On Mon, Jan 22, 2024 at 02:30:31PM +0300, Fedor Pchelkin wrote: > From: "Masami Hiramatsu (Google)" <mhiramat@xxxxxxxxxx> > > commit 4fbd2f83fda0ca44a2ec6421ca3508b355b31858 upstream. > > Since forcibly unoptimized kprobes will be put on the freeing_list directly > in the unoptimize_kprobe(), do_unoptimize_kprobes() must continue to check > the freeing_list even if unoptimizing_list is empty. > > This bug can happen if a kprobe is put in an instruction which is in the > middle of the jump-replaced instruction sequence of an optprobe, *and* the > optprobe is recently unregistered and queued on unoptimizing_list. > In this case, the optprobe will be unoptimized forcibly (means immediately) > and put it into the freeing_list, expecting the optprobe will be handled in > do_unoptimize_kprobe(). > But if there is no other optprobes on the unoptimizing_list, current code > returns from the do_unoptimize_kprobe() soon and does not handle the > optprobe which is on the freeing_list. Then the optprobe will hit the > WARN_ON_ONCE() in the do_free_cleaned_kprobes(), because it is not handled > in the latter loop of the do_unoptimize_kprobe(). > > To solve this issue, do not return from do_unoptimize_kprobes() immediately > even if unoptimizing_list is empty. > > Moreover, this change affects another case. kill_optimized_kprobes() expects > kprobe_optimizer() will just free the optprobe on freeing_list. > So I changed it to just do list_move() to freeing_list if optprobes are on > unoptimizing list. And the do_unoptimize_kprobe() will skip > arch_disarm_kprobe() if the probe on freeing_list has gone flag. > > Link: https://lore.kernel.org/all/Y8URdIfVr3pq2X8w@xxxxxxxxxxxxxxxx/ > Link: https://lore.kernel.org/all/167448024501.3253718.13037333683110512967.stgit@devnote3/ > > Fixes: e4add247789e ("kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic") > Reported-by: Pengfei Xu <pengfei.xu@xxxxxxxxx> > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx > Acked-by: Steven Rostedt (Google) <rostedt@xxxxxxxxxxx> > [fp: adjust comment conflict regarding commit 223a76b268c9 ("kprobes: Fix > coding style issues")] > Signed-off-by: Fedor Pchelkin <pchelkin@xxxxxxxxx> > --- > kernel/kprobes.c | 23 ++++++++++------------- > 1 file changed, 10 insertions(+), 13 deletions(-) Now queued up, thanks. greg k-h
