Received-SPF: pass (google.com: domain of linux-kernel+bounces-33856-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Mon, 22 Jan 2024 09:47:33 -0800
From: Greg KH <gregkh@linuxfoundation.org>
To: Fedor Pchelkin <pchelkin@ispras.ru>
Cc: stable@vger.kernel.org, Masami Hiramatsu <mhiramat@kernel.org>,
	"Steven Rostedt (Google)" <rostedt@goodmis.org>,
	linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org,
	Pengfei Xu <pengfei.xu@intel.com>
Subject: Re: [PATCH 5.10/5.15 1/1] kprobes: Fix to handle forcibly
 unoptimized kprobes on freeing_list
Message-ID: <2024012224-clatter-siren-ac3d@gregkh>
References: <20240122113031.301202-1-pchelkin@ispras.ru>
 <20240122113031.301202-2-pchelkin@ispras.ru>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240122113031.301202-2-pchelkin@ispras.ru>

On Mon, Jan 22, 2024 at 02:30:31PM +0300, Fedor Pchelkin wrote:
> From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
> 
> commit 4fbd2f83fda0ca44a2ec6421ca3508b355b31858 upstream.
> 
> Since forcibly unoptimized kprobes will be put on the freeing_list directly
> in the unoptimize_kprobe(), do_unoptimize_kprobes() must continue to check
> the freeing_list even if unoptimizing_list is empty.
> 
> This bug can happen if a kprobe is put in an instruction which is in the
> middle of the jump-replaced instruction sequence of an optprobe, *and* the
> optprobe is recently unregistered and queued on unoptimizing_list.
> In this case, the optprobe will be unoptimized forcibly (means immediately)
> and put it into the freeing_list, expecting the optprobe will be handled in
> do_unoptimize_kprobe().
> But if there is no other optprobes on the unoptimizing_list, current code
> returns from the do_unoptimize_kprobe() soon and does not handle the
> optprobe which is on the freeing_list. Then the optprobe will hit the
> WARN_ON_ONCE() in the do_free_cleaned_kprobes(), because it is not handled
> in the latter loop of the do_unoptimize_kprobe().
> 
> To solve this issue, do not return from do_unoptimize_kprobes() immediately
> even if unoptimizing_list is empty.
> 
> Moreover, this change affects another case. kill_optimized_kprobes() expects
> kprobe_optimizer() will just free the optprobe on freeing_list.
> So I changed it to just do list_move() to freeing_list if optprobes are on
> unoptimizing list. And the do_unoptimize_kprobe() will skip
> arch_disarm_kprobe() if the probe on freeing_list has gone flag.
> 
> Link: https://lore.kernel.org/all/Y8URdIfVr3pq2X8w@xpf.sh.intel.com/
> Link: https://lore.kernel.org/all/167448024501.3253718.13037333683110512967.stgit@devnote3/
> 
> Fixes: e4add247789e ("kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic")
> Reported-by: Pengfei Xu <pengfei.xu@intel.com>
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> Cc: stable@vger.kernel.org
> Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
> [fp: adjust comment conflict regarding commit 223a76b268c9 ("kprobes: Fix
>  coding style issues")]
> Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
> ---
>  kernel/kprobes.c | 23 ++++++++++-------------
>  1 file changed, 10 insertions(+), 13 deletions(-)

Now queued up, thanks.

greg k-h