From: Peter Zijlstra <peterz@infradead.org>
To: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Ingo Molnar <mingo@kernel.org>,
Steven Rostedt <rostedt@goodmis.org>,
x86@kernel.org, linux-kernel@vger.kernel.org, bristot@redhat.com,
jbaron@akamai.com, torvalds@linux-foundation.org,
tglx@linutronix.de, namit@vmware.com, hpa@zytor.com,
luto@kernel.org, ard.biesheuvel@linaro.org, jpoimboe@redhat.com,
jeyu@kernel.org, alexei.starovoitov@gmail.com
Subject: Re: [PATCH -tip 1/2] x86/alternative: Sync bp_patching update for avoiding NULL pointer exception
Date: Mon, 2 Dec 2019 10:15:19 +0100 [thread overview]
Message-ID: <20191202091519.GA2827@hirez.programming.kicks-ass.net> (raw)
In-Reply-To: <157483421229.25881.15314414408559963162.stgit@devnote2>
On Wed, Nov 27, 2019 at 02:56:52PM +0900, Masami Hiramatsu wrote:
> ftracetest multiple_kprobes.tc testcase hit a following NULL pointer
> exception.
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 800000007bf60067 P4D 800000007bf60067 PUD 7bf5f067 PMD 0
> Oops: 0000 [#1] PREEMPT SMP PTI
> CPU: 6 PID: 0 Comm: swapper/6 Not tainted 5.4.0-rc8+ #23
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
> RIP: 0010:poke_int3_handler+0x39/0x100
> Code: 5b 5d c3 f6 87 88 00 00 00 03 75 f2 48 8b 87 80 00 00 00 48 89 fb 48 8d 68 ff 48 8b 05 80 98 72 01 83 fa 01 0f 8f 93 00 00 00 <48> 63 10 48 81 c2 00 00 00 81 48 39 d5 75 c5 0f b6 50 08 8d 4a 34
> RSP: 0018:ffffc900001a8eb8 EFLAGS: 00010046
> RAX: 0000000000000000 RBX: ffffc900001a8ee8 RCX: ffffffff81a00b57
> RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffffc900001a8ee8
> RBP: ffffffff81027635 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> FS: 0000000000000000(0000) GS:ffff88807d980000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000000 CR3: 000000007a970000 CR4: 00000000000006a0
> Call Trace:
> <IRQ>
> do_int3+0xd/0xf0
> int3+0x42/0x50
> RIP: 0010:sched_clock+0x6/0x10
>
> eu-addr2line told that poke_int3_handler+0x39 was alternatives:958.
>
> static inline void *text_poke_addr(struct text_poke_loc *tp)
> {
> return _stext + tp->rel_addr; <------ Here is line #958
> }
>
> This seems like caused by the tp (bp_patching.vec) was NULL but
> bp_patching.nr_entries != 0. There is a small chance to do
> this, because we have no sync after zeroing bp_patching.nr_entries
> before clearing bp_patching.vec.
>
> Steve suggested we could fix this by adding sync_core, because int3
> is done with interrupts disabled, and the on_each_cpu() requires
> all CPUs to have had their interrupts enabled.
>
> Fixes: c0213b0ac03c ("x86/alternative: Batch of patch operations")
> Suggested-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
> Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
> ---
> arch/x86/kernel/alternative.c | 8 +++++++-
> 1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
> index 4552795a8df4..9505096e2cd1 100644
> --- a/arch/x86/kernel/alternative.c
> +++ b/arch/x86/kernel/alternative.c
> @@ -1134,8 +1134,14 @@ static void text_poke_bp_batch(struct text_poke_loc *tp, unsigned int nr_entries
> * sync_core() implies an smp_mb() and orders this store against
> * the writing of the new instruction.
> */
> - bp_patching.vec = NULL;
> bp_patching.nr_entries = 0;
> + /*
> + * This sync_core () ensures that all int3 handlers in progress
> + * have finished. This allows poke_int3_handler () after this to
> + * avoid touching bp_paching.vec by checking nr_entries == 0.
> + */
> + text_poke_sync();
> + bp_patching.vec = NULL;
> }
Hurm.. is there no way we can merge that with the 'last'
text_poke_sync() ? It seems a little daft to do 2 back-to-back IPI
things like that.
next prev parent reply other threads:[~2019-12-02 9:15 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-27 5:56 [PATCH -tip 0/2] x86/kprobes: Fix 2 issues related to text_poke_bp and optprobe Masami Hiramatsu
2019-11-27 5:56 ` [PATCH -tip 1/2] x86/alternative: Sync bp_patching update for avoiding NULL pointer exception Masami Hiramatsu
2019-12-02 9:15 ` Peter Zijlstra [this message]
2019-12-02 11:50 ` Masami Hiramatsu
2019-12-02 13:43 ` Peter Zijlstra
2019-12-02 14:39 ` Masami Hiramatsu
2019-12-04 8:33 ` [tip: core/kprobes] x86/alternatives: " tip-bot2 for Masami Hiramatsu
2019-12-09 14:39 ` [PATCH -tip 1/2] x86/alternative: " Peter Zijlstra
2019-12-10 16:44 ` Masami Hiramatsu
2019-12-10 17:32 ` Peter Zijlstra
2019-12-11 0:09 ` Peter Zijlstra
2019-12-11 8:09 ` Masami Hiramatsu
2019-12-11 9:12 ` Daniel Bristot de Oliveira
2019-11-27 5:57 ` [PATCH -tip 2/2] kprobes: Set unoptimized flag after unoptimizing code Masami Hiramatsu
2019-11-27 6:19 ` Alexei Starovoitov
2019-11-27 6:49 ` Ingo Molnar
2019-12-02 21:55 ` Alexei Starovoitov
2019-11-27 6:56 ` Masami Hiramatsu
2019-12-04 8:33 ` [tip: core/kprobes] " tip-bot2 for Masami Hiramatsu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191202091519.GA2827@hirez.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=alexei.starovoitov@gmail.com \
--cc=ard.biesheuvel@linaro.org \
--cc=bristot@redhat.com \
--cc=hpa@zytor.com \
--cc=jbaron@akamai.com \
--cc=jeyu@kernel.org \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mhiramat@kernel.org \
--cc=mingo@kernel.org \
--cc=namit@vmware.com \
--cc=rostedt@goodmis.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).