From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753482AbbGaOAr (ORCPT ); Fri, 31 Jul 2015 10:00:47 -0400 Received: from terminus.zytor.com ([198.137.202.10]:57420 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751477AbbGaOAp (ORCPT ); Fri, 31 Jul 2015 10:00:45 -0400 Date: Fri, 31 Jul 2015 07:00:09 -0700 From: tip-bot for Oleg Nesterov Message-ID: Cc: srikar@linux.vnet.ibm.com, luto@amacapital.net, linux-kernel@vger.kernel.org, panand@redhat.com, hpa@zytor.com, peterz@infradead.org, torvalds@linux-foundation.org, tglx@linutronix.de, oleg@redhat.com, arapov@gmail.com, mingo@kernel.org Reply-To: oleg@redhat.com, torvalds@linux-foundation.org, peterz@infradead.org, tglx@linutronix.de, panand@redhat.com, linux-kernel@vger.kernel.org, hpa@zytor.com, luto@amacapital.net, srikar@linux.vnet.ibm.com, mingo@kernel.org, arapov@gmail.com In-Reply-To: <20150721134021.GA4773@redhat.com> References: <20150721134021.GA4773@redhat.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:perf/core] uprobes: Change handle_trampoline() to flush the frames invalidated by longjmp() Git-Commit-ID: 5eeb50de42fd3251845d03c556db012267c72b3f X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 5eeb50de42fd3251845d03c556db012267c72b3f Gitweb: http://git.kernel.org/tip/5eeb50de42fd3251845d03c556db012267c72b3f Author: Oleg Nesterov AuthorDate: Tue, 21 Jul 2015 15:40:21 +0200 Committer: Ingo Molnar CommitDate: Fri, 31 Jul 2015 10:38:05 +0200 uprobes: Change handle_trampoline() to flush the frames invalidated by longjmp() Test-case: #include #include jmp_buf jmp; void func_2(void) { longjmp(jmp, 1); } void func_1(void) { if (setjmp(jmp)) return; func_2(); printf("ERR!! I am running on the caller's stack\n"); } int main(void) { func_1(); return 0; } fails if you probe func_1() and func_2() because handle_trampoline() assumes that the probed function should must return and hit the bp installed be prepare_uretprobe(). But in this case func_2() does not return, so when func_1() returns the kernel uses the no longer valid return_instance of func_2(). Change handle_trampoline() to unwind ->return_instances until we know that the next chain is alive or NULL, this ensures that the current chain is the last we need to report and free. Alternatively, every return_instance could use unique trampoline_vaddr, in this case we could use it as a key. And this could solve the problem with sigaltstack() automatically. But this approach needs more changes, and it puts the "hard" limit on MAX_URETPROBE_DEPTH. Plus it can not solve another problem partially fixed by the next patch. Note: this change has no effect on !x86, the arch-agnostic version of arch_uretprobe_is_alive() just returns "true". TODO: as documented by the previous change, arch_uretprobe_is_alive() can be fooled by sigaltstack/etc. Tested-by: Pratyush Anand Signed-off-by: Oleg Nesterov Acked-by: Srikar Dronamraju Acked-by: Anton Arapov Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20150721134021.GA4773@redhat.com Signed-off-by: Ingo Molnar --- kernel/events/uprobes.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index c5f316e..93d939c8 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -1774,6 +1774,7 @@ static void handle_trampoline(struct pt_regs *regs) { struct uprobe_task *utask; struct return_instance *ri, *next; + bool valid; utask = current->utask; if (!utask) @@ -1783,18 +1784,24 @@ static void handle_trampoline(struct pt_regs *regs) if (!ri) goto sigill; - next = find_next_ret_chain(ri); - /* - * TODO: we should throw out return_instance's invalidated by - * longjmp(), currently we assume that the probed function always - * returns. - */ - instruction_pointer_set(regs, ri->orig_ret_vaddr); do { - handle_uretprobe_chain(ri, regs); - ri = free_ret_instance(ri); - utask->depth--; - } while (ri != next); + /* + * We should throw out the frames invalidated by longjmp(). + * If this chain is valid, then the next one should be alive + * or NULL; the latter case means that nobody but ri->func + * could hit this trampoline on return. TODO: sigaltstack(). + */ + next = find_next_ret_chain(ri); + valid = !next || arch_uretprobe_is_alive(next, regs); + + instruction_pointer_set(regs, ri->orig_ret_vaddr); + do { + if (valid) + handle_uretprobe_chain(ri, regs); + ri = free_ret_instance(ri); + utask->depth--; + } while (ri != next); + } while (!valid); utask->return_instances = ri; return;