kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case

In the Linux kernel, the following vulnerability has been resolved:

kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case

In __unregister_kprobe_top(), if the currently unregistered probe has

post_handler but other child probes of the aggrprobe do not have

post_handler, the post_handler of the aggrprobe is cleared. If this is

a ftrace-based probe, there is a problem. In later calls to

disarm_kprobe(), we will use kprobe_ftrace_ops because post_handler is

NULL. But we're armed with kprobe_ipmodify_ops. This triggers a WARN in

__disarm_kprobe_ftrace() and may even cause use-after-free:

Failed to disarm kprobe-ftrace at kernel_clone+0x0/0x3c0 (error -2)

WARNING: CPU: 5 PID: 137 at kernel/kprobes.c:1135 __disarm_kprobe_ftrace.isra.21+0xcf/0xe0

Modules linked in: testKprobe_007(-)

CPU: 5 PID: 137 Comm: rmmod Not tainted 6.1.0-rc4-dirty #18

[...]

Call Trace:

<TASK>

__disable_kprobe+0xcd/0xe0

__unregister_kprobe_top+0x12/0x150

? mutex_lock+0xe/0x30

unregister_kprobes.part.23+0x31/0xa0

unregister_kprobe+0x32/0x40

__x64_sys_delete_module+0x15e/0x260

? do_user_addr_fault+0x2cd/0x6b0

do_syscall_64+0x3a/0x90

entry_SYSCALL_64_after_hwframe+0x63/0xcd

[...]

For the kprobe-on-ftrace case, we keep the post_handler setting to

identify this aggrprobe armed with kprobe_ipmodify_ops. This way we

can disarm it correctly.