• Masami Hiramatsu's avatar
    kprobes: Fix to free gone and unused optprobes · 7b959fc5
    Masami Hiramatsu authored
    Fix to free gone and unused optprobes. This bug will
    cause a kernel panic if the user reuses the killed and
    unused probe.
    
    Reported at:
    
      http://sourceware.org/ml/systemtap/2013-q2/msg00142.html
    
    In the normal path, an optprobe on an init function is
    unregistered when a module goes live.
    
    unregister_kprobe(kp)
     -> __unregister_kprobe_top
       ->__disable_kprobe
         ->disarm_kprobe(ap == op)
           ->__disarm_kprobe
            ->unoptimize_kprobe : the op is queued
                                  on unoptimizing_list
    and do nothing in __unregister_kprobe_bottom
    
    After a while (usually wait 5 jiffies), kprobe_optimizer
    runs to unoptimize and free optprobe.
    
    kprobe_optimizer
     ->do_unoptimize_kprobes
       ->arch_unoptimize_kprobes : moved to free_list
     ->do_free_cleaned_kprobes
       ->hlist_del: the op is removed
       ->free_aggr_kprobe
         ->arch_remove_optimized_kprobe
         ->arch_remove_kprobe
         ->kfree: the op is freed
    
    Here, if kprobes_module_callback is called and the delayed
    unoptimizing probe is picked BEFORE kprobe_optimizer runs,
    
    kprobes_module_callback
     ->kill_kprobe
       ->kill_optimized_kprobe : dequeued from unoptimizing_list <=!!!
         ->arch_remove_optimized_kprobe
       ->arch_remove_kprobe
       (but op is not freed, and on the kprobe hash table)
    
    This doesn't happen if the probe unregistration is done AFTER
    kprobes_module_callback is called (because at that time the op
    is gone), and kprobe-tracer does it.
    
    To fix this bug, this patch changes kprobes_module_callback to
    enqueue the op to freeing_list at kill_optimized_kprobe only
    if the op is unused. The unused probes on freeing_list will
    be freed in do_free_cleaned_kprobes.
    
    Note that this calls arch_remove_*kprobe twice on the
    same probe. Thus those functions have to check the double free.
    Fortunately, most of arch codes already checked that except
    for mips. This will be fixed in the next patch.
    Signed-off-by: 's avatarMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
    Cc: Timo Juhani Lindfors <timo.lindfors@iki.fi>
    Cc: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
    Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
    Cc: Frank Ch. Eigler <fche@redhat.com>
    Cc: systemtap@sourceware.org
    Cc: yrl.pp-manager.tt@hitachi.com
    Cc: David S. Miller <davem@davemloft.net>
    Cc: "David S. Miller" <davem@davemloft.net>
    Link: http://lkml.kernel.org/r/20130522093409.9084.63554.stgit@mhiramat-M0-7522
    [ Minor edits. ]
    Signed-off-by: 's avatarIngo Molnar <mingo@kernel.org>
    7b959fc5
kprobes.c 59.3 KB