tr->events);
+       event_file_get(file);
 
        return file;
 }

diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 33264e510d161f5c78fdd464e45b6f966dd765d9..0c611b281a5b5f71ca11de8ccdc939e725725625 100644 (file)
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -2349,6 +2349,9 @@ int apply_event_filter(struct trace_event_file *file, char *filter_string)
        struct event_filter *filter = NULL;
        int err;
 
+       if (file->flags & EVENT_FILE_FL_FREED)
+               return -ENODEV;
+
        if (!strcmp(strstrip(filter_string), "0")) {
                filter_disable(file);
                filter = event_filter(file);