In the Linux kernel, the following vulnerability has been resolved:
kprobes: don't call disarm_kprobe() for disabled kprobes
The assumption in _disablekprobe() is wrong, and it could try to disarm an already disarmed kprobe and fire the WARN_ONCE() below. [0] We can easily reproduce this issue.
Write 0 to /sys/kernel/debug/kprobes/enabled.
Run execsnoop. At this time, one kprobe is disabled.
[1] 2460 PCOMM PID PPID RET ARGS
ffffffff91345650 r _x64sysexecve+0x0 [FTRACE] ffffffff91345650 k _x64sysexecve+0x0 [DISABLED][FTRACE]
Write 1 to /sys/kernel/debug/kprobes/enabled, which changes kprobesalldisarmed to false but does not arm the disabled kprobe.
ffffffff91345650 r _x64sysexecve+0x0 [FTRACE] ffffffff91345650 k _x64sysexecve+0x0 [DISABLED][FTRACE]
Kill execsnoop, when _disablekprobe() calls disarmkprobe() for the disabled kprobe and hits the WARNONCE() in _disarmkprobe_ftrace().
/usr/share/bcc/tools/execsnoop ^C
Actually, WARNONCE() is fired twice, and _unregisterkprobetop() misses some cleanups and leaves the aggregated kprobe in the hash table. Then, _unregistertrace_kprobe() initialises tk->rp.kp.list and creates an infinite loop like this.
aggregated kprobe.list -> kprobe.list -. ^ | '.__.'
In this situation, these commands fall into the infinite loop and result in RCU stall or soft lockup.
cat /sys/kernel/debug/kprobes/list : showkprobeaddr() enters into the infinite loop with RCU.
/usr/share/bcc/tools/execsnoop : warnkproberereg() holds kprobemutex, and _getvalidkprobe() is stuck in the loop.
To avoid the issue, make sure we don't call disarm_kprobe() for disabled kprobes.
[0] Failed to disarm kprobe-ftrace at x64sysexecve+0x0/0x40 (error -2) WARNING: CPU: 6 PID: 2460 at kernel/kprobes.c:1130 _disarmkprobeftrace.isra.19 (kernel/kprobes.c:1129) Modules linked in: ena CPU: 6 PID: 2460 Comm: execsnoop Not tainted 5.19.0+ #28 Hardware name: Amazon EC2 c5.2xlarge/, BIOS 1.0 10/16/2017 RIP: 0010:disarmkprobeftrace.isra.19 (kernel/kprobes.c:1129) Code: 24 8b 02 eb c1 80 3d c4 83 f2 01 00 75 d4 48 8b 75 00 89 c2 48 c7 c7 90 fa 0f 92 89 04 24 c6 05 ab 83 01 e8 e4 94 f0 ff <0f> 0b 8b 04 24 eb b1 89 c6 48 c7 c7 60 fa 0f 92 89 04 24 e8 cc 94 RSP: 0018:ffff9e6ec154bd98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff930f7b00 RCX: 0000000000000001 RDX: 0000000080000001 RSI: ffffffff921461c5 RDI: 00000000ffffffff RBP: ffff89c504286da8 R08: 0000000000000000 R09: c0000000fffeffff R10: 0000000000000000 R11: ffff9e6ec154bc28 R12: ffff89c502394e40 R13: ffff89c502394c00 R14: ffff9e6ec154bc00 R15: 0000000000000000 FS: 00007fe800398740(0000) GS:ffff89c812d80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c00057f010 CR3: 0000000103b54006 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> _disablekprobe (kernel/kprobes.c:1716) disablekprobe (kernel/kprobes.c:2392) _disabletracekprobe (kernel/trace/tracekprobe.c:340) disabletracekprobe (kernel/trace/tracekprobe.c:429) perftraceeventunreg.isra.2 (./include/linux/tracepoint.h:93 kernel/trace/traceeventperf.c:168) perfkprobedestroy (kernel/trace/traceeventperf.c:295) freeevent (kernel/events/core.c:4971) perfeventreleasekernel (kernel/events/core.c:5176) perfrelease (kernel/events/core.c:5186) _fput (fs/filetable.c:321) taskworkrun (./include/linux/ ---truncated---
[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b474ff1b20951f1eac75d100a93861e6da2b522b",
        "target": {
            "function": "__disable_kprobe",
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-17a5c1da",
        "signature_type": "Function",
        "digest": {
            "length": 499.0,
            "function_hash": "203416074594320391114086419835199639944"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@744b0d3080709a172f0408aedabd1cedd24c2ee6",
        "target": {
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-21dc26f3",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "31377193749484076233562012348954755808",
                "283030541635559849347304943637466248455",
                "50198703440687434685105466296352848356",
                "121079917088020392848993334921875563190"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f3c1bc22fc2165461883f506b4d2c3594bd7137",
        "target": {
            "function": "__disable_kprobe",
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-31de6d83",
        "signature_type": "Function",
        "digest": {
            "length": 377.0,
            "function_hash": "305483165318396343923498647274207142157"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c80e79906b4ca440d09e7f116609262bb747909",
        "target": {
            "function": "__disable_kprobe",
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-38adc99d",
        "signature_type": "Function",
        "digest": {
            "length": 529.0,
            "function_hash": "18478206017919056265645950441142798595"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b474ff1b20951f1eac75d100a93861e6da2b522b",
        "target": {
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-405cacc2",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "31377193749484076233562012348954755808",
                "283030541635559849347304943637466248455",
                "50198703440687434685105466296352848356",
                "121079917088020392848993334921875563190"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f3c1bc22fc2165461883f506b4d2c3594bd7137",
        "target": {
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-48009f65",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "25264580365683523411994744769114678813",
                "24898013704783289853930316000531623257",
                "257964036136078548270698235299625612139",
                "315866637841393680855251639766578965152",
                "79965970956571454959847799850622045025"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19cd630712e7c13a3dedfc6986a9b983fed6fd98",
        "target": {
            "function": "__disable_kprobe",
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-48bfc2e1",
        "signature_type": "Function",
        "digest": {
            "length": 377.0,
            "function_hash": "305483165318396343923498647274207142157"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@19cd630712e7c13a3dedfc6986a9b983fed6fd98",
        "target": {
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-69fac7f5",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "25264580365683523411994744769114678813",
                "24898013704783289853930316000531623257",
                "257964036136078548270698235299625612139",
                "315866637841393680855251639766578965152",
                "79965970956571454959847799850622045025"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55c7a91527343d2e0b5647cc308c6e04ddd2aa52",
        "target": {
            "function": "__disable_kprobe",
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-a5f48abb",
        "signature_type": "Function",
        "digest": {
            "length": 499.0,
            "function_hash": "203416074594320391114086419835199639944"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc3188d8a3b8c08c306a4c851ddb2c92ba4599ca",
        "target": {
            "function": "__disable_kprobe",
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-ab6faf6a",
        "signature_type": "Function",
        "digest": {
            "length": 529.0,
            "function_hash": "18478206017919056265645950441142798595"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc3188d8a3b8c08c306a4c851ddb2c92ba4599ca",
        "target": {
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-ada1f6d8",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "31377193749484076233562012348954755808",
                "283030541635559849347304943637466248455",
                "50198703440687434685105466296352848356",
                "121079917088020392848993334921875563190"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@55c7a91527343d2e0b5647cc308c6e04ddd2aa52",
        "target": {
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-b0a324d5",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "31377193749484076233562012348954755808",
                "283030541635559849347304943637466248455",
                "50198703440687434685105466296352848356",
                "121079917088020392848993334921875563190"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc91d2db55acdaf0c0075b624e572d3520ca3bc3",
        "target": {
            "function": "__disable_kprobe",
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-b3a2bfc2",
        "signature_type": "Function",
        "digest": {
            "length": 499.0,
            "function_hash": "203416074594320391114086419835199639944"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c80e79906b4ca440d09e7f116609262bb747909",
        "target": {
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-c4804e96",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "31377193749484076233562012348954755808",
                "283030541635559849347304943637466248455",
                "50198703440687434685105466296352848356",
                "121079917088020392848993334921875563190"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@744b0d3080709a172f0408aedabd1cedd24c2ee6",
        "target": {
            "function": "__disable_kprobe",
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-e69fb028",
        "signature_type": "Function",
        "digest": {
            "length": 499.0,
            "function_hash": "203416074594320391114086419835199639944"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc91d2db55acdaf0c0075b624e572d3520ca3bc3",
        "target": {
            "file": "kernel/kprobes.c"
        },
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2022-50008-e9f93867",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "31377193749484076233562012348954755808",
                "283030541635559849347304943637466248455",
                "50198703440687434685105466296352848356",
                "121079917088020392848993334921875563190"
            ]
        }
    }
]