Since the backport commit eea46baf1451 ("ftrace: Fix possible use-after-free issue in ftrace_location()") on linux-5.4.y branch, the old ftrace_int3_handler()->ftrace_location() path has included rcu_read_lock(), which has mcount location inside and leads to potential double fault.

Replace rcu_read_lock/unlock with preempt_enable/disable notrace macros so that the mcount location does not appear on the int3 handler path.

This fix is specific to linux-5.4.y branch, the only branch still using ftrace_int3_handler with commit e60b613df8b6 ("ftrace: Fix possible use-after-free issue in ftrace_location()") backported. It also avoids the need to backport the code conversion to text_poke() on this branch.

Reported-by: Koichiro Den koichiro.den@canonical.com Closes: https://lore.kernel.org/all/74gjhwxupvozwop7ndhrh7t5qeckomt7yqvkkbm5j2tlx6dk... Fixes: eea46baf1451 ("ftrace: Fix possible use-after-free issue in ftrace_location()") # linux-5.4.y Signed-off-by: Steven Rostedt (Google) rostedt@goodmis.org Signed-off-by: Koichiro Den koichiro.den@canonical.com --- kernel/trace/ftrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 380032a27f98..2eb1a8ec5755 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -1554,7 +1554,7 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) struct dyn_ftrace key; unsigned long ip = 0;

- rcu_read_lock(); + preempt_disable_notrace(); key.ip = start; key.flags = end; /* overload flags, as it is unsigned long */

@@ -1572,7 +1572,7 @@ unsigned long ftrace_location_range(unsigned long start, unsigned long end) break; } } - rcu_read_unlock(); + preempt_enable_notrace(); return ip; }