In the Linux kernel, the following vulnerability has been resolved:
fgraph: Add READONCE() when accessing fgrapharray[]
In _ftracereturntohandler(), a loop iterates over the fgrapharray[] elements, which are fgraphops. The loop checks if an element is a fgraphstub to prevent using a fgraphstub afterward.
However, if the compiler reloads fgrapharray[] after this check, it might race with an update to fgrapharray[] that introduces a fgraphstub. This could result in the stub being processed, but the stub contains a null "funchash" field, leading to a NULL pointer dereference.
To ensure that the gops compared against the fgraphstub matches the gops processed later, add a READONCE(). A similar patch appears in commit 63a8dfb ("functiongraph: Add READONCE() when accessing fgraph_array[]").