[PATCH] kprobes: fix race in unregister_kprobe()

[Ananth N Mavinakayanahalli]

From: Ananth N Mavinakayanahalli <ananth@xxxxxxxxxx>

On architectures which have no-execute support, we use a
module_alloc()ed scratch area to store the kprobed instruction
for out-of-line single-stepping. This instruction slot is
released during unregister_kprobe().

We are currently releasing the slot before synchronize_sched()
would return, leading to a potential reuse of the slot by
another kprobe before the current references are released.
Small patch to fix that condition.

Signed-off-by: Ananth N Mavinakayanahalli <ananth@xxxxxxxxxx>
Acked-by: Anil S Keshavamurthy <anil.s.keshavamurthy@xxxxxxxxx>
---

 kernel/kprobes.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

Index: linux-2.6.15-rc3/kernel/kprobes.c
===================================================================
--- linux-2.6.15-rc3.orig/kernel/kprobes.c
+++ linux-2.6.15-rc3/kernel/kprobes.c
@@ -436,7 +436,6 @@ static inline void cleanup_kprobe(struct
 	arch_disarm_kprobe(p);
 	hlist_del_rcu(&p->hlist);
 	spin_unlock_irqrestore(&kprobe_lock, flags);
-	arch_remove_kprobe(p);
 }
 
 static inline void cleanup_aggr_kprobe(struct kprobe *old_p,
@@ -506,6 +505,8 @@ void __kprobes unregister_kprobe(struct 
 			cleanup_kprobe(p, flags);
 
 		synchronize_sched();
+		arch_remove_kprobe(p);
+
 		if (old_p->pre_handler == aggr_pre_handler &&
 				list_empty(&old_p->list))
 			kfree(old_p);
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/