[PATCH] kprobes: fix race in recovery of reentrant probe

There is a window where a probe gets removed right after the probe is hit
on some different cpu.  In this case probe handlers can't find a matching
probe instance related to break address.  In this case we need to read the
original instruction at break address to see if that is not a break/int3
instruction and recover safely.

Previous code had a bug where we were not checking for the above race in
case of reentrant probes and the below patch fixes this race.

Tested on IA64, Powerpc, x86_64.

Signed-off-by: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/arch/i386/kernel/kprobes.c b/arch/i386/kernel/kprobes.c
index 2f372dbd34fd54a80c77b6a6380fc5794b3ba781..6483eeb1a4e809f3fef395af0dd151528520c9a4 100644 (file)
--- a/arch/i386/kernel/kprobes.c
+++ b/arch/i386/kernel/kprobes.c
@@ -188,6 +188,19 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
                        kcb->kprobe_status = KPROBE_REENTER;
                        return 1;
                } else {
+                       if (regs->eflags & VM_MASK) {
+                       /* We are in virtual-8086 mode. Return 0 */
+                               goto no_kprobe;
+                       }
+                       if (*addr != BREAKPOINT_INSTRUCTION) {
+                       /* The breakpoint instruction was removed by
+                        * another cpu right after we hit, no further
+                        * handling of this interrupt is appropriate
+                        */
+                               regs->eip -= sizeof(kprobe_opcode_t);
+                               ret = 1;
+                               goto no_kprobe;
+                       }
                        p = __get_cpu_var(current_kprobe);
                        if (p->break_handler && p->break_handler(p, regs)) {
                                goto ss_probe;

diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c
index 4de7f6759093720595fe958f0b757d5adb884cd5..346fedf9ea479a361ea7cdca2173b442b2302adb 100644 (file)
--- a/arch/ia64/kernel/kprobes.c
+++ b/arch/ia64/kernel/kprobes.c
@@ -638,6 +638,13 @@ static int __kprobes pre_kprobes_handler(struct die_args *args)
                        if (p->break_handler && p->break_handler(p, regs)) {
                                goto ss_probe;
                        }
+               } else if (!is_ia64_break_inst(regs)) {
+                       /* The breakpoint instruction was removed by
+                        * another cpu right after we hit, no further
+                        * handling of this interrupt is appropriate
+                        */
+                       ret = 1;
+                       goto no_kprobe;
                } else {
                        /* Not our break */
                        goto no_kprobe;

diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 27b0c40601fb5d6db8a13b9915ad2d626152173f..cfab48566db1306c3e8f47b5034ca703a67f471b 100644 (file)
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -179,6 +179,18 @@ static inline int kprobe_handler(struct pt_regs *regs)
                        kcb->kprobe_status = KPROBE_REENTER;
                        return 1;
                } else {
+                       if (*addr != BREAKPOINT_INSTRUCTION) {
+                               /* If trap variant, then it belongs not to us */
+                               kprobe_opcode_t cur_insn = *addr;
+                               if (is_trap(cur_insn))
+                                       goto no_kprobe;
+                               /* The breakpoint instruction was removed by
+                                * another cpu right after we hit, no further
+                                * handling of this interrupt is appropriate
+                                */
+                               ret = 1;
+                               goto no_kprobe;
+                       }
                        p = __get_cpu_var(current_kprobe);
                        if (p->break_handler && p->break_handler(p, regs)) {
                                goto ss_probe;

diff --git a/arch/sparc64/kernel/kprobes.c b/arch/sparc64/kernel/kprobes.c
index ff5e9d5cad50ed7f2507f3c9a1935e518d34d937..b9a9ce70e55c1f281ff4759b47abc6d03e10ae49 100644 (file)
--- a/arch/sparc64/kernel/kprobes.c
+++ b/arch/sparc64/kernel/kprobes.c
@@ -135,6 +135,14 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
                        prepare_singlestep(p, regs, kcb);
                        return 1;
                } else {
+                       if (*(u32 *)addr != BREAKPOINT_INSTRUCTION) {
+                       /* The breakpoint instruction was removed by
+                        * another cpu right after we hit, no further
+                        * handling of this interrupt is appropriate
+                        */
+                               ret = 1;
+                               goto no_kprobe;
+                       }
                        p = __get_cpu_var(current_kprobe);
                        if (p->break_handler && p->break_handler(p, regs))
                                goto ss_probe;

diff --git a/arch/x86_64/kernel/kprobes.c b/arch/x86_64/kernel/kprobes.c
index b7dc1f816d13e616dacced97857994f42000ee47..8b866a8572cfab92546ff539b185799d695c07dc 100644 (file)
--- a/arch/x86_64/kernel/kprobes.c
+++ b/arch/x86_64/kernel/kprobes.c
@@ -334,6 +334,15 @@ int __kprobes kprobe_handler(struct pt_regs *regs)
                                return 1;
                        }
                } else {
+                       if (*addr != BREAKPOINT_INSTRUCTION) {
+                       /* The breakpoint instruction was removed by
+                        * another cpu right after we hit, no further
+                        * handling of this interrupt is appropriate
+                        */
+                               regs->rip = (unsigned long)addr;
+                               ret = 1;
+                               goto no_kprobe;
+                       }
                        p = __get_cpu_var(current_kprobe);
                        if (p->break_handler && p->break_handler(p, regs)) {
                                goto ss_probe;