Skip to content

RFC tracing/kprobes/uprobes: Fix race between opening probe event files and deleting probe

Steven Rostedt lkml 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 RFC Latest4 patches 37 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/4tracing: Add ref count to ftrace_event_callinclude/linux/ftrace_event.h kernel/trace/trace_events.c+77 -517 replies
2/4tracing: trace_remove_event_call() should fail if call/file is in useinclude/linux/ftrace_event.h kernel/trace/trace_events.c+32 -31 reply
3/4tracing/kprobes: Fail to unregister if probe event files are openkernel/trace/trace_kprobe.c+15 -630 replies
4/4tracing/uprobes: Fail to unregister if probe event files are openkernel/trace/trace_uprobe.c+36 -123 replies

Reviews trailers per patch

3 of 4 patches have a Reviewed-by or Acked-by.

PatchMasami HiramatsuOleg Nesterov
1/4
2/4R-b
3/4A-b A-b
4/4A-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v1 thread

Cover letter [RFC][PATCH 0/4] tracing/kprobes/uprobes: Fix race between opening probe event files and deleting probe

Currently there exists a race with deleting a kprobe or uprobe and a user opening the probe event file or using perf events.

The problem stems from not being able to take the probe_lock from the unregister code because we may have the event_mutex at the time, and the event mutex may be taken with the probe_lock held.

To solve this, the events get a ref count (using the flags field), where when an event file is opened, the ftrace_event_call ref count increments. Then this is checked under event_mutex and if set, the unregistering of the probe will fail.

Here's a test that shows how things break:

     # cd /sys/kernel/debug/tracing
     # echo 'p:sigprocmask sigprocmask' > kprobe_events || exit -1
     # enable_probe() {
        sleep 10
        echo 1
     }
     # file=events/kprobes/sigprocmask/enable
     # enable_probe > $file &
     > kprobe_events

The above will corrupt the kprobe system, as the write to the enable file will happen after the kprobe was deleted.

Trying to create the probe again fails:

# echo 'p:sigprocmask sigprocmask' > kprobe_events # cat kprobe_events
p:kprobes/sigprocmask sigprocmask
# ls events/kprobes/
enable filter

After applying these patches, the "> kprobe_events" fails due to the event being busy.

Masami, please review these patches and give your ack.

Srikar, can you please review the last patch. I didn't test uprobes with this. I'll do that after the 4th.

Thanks,

-- Steve

Oleg Nesterov (1):
tracing: trace_remove_event_call() should fail if call/file is in use

Steven Rostedt (Red Hat) (3):
tracing: Add ref count to ftrace_event_call tracing/kprobes: Fail to unregister if probe event files are open tracing/uprobes: Fail to unregister if probe event files are open

----

 include/linux/ftrace_event.h |    8 +++-
 kernel/trace/trace_events.c  |  109 +++++++++++++++++++++++++++++++++++++++---
 kernel/trace/trace_kprobe.c  |   21 +++++---
 kernel/trace/trace_uprobe.c  |   48 ++++++++++++++-----
 4 files changed, 160 insertions(+), 26 deletions(-)