lkml.org 
[lkml]   [2018]   [Jan]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: kprobes: propagate error from arm_kprobe_ftrace()
+++ Steven Rostedt [03/01/18 09:33 -0500]:
>On Wed, 3 Jan 2018 02:40:47 +0100
>Jessica Yu <jeyu@kernel.org> wrote:
>
>> Improve error handling when arming ftrace-based kprobes. Specifically, if
>> we fail to arm a ftrace-based kprobe, register_kprobe()/enable_kprobe()
>> should report an error instead of success. Previously, this has lead to
>> confusing situations where register_kprobe() would return 0 indicating
>> success, but the kprobe would not be functional if ftrace registration
>> during the kprobe arming process had failed. We should therefore take any
>> errors returned by ftrace into account and propagate this error so that we
>> do not register/enable kprobes that cannot be armed. This can happen if,
>> for example, register_ftrace_function() finds an IPMODIFY conflict (since
>> kprobe_ftrace_ops has this flag set) and returns an error. Such a conflict
>> is possible since livepatches also set the IPMODIFY flag for their ftrace_ops.
>>
>> arm_all_kprobes() keeps its current behavior and attempts to arm all
>> kprobes. It returns the last encountered error and gives a warning if
>> not all probes could be armed.
>>
>> This patch is based on Petr Mladek's original patchset (patches 2 and 3)
>> back in 2015, which improved kprobes error handling, found here:
>>
>> https://lkml.org/lkml/2015/2/26/452
>>
>> However, further work on this had been paused since then and the patches
>> were not upstreamed.
>>
>> Based-on-patches-by: Petr Mladek <pmladek@suse.com>
>> Signed-off-by: Jessica Yu <jeyu@kernel.org>
>> ---
>> kernel/kprobes.c | 94 +++++++++++++++++++++++++++++++++++++++++---------------
>> 1 file changed, 69 insertions(+), 25 deletions(-)
>>
>> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
>> index b4aab48ad258..ae6b6fe79de3 100644
>> --- a/kernel/kprobes.c
>> +++ b/kernel/kprobes.c
>> @@ -988,18 +988,32 @@ static int prepare_kprobe(struct kprobe *p)
>> }
>>
>> /* Caller must lock kprobe_mutex */
>> -static void arm_kprobe_ftrace(struct kprobe *p)
>> +static int arm_kprobe_ftrace(struct kprobe *p)
>> {
>> - int ret;
>> + int ret = 0;
>>
>> ret = ftrace_set_filter_ip(&kprobe_ftrace_ops,
>> (unsigned long)p->addr, 0, 0);
>> - WARN(ret < 0, "Failed to arm kprobe-ftrace at %p (%d)\n", p->addr, ret);
>> - kprobe_ftrace_enabled++;
>> - if (kprobe_ftrace_enabled == 1) {
>> + if (WARN(ret < 0, "Failed to arm kprobe-ftrace at %p (%d)\n", p->addr, ret))
>> + return ret;
>
>I wonder if we should change this from a WARN to a printk(). No reason
>to do stack dumps here.

Yeah, I was trying to preserve the current behavior. I'll leave it up
to Masami.

>> +
>> + if (kprobe_ftrace_enabled == 0) {
>> ret = register_ftrace_function(&kprobe_ftrace_ops);
>> - WARN(ret < 0, "Failed to init kprobe-ftrace (%d)\n", ret);
>> + if (WARN(ret < 0, "Failed to init kprobe-ftrace (%d)\n", ret))
>> + goto err_ftrace;
>> }
>> +
>> + kprobe_ftrace_enabled++;
>> + return ret;
>> +
>> +err_ftrace:
>> + /*
>> + * Note: Since kprobe_ftrace_ops has IPMODIFY set, and ftrace requires a
>> + * non-empty filter_hash for IPMODIFY ops, we're safe from an accidental
>> + * empty filter_hash which would undesirably trace all functions.
>> + */
>> + ftrace_set_filter_ip(&kprobe_ftrace_ops, (unsigned long)p->addr, 1, 0);
>> + return ret;
>> }
>>
>> /* Caller must lock kprobe_mutex */
>> @@ -1018,22 +1032,23 @@ static void disarm_kprobe_ftrace(struct kprobe *p)
>> }
>> #else /* !CONFIG_KPROBES_ON_FTRACE */
>> #define prepare_kprobe(p) arch_prepare_kprobe(p)
>> -#define arm_kprobe_ftrace(p) do {} while (0)
>> +#define arm_kprobe_ftrace(p) (0)
>
>Hmm. Perhaps we should have arm_kprobe_ftrace() return a failure.
>
>> #define disarm_kprobe_ftrace(p) do {} while (0)
>> #endif
>>
>> /* Arm a kprobe with text_mutex */
>> -static void arm_kprobe(struct kprobe *kp)
>> +static int arm_kprobe(struct kprobe *kp)
>> {
>> - if (unlikely(kprobe_ftrace(kp))) {
>> - arm_kprobe_ftrace(kp);
>> - return;
>> - }
>> + if (unlikely(kprobe_ftrace(kp)))
>> + return arm_kprobe_ftrace(kp);
>
>If CONFIG_KPROBES_ON_FTRACE is not defined, this if should always be
>false. But if for some reason in the future, it is not false, we just
>had arm_kprobe_ftrace() return success when it really is a failure.
>
> -ENODEV?

Good point, I will include this change in v4, unless there are
objections.

>> +
>> cpus_read_lock();
>> mutex_lock(&text_mutex);
>> __arm_kprobe(kp);
>> mutex_unlock(&text_mutex);
>> cpus_read_unlock();
>> +
>> + return 0;
>> }
>>
>> /* Disarm a kprobe with text_mutex */
>> @@ -1372,9 +1387,15 @@ static int register_aggr_kprobe(struct kprobe *orig_p, struct kprobe *p)
>>
>> if (ret == 0 && kprobe_disabled(ap) && !kprobe_disabled(p)) {
>> ap->flags &= ~KPROBE_FLAG_DISABLED;
>> - if (!kprobes_all_disarmed)
>> + if (!kprobes_all_disarmed) {
>> /* Arm the breakpoint again. */
>> - arm_kprobe(ap);
>> + ret = arm_kprobe(ap);
>> + if (ret) {
>> + ap->flags |= KPROBE_FLAG_DISABLED;
>> + list_del_rcu(&p->list);
>
>Don't we need to hold the mutex to modify the list?

It is unfortunately unclear from this snippet, but we do hold the
kprobe_mutex here. It's held for most of the duration of
register_kprobe(), where register_aggr_kprobe() is called.

>> + synchronize_sched();
>> + }
>> + }
>> }
>> return ret;
>> }
>> @@ -1594,8 +1615,14 @@ int register_kprobe(struct kprobe *p)
>> hlist_add_head_rcu(&p->hlist,
>> &kprobe_table[hash_ptr(p->addr, KPROBE_HASH_BITS)]);
>>
>> - if (!kprobes_all_disarmed && !kprobe_disabled(p))
>> - arm_kprobe(p);
>> + if (!kprobes_all_disarmed && !kprobe_disabled(p)) {
>> + ret = arm_kprobe(p);
>> + if (ret) {
>> + hlist_del_rcu(&p->hlist);
>
>Same here.

We do hold kprobe_mutex here as well (see above comment).

>> + synchronize_sched();
>> + goto out;
>> + }
>> + }
>>
>> /* Try to optimize kprobe */
>> try_to_optimize_kprobe(p);
>> @@ -2137,7 +2164,9 @@ int enable_kprobe(struct kprobe *kp)
>>
>> if (!kprobes_all_disarmed && kprobe_disabled(p)) {
>> p->flags &= ~KPROBE_FLAG_DISABLED;
>> - arm_kprobe(p);
>> + ret = arm_kprobe(p);
>> + if (ret)
>> + p->flags |= KPROBE_FLAG_DISABLED;
>> }
>> out:
>> mutex_unlock(&kprobe_mutex);
>> @@ -2565,11 +2594,12 @@ static const struct file_operations debugfs_kprobe_ei_ops = {
>> .release = seq_release,
>> };
>>
>> -static void arm_all_kprobes(void)
>> +static int arm_all_kprobes(void)
>> {
>> struct hlist_head *head;
>> struct kprobe *p;
>> - unsigned int i;
>> + unsigned int i, errors = 0;
>> + int err, ret = 0;
>>
>> mutex_lock(&kprobe_mutex);
>>
>> @@ -2586,16 +2616,26 @@ static void arm_all_kprobes(void)
>> /* Arming kprobes doesn't optimize kprobe itself */
>> for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
>> head = &kprobe_table[i];
>> - hlist_for_each_entry_rcu(p, head, hlist)
>> - if (!kprobe_disabled(p))
>> - arm_kprobe(p);
>> + /* Arm all kprobes on a best-effort basis */
>> + hlist_for_each_entry_rcu(p, head, hlist) {
>> + if (!kprobe_disabled(p)) {
>> + err = arm_kprobe(p);
>> + if (err) {
>> + errors++;
>> + ret = err;
>> + }
>> + }
>> + }
>> }
>>
>> - printk(KERN_INFO "Kprobes globally enabled\n");
>> + if (errors)
>> + pr_warn("Kprobes globally enabled, but failed to arm %d probes\n", errors);
>
>Perhaps we should have a count of all kprobes that were tried, and
>write something like:
>
> "Kprobes globally enabled, but failed to arm %d out of %d probes\n",
> errors, total

Sure, ok.

Thank you for the review!

Jessica

\
 
 \ /
  Last update: 2018-01-03 22:00    [W:0.061 / U:2.276 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site