On Fri, Oct 21, 2022 at 03:07:36PM -0700, Andrii Nakryiko wrote:
> On Wed, Oct 19, 2022 at 6:57 AM Jiri Olsa <jolsa@xxxxxxxxxx> wrote:
> >
> > Currently we allow to create kprobe multi link on function from kernel
> > module, but we don't take the module reference to ensure it's not
> > unloaded while we are tracing it.
> >
> > The multi kprobe link is based on fprobe/ftrace layer which takes
> > different approach and releases ftrace hooks when module is unloaded
> > even if there's tracer registered on top of it.
> >
> > Adding code that gathers all the related modules for the link and takes
> > their references before it's attached. All kernel module references are
> > released after link is unregistered.
> >
> > Note that we do it the same way already for trampoline probes
> > (but for single address).
> >
> > Acked-by: Song Liu <song@xxxxxxxxxx>
> > Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
> > ---
> > kernel/trace/bpf_trace.c | 92 ++++++++++++++++++++++++++++++++++++++++
> > 1 file changed, 92 insertions(+)
> >
> > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> > index 17ae9e8336db..9a4a2388dff2 100644
> > --- a/kernel/trace/bpf_trace.c
> > +++ b/kernel/trace/bpf_trace.c
> > @@ -2452,6 +2452,8 @@ struct bpf_kprobe_multi_link {
> > unsigned long *addrs;
> > u64 *cookies;
> > u32 cnt;
> > + struct module **mods;
> > + u32 mods_cnt;
>
> oh, and while we are at it, swap the order so two u32s are tightly packed?
will change
thanks,
jirka
>
> > };
> >
> > struct bpf_kprobe_multi_run_ctx {
> > @@ -2507,6 +2509,14 @@ static int copy_user_syms(struct user_syms *us, unsigned long __user *usyms, u32
> > return err;
> > }
>
> [...]
