* [PATCH] rcu: Avoid kernel stack overflow due to rcu_irq_enter_check_tick() being kprobe-ed
@ 2023-01-06 3:54 Zheng Yejian
2023-01-06 7:09 ` [PATCH v2] rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() " Zheng Yejian
0 siblings, 1 reply; 4+ messages in thread
From: Zheng Yejian @ 2023-01-06 3:54 UTC (permalink / raw)
To: frederic, paulmck
Cc: jiangshanlai, joel, josh, linux-kernel, mathieu.desnoyers,
mhiramat, quic_neeraju, rcu, rostedt, peterz, zhengyejian1
Register kprobe on __rcu_irq_enter_check_tick() can cause kernel stack
overflow [1]. This issue can be reproduced by enabling CONFIG_NO_HZ_FULL
and boot kernel with argument "nohz_full=" then execute like:
# cd /sys/kernel/tracing/
# echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events
# echo 1 > events/kprobes/enable
It seems __rcu_irq_enter_check_tick() should not be kprobe-ed, so add
it into kprobe blacklist with NOKPROBE_SYMBOL(). This may have less impact
than tagging as 'noinstr' which was discussed but not concluded in
Link: https://lore.kernel.org/all/20221119040049.795065-1-zhengyejian1@huawei.com/
[1]
Insufficient stack space to handle exception!
ESR: 0x00000000f2000004 -- BRK (AArch64)
FAR: 0x0000ffffccf3e510
Task stack: [0xffff80000ad30000..0xffff80000ad38000]
IRQ stack: [0xffff800008050000..0xffff800008058000]
Overflow stack: [0xffff089c36f9f310..0xffff089c36fa0310]
CPU: 5 PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19
Hardware name: linux,dummy-virt (DT)
pstate: 400003c5 (nZcv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __rcu_irq_enter_check_tick+0x0/0x1b8
lr : ct_nmi_enter+0x11c/0x138
sp : ffff80000ad30080
x29: ffff80000ad30080 x28: ffff089c82e20000 x27: 0000000000000000
x26: 0000000000000000 x25: ffff089c02a8d100 x24: 0000000000000000
x23: 00000000400003c5 x22: 0000ffffccf3e510 x21: ffff089c36fae148
x20: ffff80000ad30120 x19: ffffa8da8fcce148 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: ffffa8da8e44ea6c
x14: ffffa8da8e44e968 x13: ffffa8da8e03136c x12: 1fffe113804d6809
x11: ffff6113804d6809 x10: 0000000000000a60 x9 : dfff800000000000
x8 : ffff089c026b404f x7 : 00009eec7fb297f7 x6 : 0000000000000001
x5 : ffff80000ad30120 x4 : dfff800000000000 x3 : ffffa8da8e3016f4
x2 : 0000000000000003 x1 : 0000000000000000 x0 : 0000000000000000
Kernel panic - not syncing: kernel stack overflow
CPU: 5 PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0xf8/0x108
show_stack+0x20/0x30
dump_stack_lvl+0x68/0x84
dump_stack+0x1c/0x38
panic+0x214/0x404
add_taint+0x0/0xf8
panic_bad_stack+0x144/0x160
handle_bad_stack+0x38/0x58
__bad_stack+0x78/0x7c
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
[...]
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
el1_interrupt+0x28/0x60
el1h_64_irq_handler+0x18/0x28
el1h_64_irq+0x64/0x68
__ftrace_set_clr_event_nolock+0x98/0x198
__ftrace_set_clr_event+0x58/0x80
system_enable_write+0x144/0x178
vfs_write+0x174/0x738
ksys_write+0xd0/0x188
__arm64_sys_write+0x4c/0x60
invoke_syscall+0x64/0x180
el0_svc_common.constprop.0+0x84/0x160
do_el0_svc+0x48/0xe8
el0_svc+0x34/0xd0
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x190/0x194
SMP: stopping secondary CPUs
Kernel Offset: 0x28da86000000 from 0xffff800008000000
PHYS_OFFSET: 0xfffff76600000000
CPU features: 0x00000,01a00100,0000421b
Memory Limit: none
Cc: stable@vger.kernel.org
Fixes: aaf2bc50df1f ("rcu: Abstract out rcu_irq_enter_check_tick() from rcu_nmi_enter()")
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
---
kernel/rcu/tree.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index cf34a961821a..41606d3ed083 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -659,6 +659,7 @@ void __rcu_irq_enter_check_tick(void)
}
raw_spin_unlock_rcu_node(rdp->mynode);
}
+NOKPROBE_SYMBOL(__rcu_irq_enter_check_tick);
#endif /* CONFIG_NO_HZ_FULL */
/*
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v2] rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
2023-01-06 3:54 [PATCH] rcu: Avoid kernel stack overflow due to rcu_irq_enter_check_tick() being kprobe-ed Zheng Yejian
@ 2023-01-06 7:09 ` Zheng Yejian
2023-01-09 20:04 ` Paul E. McKenney
0 siblings, 1 reply; 4+ messages in thread
From: Zheng Yejian @ 2023-01-06 7:09 UTC (permalink / raw)
To: zhengyejian1
Cc: frederic, jiangshanlai, joel, josh, linux-kernel,
mathieu.desnoyers, mhiramat, paulmck, peterz, quic_neeraju, rcu,
rostedt
Register kprobe on __rcu_irq_enter_check_tick() can cause kernel stack
overflow [1]. This issue can be reproduced by enabling CONFIG_NO_HZ_FULL
and boot kernel with argument "nohz_full=" then execute like:
# cd /sys/kernel/tracing/
# echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events
# echo 1 > events/kprobes/enable
It seems __rcu_irq_enter_check_tick() should not be kprobe-ed, so add
it into kprobe blacklist with NOKPROBE_SYMBOL(). This may have less impact
than tagging as 'noinstr' which was discussed but not concluded in
Link: https://lore.kernel.org/all/20221119040049.795065-1-zhengyejian1@huawei.com/
[1]
Insufficient stack space to handle exception!
ESR: 0x00000000f2000004 -- BRK (AArch64)
FAR: 0x0000ffffccf3e510
Task stack: [0xffff80000ad30000..0xffff80000ad38000]
IRQ stack: [0xffff800008050000..0xffff800008058000]
Overflow stack: [0xffff089c36f9f310..0xffff089c36fa0310]
CPU: 5 PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19
Hardware name: linux,dummy-virt (DT)
pstate: 400003c5 (nZcv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __rcu_irq_enter_check_tick+0x0/0x1b8
lr : ct_nmi_enter+0x11c/0x138
sp : ffff80000ad30080
x29: ffff80000ad30080 x28: ffff089c82e20000 x27: 0000000000000000
x26: 0000000000000000 x25: ffff089c02a8d100 x24: 0000000000000000
x23: 00000000400003c5 x22: 0000ffffccf3e510 x21: ffff089c36fae148
x20: ffff80000ad30120 x19: ffffa8da8fcce148 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: ffffa8da8e44ea6c
x14: ffffa8da8e44e968 x13: ffffa8da8e03136c x12: 1fffe113804d6809
x11: ffff6113804d6809 x10: 0000000000000a60 x9 : dfff800000000000
x8 : ffff089c026b404f x7 : 00009eec7fb297f7 x6 : 0000000000000001
x5 : ffff80000ad30120 x4 : dfff800000000000 x3 : ffffa8da8e3016f4
x2 : 0000000000000003 x1 : 0000000000000000 x0 : 0000000000000000
Kernel panic - not syncing: kernel stack overflow
CPU: 5 PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0xf8/0x108
show_stack+0x20/0x30
dump_stack_lvl+0x68/0x84
dump_stack+0x1c/0x38
panic+0x214/0x404
add_taint+0x0/0xf8
panic_bad_stack+0x144/0x160
handle_bad_stack+0x38/0x58
__bad_stack+0x78/0x7c
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
[...]
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
el1_interrupt+0x28/0x60
el1h_64_irq_handler+0x18/0x28
el1h_64_irq+0x64/0x68
__ftrace_set_clr_event_nolock+0x98/0x198
__ftrace_set_clr_event+0x58/0x80
system_enable_write+0x144/0x178
vfs_write+0x174/0x738
ksys_write+0xd0/0x188
__arm64_sys_write+0x4c/0x60
invoke_syscall+0x64/0x180
el0_svc_common.constprop.0+0x84/0x160
do_el0_svc+0x48/0xe8
el0_svc+0x34/0xd0
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x190/0x194
SMP: stopping secondary CPUs
Kernel Offset: 0x28da86000000 from 0xffff800008000000
PHYS_OFFSET: 0xfffff76600000000
CPU features: 0x00000,01a00100,0000421b
Memory Limit: none
Cc: stable@vger.kernel.org
Fixes: aaf2bc50df1f ("rcu: Abstract out rcu_irq_enter_check_tick() from rcu_nmi_enter()")
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
---
kernel/rcu/tree.c | 1 +
1 file changed, 1 insertion(+)
Change since v1:
Make commit tile clear:
- rcu_irq_enter_check_tick() ==> __rcu_irq_enter_check_tick()
- kernel stack overflow ==> stack overflow
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index cf34a961821a..41606d3ed083 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -659,6 +659,7 @@ void __rcu_irq_enter_check_tick(void)
}
raw_spin_unlock_rcu_node(rdp->mynode);
}
+NOKPROBE_SYMBOL(__rcu_irq_enter_check_tick);
#endif /* CONFIG_NO_HZ_FULL */
/*
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
2023-01-06 7:09 ` [PATCH v2] rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() " Zheng Yejian
@ 2023-01-09 20:04 ` Paul E. McKenney
2023-01-10 0:55 ` Zheng Yejian
0 siblings, 1 reply; 4+ messages in thread
From: Paul E. McKenney @ 2023-01-09 20:04 UTC (permalink / raw)
To: Zheng Yejian
Cc: frederic, jiangshanlai, joel, josh, linux-kernel,
mathieu.desnoyers, mhiramat, peterz, quic_neeraju, rcu, rostedt
On Fri, Jan 06, 2023 at 03:09:34PM +0800, Zheng Yejian wrote:
> Register kprobe on __rcu_irq_enter_check_tick() can cause kernel stack
> overflow [1]. This issue can be reproduced by enabling CONFIG_NO_HZ_FULL
> and boot kernel with argument "nohz_full=" then execute like:
> # cd /sys/kernel/tracing/
> # echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events
> # echo 1 > events/kprobes/enable
>
> It seems __rcu_irq_enter_check_tick() should not be kprobe-ed, so add
> it into kprobe blacklist with NOKPROBE_SYMBOL(). This may have less impact
> than tagging as 'noinstr' which was discussed but not concluded in
> Link: https://lore.kernel.org/all/20221119040049.795065-1-zhengyejian1@huawei.com/
Queued for testing and further review, thank you!
Could you please check the wordsmithed version below?
Thanx, Paul
------------------------------------------------------------------------
commit 5ceaf736da841c4bdb03049c7d6e0c0c41253161
Author: Zheng Yejian <zhengyejian1@huawei.com>
Date: Fri Jan 6 15:09:34 2023 +0800
rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
Registering a kprobe on __rcu_irq_enter_check_tick() can cause kernel
stack overflow as shown below. This issue can be reproduced by enabling
CONFIG_NO_HZ_FULL and booting the kernel with argument "nohz_full=",
and then giving the following commands at the shell prompt:
# cd /sys/kernel/tracing/
# echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events
# echo 1 > events/kprobes/enable
This commit therefore adds __rcu_irq_enter_check_tick() to the kprobes
blacklist using NOKPROBE_SYMBOL().
Insufficient stack space to handle exception!
ESR: 0x00000000f2000004 -- BRK (AArch64)
FAR: 0x0000ffffccf3e510
Task stack: [0xffff80000ad30000..0xffff80000ad38000]
IRQ stack: [0xffff800008050000..0xffff800008058000]
Overflow stack: [0xffff089c36f9f310..0xffff089c36fa0310]
CPU: 5 PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19
Hardware name: linux,dummy-virt (DT)
pstate: 400003c5 (nZcv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __rcu_irq_enter_check_tick+0x0/0x1b8
lr : ct_nmi_enter+0x11c/0x138
sp : ffff80000ad30080
x29: ffff80000ad30080 x28: ffff089c82e20000 x27: 0000000000000000
x26: 0000000000000000 x25: ffff089c02a8d100 x24: 0000000000000000
x23: 00000000400003c5 x22: 0000ffffccf3e510 x21: ffff089c36fae148
x20: ffff80000ad30120 x19: ffffa8da8fcce148 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: ffffa8da8e44ea6c
x14: ffffa8da8e44e968 x13: ffffa8da8e03136c x12: 1fffe113804d6809
x11: ffff6113804d6809 x10: 0000000000000a60 x9 : dfff800000000000
x8 : ffff089c026b404f x7 : 00009eec7fb297f7 x6 : 0000000000000001
x5 : ffff80000ad30120 x4 : dfff800000000000 x3 : ffffa8da8e3016f4
x2 : 0000000000000003 x1 : 0000000000000000 x0 : 0000000000000000
Kernel panic - not syncing: kernel stack overflow
CPU: 5 PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0xf8/0x108
show_stack+0x20/0x30
dump_stack_lvl+0x68/0x84
dump_stack+0x1c/0x38
panic+0x214/0x404
add_taint+0x0/0xf8
panic_bad_stack+0x144/0x160
handle_bad_stack+0x38/0x58
__bad_stack+0x78/0x7c
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
[...]
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
arm64_enter_el1_dbg.isra.0+0x14/0x20
el1_dbg+0x2c/0x90
el1h_64_sync_handler+0xcc/0xe8
el1h_64_sync+0x64/0x68
__rcu_irq_enter_check_tick+0x0/0x1b8
el1_interrupt+0x28/0x60
el1h_64_irq_handler+0x18/0x28
el1h_64_irq+0x64/0x68
__ftrace_set_clr_event_nolock+0x98/0x198
__ftrace_set_clr_event+0x58/0x80
system_enable_write+0x144/0x178
vfs_write+0x174/0x738
ksys_write+0xd0/0x188
__arm64_sys_write+0x4c/0x60
invoke_syscall+0x64/0x180
el0_svc_common.constprop.0+0x84/0x160
do_el0_svc+0x48/0xe8
el0_svc+0x34/0xd0
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x190/0x194
SMP: stopping secondary CPUs
Kernel Offset: 0x28da86000000 from 0xffff800008000000
PHYS_OFFSET: 0xfffff76600000000
CPU features: 0x00000,01a00100,0000421b
Memory Limit: none
Link: https://lore.kernel.org/all/20221119040049.795065-1-zhengyejian1@huawei.com/
Fixes: aaf2bc50df1f ("rcu: Abstract out rcu_irq_enter_check_tick() from rcu_nmi_enter()")
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index a6181b76fd5ab..63545d79da51c 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -640,6 +640,7 @@ void __rcu_irq_enter_check_tick(void)
}
raw_spin_unlock_rcu_node(rdp->mynode);
}
+NOKPROBE_SYMBOL(__rcu_irq_enter_check_tick);
#endif /* CONFIG_NO_HZ_FULL */
/*
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
2023-01-09 20:04 ` Paul E. McKenney
@ 2023-01-10 0:55 ` Zheng Yejian
0 siblings, 0 replies; 4+ messages in thread
From: Zheng Yejian @ 2023-01-10 0:55 UTC (permalink / raw)
To: paulmck
Cc: frederic, jiangshanlai, joel, josh, linux-kernel,
mathieu.desnoyers, mhiramat, peterz, quic_neeraju, rcu, rostedt
On 2023/1/10 04:04, Paul E. McKenney wrote:
> On Fri, Jan 06, 2023 at 03:09:34PM +0800, Zheng Yejian wrote:
>> Register kprobe on __rcu_irq_enter_check_tick() can cause kernel stack
>> overflow [1]. This issue can be reproduced by enabling CONFIG_NO_HZ_FULL
>> and boot kernel with argument "nohz_full=" then execute like:
>> # cd /sys/kernel/tracing/
>> # echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events
>> # echo 1 > events/kprobes/enable
>>
>> It seems __rcu_irq_enter_check_tick() should not be kprobe-ed, so add
>> it into kprobe blacklist with NOKPROBE_SYMBOL(). This may have less impact
>> than tagging as 'noinstr' which was discussed but not concluded in
>> Link: https://lore.kernel.org/all/20221119040049.795065-1-zhengyejian1@huawei.com/
>
> Queued for testing and further review, thank you!
>
> Could you please check the wordsmithed version below?
It looks much better, thank you!
--
Best regards,
Zheng Yejian
>
> Thanx, Paul
>
> ------------------------------------------------------------------------
>
> commit 5ceaf736da841c4bdb03049c7d6e0c0c41253161
> Author: Zheng Yejian <zhengyejian1@huawei.com>
> Date: Fri Jan 6 15:09:34 2023 +0800
>
> rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
>
> Registering a kprobe on __rcu_irq_enter_check_tick() can cause kernel
> stack overflow as shown below. This issue can be reproduced by enabling
> CONFIG_NO_HZ_FULL and booting the kernel with argument "nohz_full=",
> and then giving the following commands at the shell prompt:
>
> # cd /sys/kernel/tracing/
> # echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events
> # echo 1 > events/kprobes/enable
>
> This commit therefore adds __rcu_irq_enter_check_tick() to the kprobes
> blacklist using NOKPROBE_SYMBOL().
>
> Insufficient stack space to handle exception!
> ESR: 0x00000000f2000004 -- BRK (AArch64)
> FAR: 0x0000ffffccf3e510
> Task stack: [0xffff80000ad30000..0xffff80000ad38000]
> IRQ stack: [0xffff800008050000..0xffff800008058000]
> Overflow stack: [0xffff089c36f9f310..0xffff089c36fa0310]
> CPU: 5 PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19
> Hardware name: linux,dummy-virt (DT)
> pstate: 400003c5 (nZcv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : __rcu_irq_enter_check_tick+0x0/0x1b8
> lr : ct_nmi_enter+0x11c/0x138
> sp : ffff80000ad30080
> x29: ffff80000ad30080 x28: ffff089c82e20000 x27: 0000000000000000
> x26: 0000000000000000 x25: ffff089c02a8d100 x24: 0000000000000000
> x23: 00000000400003c5 x22: 0000ffffccf3e510 x21: ffff089c36fae148
> x20: ffff80000ad30120 x19: ffffa8da8fcce148 x18: 0000000000000000
> x17: 0000000000000000 x16: 0000000000000000 x15: ffffa8da8e44ea6c
> x14: ffffa8da8e44e968 x13: ffffa8da8e03136c x12: 1fffe113804d6809
> x11: ffff6113804d6809 x10: 0000000000000a60 x9 : dfff800000000000
> x8 : ffff089c026b404f x7 : 00009eec7fb297f7 x6 : 0000000000000001
> x5 : ffff80000ad30120 x4 : dfff800000000000 x3 : ffffa8da8e3016f4
> x2 : 0000000000000003 x1 : 0000000000000000 x0 : 0000000000000000
> Kernel panic - not syncing: kernel stack overflow
> CPU: 5 PID: 190 Comm: bash Not tainted 6.2.0-rc2-00320-g1f5abbd77e2c #19
> Hardware name: linux,dummy-virt (DT)
> Call trace:
> dump_backtrace+0xf8/0x108
> show_stack+0x20/0x30
> dump_stack_lvl+0x68/0x84
> dump_stack+0x1c/0x38
> panic+0x214/0x404
> add_taint+0x0/0xf8
> panic_bad_stack+0x144/0x160
> handle_bad_stack+0x38/0x58
> __bad_stack+0x78/0x7c
> __rcu_irq_enter_check_tick+0x0/0x1b8
> arm64_enter_el1_dbg.isra.0+0x14/0x20
> el1_dbg+0x2c/0x90
> el1h_64_sync_handler+0xcc/0xe8
> el1h_64_sync+0x64/0x68
> __rcu_irq_enter_check_tick+0x0/0x1b8
> arm64_enter_el1_dbg.isra.0+0x14/0x20
> el1_dbg+0x2c/0x90
> el1h_64_sync_handler+0xcc/0xe8
> el1h_64_sync+0x64/0x68
> __rcu_irq_enter_check_tick+0x0/0x1b8
> arm64_enter_el1_dbg.isra.0+0x14/0x20
> el1_dbg+0x2c/0x90
> el1h_64_sync_handler+0xcc/0xe8
> el1h_64_sync+0x64/0x68
> __rcu_irq_enter_check_tick+0x0/0x1b8
> [...]
> el1_dbg+0x2c/0x90
> el1h_64_sync_handler+0xcc/0xe8
> el1h_64_sync+0x64/0x68
> __rcu_irq_enter_check_tick+0x0/0x1b8
> arm64_enter_el1_dbg.isra.0+0x14/0x20
> el1_dbg+0x2c/0x90
> el1h_64_sync_handler+0xcc/0xe8
> el1h_64_sync+0x64/0x68
> __rcu_irq_enter_check_tick+0x0/0x1b8
> arm64_enter_el1_dbg.isra.0+0x14/0x20
> el1_dbg+0x2c/0x90
> el1h_64_sync_handler+0xcc/0xe8
> el1h_64_sync+0x64/0x68
> __rcu_irq_enter_check_tick+0x0/0x1b8
> el1_interrupt+0x28/0x60
> el1h_64_irq_handler+0x18/0x28
> el1h_64_irq+0x64/0x68
> __ftrace_set_clr_event_nolock+0x98/0x198
> __ftrace_set_clr_event+0x58/0x80
> system_enable_write+0x144/0x178
> vfs_write+0x174/0x738
> ksys_write+0xd0/0x188
> __arm64_sys_write+0x4c/0x60
> invoke_syscall+0x64/0x180
> el0_svc_common.constprop.0+0x84/0x160
> do_el0_svc+0x48/0xe8
> el0_svc+0x34/0xd0
> el0t_64_sync_handler+0xb8/0xc0
> el0t_64_sync+0x190/0x194
> SMP: stopping secondary CPUs
> Kernel Offset: 0x28da86000000 from 0xffff800008000000
> PHYS_OFFSET: 0xfffff76600000000
> CPU features: 0x00000,01a00100,0000421b
> Memory Limit: none
>
> Link: https://lore.kernel.org/all/20221119040049.795065-1-zhengyejian1@huawei.com/
> Fixes: aaf2bc50df1f ("rcu: Abstract out rcu_irq_enter_check_tick() from rcu_nmi_enter()")
> Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
>
> diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
> index a6181b76fd5ab..63545d79da51c 100644
> --- a/kernel/rcu/tree.c
> +++ b/kernel/rcu/tree.c
> @@ -640,6 +640,7 @@ void __rcu_irq_enter_check_tick(void)
> }
> raw_spin_unlock_rcu_node(rdp->mynode);
> }
> +NOKPROBE_SYMBOL(__rcu_irq_enter_check_tick);
> #endif /* CONFIG_NO_HZ_FULL */
>
> /*
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-01-10 0:55 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-06 3:54 [PATCH] rcu: Avoid kernel stack overflow due to rcu_irq_enter_check_tick() being kprobe-ed Zheng Yejian
2023-01-06 7:09 ` [PATCH v2] rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() " Zheng Yejian
2023-01-09 20:04 ` Paul E. McKenney
2023-01-10 0:55 ` Zheng Yejian
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.