[PATCH] Fix kprobes handling of simultaneous probe hit/unregister

[PATCH] Fix kprobes handling of simultaneous probe hit/unregister

[Jim Keniston]

[-- Attachment #1: Type: text/plain, Size: 1017 bytes --]

This patch fixes a bug in kprobes's handling of a corner case on i386
and x86_64.  On an SMP system, if one CPU unregisters a kprobe just
after another CPU hits that probepoint, kprobe_handler() on the latter
CPU sees that the kprobe has been unregistered, and attempts to let the
CPU continue as if the probepoint hadn't been hit.  The bug is that on
i386 and x86_64, we were neglecting to set the IP back to the beginning
of the probed instruction.  This could cause an oops or crash.

This bug doesn't exist on ppc64 and ia64, where a breakpoint
instruction leaves the IP pointing to the beginning of the instruction.
I don't know about sparc64.  (Dave, could you please advise?)

This fix has been tested on i386 and x86_64 SMP systems.  To reproduce
the problem, set one CPU to work registering and unregistering a kprobe
repeatedly, and another CPU pounding the probepoint in a tight loop.

Please apply.

Acked-by: Prasanna S Panchamukhi <prasanna@in.ibm.com>
Signed-off-by: Jim Keniston <jkenisto@us.ibm.com>

[-- Attachment #2: kprobes_unregister_fix.patch --]
[-- Type: text/plain, Size: 1065 bytes --]

--- linux-2.6.13/arch/i386/kernel/kprobes.c	2005-08-30 12:27:35.000000000 -0700
+++ linux-fixed/arch/i386/kernel/kprobes.c	2005-08-30 15:33:03.000000000 -0700
@@ -220,7 +220,10 @@
 			 * either a probepoint or a debugger breakpoint
 			 * at this address.  In either case, no further
 			 * handling of this interrupt is appropriate.
+			 * Back up over the (now missing) int3 and run
+			 * the original instruction.
 			 */
+			regs->eip -= sizeof(kprobe_opcode_t);
 			ret = 1;
 		}
 		/* Not one of ours: let kernel handle it */
--- linux-2.6.13/arch/x86_64/kernel/kprobes.c	2005-08-30 12:27:35.000000000 -0700
+++ linux-fixed/arch/x86_64/kernel/kprobes.c	2005-08-30 15:32:31.000000000 -0700
@@ -360,7 +360,10 @@
 			 * either a probepoint or a debugger breakpoint
 			 * at this address.  In either case, no further
 			 * handling of this interrupt is appropriate.
+			 * Back up over the (now missing) int3 and run
+			 * the original instruction.
 			 */
+			regs->rip = (unsigned long)addr;
 			ret = 1;
 		}
 		/* Not one of ours: let kernel handle it */

Re: [PATCH] Fix kprobes handling of simultaneous probe hit/unregister

[David S. Miller]

From: Jim Keniston <jkenisto@us.ibm.com>
Date: 31 Aug 2005 14:53:37 -0700

> This bug doesn't exist on ppc64 and ia64, where a breakpoint
> instruction leaves the IP pointing to the beginning of the instruction.
> I don't know about sparc64.  (Dave, could you please advise?)

On sparc64 instructions are all 32-bit, 4-byte aligned, and a
breakpoint instruction leaves the PC pointing at the beginning of that
breakpoint instruction.

So I think sparc64 should be OK.