On Wed, Oct 19, 2022 at 6:57 AM Jiri Olsa <jolsa@xxxxxxxxxx> wrote:
>
> Currently we allow to create kprobe multi link on function from kernel
> module, but we don't take the module reference to ensure it's not
> unloaded while we are tracing it.
>
> The multi kprobe link is based on fprobe/ftrace layer which takes
> different approach and releases ftrace hooks when module is unloaded
> even if there's tracer registered on top of it.
>
> Adding code that gathers all the related modules for the link and takes
> their references before it's attached. All kernel module references are
> released after link is unregistered.
>
> Note that we do it the same way already for trampoline probes
> (but for single address).
>
> Acked-by: Song Liu <song@xxxxxxxxxx>
> Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
> ---
> kernel/trace/bpf_trace.c | 92 ++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 92 insertions(+)
>
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 17ae9e8336db..9a4a2388dff2 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -2452,6 +2452,8 @@ struct bpf_kprobe_multi_link {
> unsigned long *addrs;
> u64 *cookies;
> u32 cnt;
> + struct module **mods;
> + u32 mods_cnt;
oh, and while we are at it, swap the order so two u32s are tightly packed?
> };
>
> struct bpf_kprobe_multi_run_ctx {
> @@ -2507,6 +2509,14 @@ static int copy_user_syms(struct user_syms *us, unsigned long __user *usyms, u32
> return err;
> }
[...]
