fprobe: Ensure running fprobe_exit_handler() finished before calling rethook_free()

JIRA: https://issues.redhat.com/browse/RHEL-26131

commit 195b9cb
Author: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Date:   Fri Jul 7 23:03:19 2023 +0900

    fprobe: Ensure running fprobe_exit_handler() finished before calling rethook_free()

    Ensure running fprobe_exit_handler() has finished before
    calling rethook_free() in the unregister_fprobe() so that caller can free
    the fprobe right after unregister_fprobe().

    unregister_fprobe() ensured that all running fprobe_entry/exit_handler()
    have finished by calling unregister_ftrace_function() which synchronizes
    RCU. But commit 5f81018 ("fprobe: Release rethook after the ftrace_ops
    is unregistered") changed to call rethook_free() after
    unregister_ftrace_function(). So call rethook_stop() to make rethook
    disabled before unregister_ftrace_function() and ensure it again.

    Here is the possible code flow that can call the exit handler after
    unregister_fprobe().

    ------
     CPU1                              CPU2
     call unregister_fprobe(fp)
     ...
                                       __fprobe_handler()
                                       rethook_hook() on probed function
     unregister_ftrace_function()
                                       return from probed function
                                       rethook hooks
                                       find rh->handler == fprobe_exit_handler
                                       call fprobe_exit_handler()
     rethook_free():
       set rh->handler = NULL;
     return from unreigster_fprobe;
                                       call fp->exit_handler() <- (*)
    ------

    (*) At this point, the exit handler is called after returning from
    unregister_fprobe().

    This fixes it as following;
    ------
     CPU1                              CPU2
     call unregister_fprobe()
     ...
     rethook_stop():
       set rh->handler = NULL;
                                       __fprobe_handler()
                                       rethook_hook() on probed function
     unregister_ftrace_function()
                                       return from probed function
                                       rethook hooks
                                       find rh->handler == NULL
                                       return from rethook
     rethook_free()
     return from unreigster_fprobe;
    ------

    Link: https://lore.kernel.org/all/168873859949.156157.13039240432299335849.stgit@devnote2/

    Fixes: 5f81018 ("fprobe: Release rethook after the ftrace_ops is unregistered")
    Cc: stable@vger.kernel.org
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>

Signed-off-by: Viktor Malik <vmalik@redhat.com>

Author: viktormalik

include/linux/rethook.h

@@ -59,6 +59,7 @@ struct rethook_node {
 };
 
 struct rethook *rethook_alloc(void *data, rethook_handler_t handler);
+void rethook_stop(struct rethook *rh);
 void rethook_free(struct rethook *rh);
 void rethook_add_node(struct rethook *rh, struct rethook_node *node);
 struct rethook_node *rethook_try_get(struct rethook *rh);

kernel/trace/fprobe.c

@@ -349,6 +349,9 @@ int unregister_fprobe(struct fprobe *fp)
 		    fp->ops.saved_func != fprobe_kprobe_handler))
 		return -EINVAL;
 
+	if (fp->rethook)
+		rethook_stop(fp->rethook);
+
 	ret = unregister_ftrace_function(&fp->ops);
 	if (ret < 0)
 		return ret;

kernel/trace/rethook.c

@@ -53,6 +53,19 @@ static void rethook_free_rcu(struct rcu_head *head)
 		kfree(rh);
 }
 
+/**
+ * rethook_stop() - Stop using a rethook.
+ * @rh: the struct rethook to stop.
+ *
+ * Stop using a rethook to prepare for freeing it. If you want to wait for
+ * all running rethook handler before calling rethook_free(), you need to
+ * call this first and wait RCU, and call rethook_free().
+ */
+void rethook_stop(struct rethook *rh)
+{
+	WRITE_ONCE(rh->handler, NULL);
+}
+
 /**
  * rethook_free() - Free struct rethook.
  * @rh: the struct rethook to be freed.