* Peter Zijlstra <peterz@xxxxxxxxxxxxx> [2011-01-26 16:45:56]: > On Wed, 2011-01-26 at 21:00 +0530, Srikar Dronamraju wrote: > > * Peter Zijlstra <peterz@xxxxxxxxxxxxx> [2011-01-26 11:11:48]: > > > > > On Wed, 2011-01-26 at 13:25 +0530, Srikar Dronamraju wrote: > > > > > > > > > > + > > > > > > + list_add(&mm->uprobes_list, &tmp_list); > > > > > > + mm->uprobes_vaddr = vma->vm_start + offset; > > > > > > + } > > > > > > + spin_unlock(&mapping->i_mmap_lock); > > > > > > > > > > Both this and unregister are racy, what is to say: > > > > > - the vma didn't get removed from the mm > > > > > - no new matching vma got added > > > > > > > > > > > > > register_uprobe, unregister_uprobe, uprobe_mmap are all synchronized by > > > > uprobes_mutex. So I dont see one unregister_uprobe getting thro when > > > > another register_uprobe is working with a vma. > > > > > > > > If I am missing something elementary, please explain a bit more. > > > > > > afaict you're not holding the mmap_sem, so userspace can simply unmap > > > the vma. > > > > When we do the actual insert/remove of the breakpoint we hold the > > mmap_sem. During the actual insertion/removal, if the vma for the > > specific inode is not found, we just come out without doing the > > actual insertion/deletion. > > Right, but then install_uprobe() should: > > - lookup the vma relating to the address you stored, We already do this thro get_user_pages in write_opcode(). > - validate that the vma is indeed a map of the right inode We can add a check in write_opcode( we need to pass the inode to write_opcode). > - validate that the offset of the probe corresponds with the stored > address I am not clear on this. We would have derived the address from the offset. So is that we check for (vaddr == vma->vm_start + uprobe->offset) > > Otherwise you can race with unmap/map and end up installing the probe in > a random location. > > Also, I think the whole thing goes funny if someone maps the same text > twice ;-) I am not sure if we can map the same text twice. If something like this is possible then we would have 2 addresses for each function. So how does the linker know which address to jump to out of the 2 or multiple matching addresses. What would be the usecases for same text being mapped multiple times and both being executable? -- Thanks and Regards Srikar -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxxx For more info on Linux MM, see: http://www.linux-mm.org/ . Fight unfair telecom policy in Canada: sign http://dissolvethecrtc.ca/ Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>