tracing: fprobe events: Fix possible UAF on modules

JIRA: https://issues.redhat.com/browse/RHEL-86682

Conflicts: Context change from missing commit 8275637 ("tracing:
Adopt __free() and guard() for trace_fprobe.c")

commit dd94150
Author: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Date:   Mon Mar 31 23:05:07 2025 +0900

    tracing: fprobe events: Fix possible UAF on modules

    Commit ac91052 ("tracing: tprobe-events: Fix leakage of module
    refcount") moved try_module_get() from __find_tracepoint_module_cb()
    to find_tracepoint() caller, but that introduced a possible UAF
    because the module can be unloaded before try_module_get(). In this
    case, the module object should be freed too. Thus, try_module_get()
    does not only fail but may access to the freed object.

    To avoid that, try_module_get() in __find_tracepoint_module_cb()
    again.

    Link: https://lore.kernel.org/all/174342990779.781946.9138388479067729366.stgit@devnote2/

    Fixes: ac91052 ("tracing: tprobe-events: Fix leakage of module refcount")
    Cc: stable@vger.kernel.org
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Signed-off-by: Jerome Marchand <jmarchan@redhat.com>

Author: jeromemarchand

kernel/trace/trace_fprobe.c

@@ -888,9 +888,15 @@ static void __find_tracepoint_module_cb(struct tracepoint *tp, struct module *mo
 	struct __find_tracepoint_cb_data *data = priv;
 
 	if (!data->tpoint && !strcmp(data->tp_name, tp->name)) {
-		data->tpoint = tp;
-		if (!data->mod)
+		/* If module is not specified, try getting module refcount. */
+		if (!data->mod && mod) {
+			/* If failed to get refcount, ignore this tracepoint. */
+			if (!try_module_get(mod))
+				return;
+
 			data->mod = mod;
+		}
+		data->tpoint = tp;
 	}
 }
 
@@ -902,7 +908,11 @@ static void __find_tracepoint_cb(struct tracepoint *tp, void *priv)
 		data->tpoint = tp;
 }
 
-/* Find a tracepoint from kernel and module. */
+/*
+ * Find a tracepoint from kernel and module. If the tracepoint is on the module,
+ * the module's refcount is incremented and returned as *@tp_mod. Thus, if it is
+ * not NULL, caller must call module_put(*tp_mod) after used the tracepoint.
+ */
 static struct tracepoint *find_tracepoint(const char *tp_name,
 					  struct module **tp_mod)
 {
@@ -931,7 +941,10 @@ static void reenable_trace_fprobe(struct trace_fprobe *tf)
 	}
 }
 
-/* Find a tracepoint from specified module. */
+/*
+ * Find a tracepoint from specified module. In this case, this does not get the
+ * module's refcount. The caller must ensure the module is not freed.
+ */
 static struct tracepoint *find_tracepoint_in_module(struct module *mod,
 						    const char *tp_name)
 {
@@ -1167,11 +1180,6 @@ static int __trace_fprobe_create(int argc, const char *argv[])
 	if (is_tracepoint) {
 		ctx.flags |= TPARG_FL_TPOINT;
 		tpoint = find_tracepoint(symbol, &tp_mod);
-		/* lock module until register this tprobe. */
-		if (tp_mod && !try_module_get(tp_mod)) {
-			tpoint = NULL;
-			tp_mod = NULL;
-		}
 		if (tpoint) {
 			ctx.funcname = kallsyms_lookup(
 				(unsigned long)tpoint->probestub,