| Message ID | 149076498222.24574.679546540523044200.stgit@devbox |
|---|---|
| State | Not Applicable, archived |
| Delegated to: | David Miller |
| Headers | show |
* Masami Hiramatsu <mhiramat@kernel.org> wrote: > @@ -1824,6 +1823,30 @@ void unregister_jprobes(struct jprobe **jps, int num) > EXPORT_SYMBOL_GPL(unregister_jprobes); > > #ifdef CONFIG_KRETPROBES > + > +/* Try to use free instance first, if failed, try to allocate new instance */ > +struct kretprobe_instance *kretprobe_alloc_instance(struct kretprobe *rp) > +{ > + struct kretprobe_instance *ri = NULL; > + unsigned long flags = 0; > + > + raw_spin_lock_irqsave(&rp->lock, flags); > + if (!hlist_empty(&rp->free_instances)) { > + ri = hlist_entry(rp->free_instances.first, > + struct kretprobe_instance, hlist); > + hlist_del(&ri->hlist); > + } > + raw_spin_unlock_irqrestore(&rp->lock, flags); > + > + /* Populate max active instance if possible */ > + if (!ri && rp->maxactive < KRETPROBE_MAXACTIVE_ALLOC) { > + ri = kmalloc(sizeof(*ri) + rp->data_size, GFP_ATOMIC); > + if (ri) > + rp->maxactive++; > + } > + > + return ri; > +} > /* > * This kprobe pre_handler is registered with every kretprobe. When probe > * hits it will set up the return probe. > @@ -1846,14 +1869,8 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs) > } > > /* TODO: consider to only swap the RA after the last pre_handler fired */ > - hash = hash_ptr(current, KPROBE_HASH_BITS); > - raw_spin_lock_irqsave(&rp->lock, flags); > - if (!hlist_empty(&rp->free_instances)) { > - ri = hlist_entry(rp->free_instances.first, > - struct kretprobe_instance, hlist); > - hlist_del(&ri->hlist); > - raw_spin_unlock_irqrestore(&rp->lock, flags); > - > + ri = kretprobe_alloc_instance(rp); > + if (ri) { > ri->rp = rp; > ri->task = current; > > @@ -1868,13 +1885,13 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs) > > /* XXX(hch): why is there no hlist_move_head? */ > INIT_HLIST_NODE(&ri->hlist); > + hash = hash_ptr(current, KPROBE_HASH_BITS); > kretprobe_table_lock(hash, &flags); > hlist_add_head(&ri->hlist, &kretprobe_inst_table[hash]); > kretprobe_table_unlock(hash, &flags); > - } else { > + } else > rp->nmissed++; > - raw_spin_unlock_irqrestore(&rp->lock, flags); > - } > + > return 0; > } > NOKPROBE_SYMBOL(pre_handler_kretprobe); So this is something I missed while the original code was merged, but the concept looks a bit weird: why do we do any "allocation" while a handler is executing? That's fundamentally fragile. What's the maximum number of parallel 'kretprobe_instance' required per kretprobe - one per CPU? If so then we should preallocate all of them when they are installed and not do any alloc/free dance when executing them. This will also speed them up, and increase robustness all around. Thanks, Ingo
On Wed, 29 Mar 2017 08:30:05 +0200 Ingo Molnar <mingo@kernel.org> wrote: > > * Masami Hiramatsu <mhiramat@kernel.org> wrote: > > > @@ -1824,6 +1823,30 @@ void unregister_jprobes(struct jprobe **jps, int num) > > EXPORT_SYMBOL_GPL(unregister_jprobes); > > > > #ifdef CONFIG_KRETPROBES > > + > > +/* Try to use free instance first, if failed, try to allocate new instance */ > > +struct kretprobe_instance *kretprobe_alloc_instance(struct kretprobe *rp) > > +{ > > + struct kretprobe_instance *ri = NULL; > > + unsigned long flags = 0; > > + > > + raw_spin_lock_irqsave(&rp->lock, flags); > > + if (!hlist_empty(&rp->free_instances)) { > > + ri = hlist_entry(rp->free_instances.first, > > + struct kretprobe_instance, hlist); > > + hlist_del(&ri->hlist); > > + } > > + raw_spin_unlock_irqrestore(&rp->lock, flags); > > + > > + /* Populate max active instance if possible */ > > + if (!ri && rp->maxactive < KRETPROBE_MAXACTIVE_ALLOC) { > > + ri = kmalloc(sizeof(*ri) + rp->data_size, GFP_ATOMIC); > > + if (ri) > > + rp->maxactive++; > > + } > > + > > + return ri; > > +} > > /* > > * This kprobe pre_handler is registered with every kretprobe. When probe > > * hits it will set up the return probe. > > @@ -1846,14 +1869,8 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs) > > } > > > > /* TODO: consider to only swap the RA after the last pre_handler fired */ > > - hash = hash_ptr(current, KPROBE_HASH_BITS); > > - raw_spin_lock_irqsave(&rp->lock, flags); > > - if (!hlist_empty(&rp->free_instances)) { > > - ri = hlist_entry(rp->free_instances.first, > > - struct kretprobe_instance, hlist); > > - hlist_del(&ri->hlist); > > - raw_spin_unlock_irqrestore(&rp->lock, flags); > > - > > + ri = kretprobe_alloc_instance(rp); > > + if (ri) { > > ri->rp = rp; > > ri->task = current; > > > > @@ -1868,13 +1885,13 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs) > > > > /* XXX(hch): why is there no hlist_move_head? */ > > INIT_HLIST_NODE(&ri->hlist); > > + hash = hash_ptr(current, KPROBE_HASH_BITS); > > kretprobe_table_lock(hash, &flags); > > hlist_add_head(&ri->hlist, &kretprobe_inst_table[hash]); > > kretprobe_table_unlock(hash, &flags); > > - } else { > > + } else > > rp->nmissed++; > > - raw_spin_unlock_irqrestore(&rp->lock, flags); > > - } > > + > > return 0; > > } > > NOKPROBE_SYMBOL(pre_handler_kretprobe); > > So this is something I missed while the original code was merged, but the concept > looks a bit weird: why do we do any "allocation" while a handler is executing? > > That's fundamentally fragile. What's the maximum number of parallel > 'kretprobe_instance' required per kretprobe - one per CPU? It depends on the place where we put the probe. If the probed function will be blocked (yield to other tasks), then we need a same number of threads on the system which can invoke the function. So, ultimately, it is same as function_graph tracer, we need it for each thread. > > If so then we should preallocate all of them when they are installed and not do > any alloc/free dance when executing them. > > This will also speed them up, and increase robustness all around. I see, kretprobe already do that, and I keep it on the code. By default, kretprobe will allocate NR_CPU of kretprobe_instance for each kretprobe. For usual usecase (deeper inside functions in kernel) that is OK. However, as Lukasz reported, for the function near the syscall entry, it may require more instances. In that case, kretprobe user needs to increase maxactive before registering kretprobes, which will be done by Alban's patch. However, the next question is, how many instances are actually needed. User may have to do trial & error loop to find that. For professional users, they will do that, but for the light users, they may not want to do that. I'm also considering to provide a "knob" of disabing this dynamic allocation feature on debugfs, which will help users who would like to avoid memory allocation on kretprobe. Thank you,
On 03/29/2017 01:25 AM, Masami Hiramatsu wrote: > On Wed, 29 Mar 2017 08:30:05 +0200 > Ingo Molnar <mingo@kernel.org> wrote: >> >> * Masami Hiramatsu <mhiramat@kernel.org> wrote: >> >>> @@ -1824,6 +1823,30 @@ void unregister_jprobes(struct jprobe **jps, int num) >>> EXPORT_SYMBOL_GPL(unregister_jprobes); >>> >>> #ifdef CONFIG_KRETPROBES >>> + >>> +/* Try to use free instance first, if failed, try to allocate new instance */ >>> +struct kretprobe_instance *kretprobe_alloc_instance(struct kretprobe *rp) >>> +{ >>> + struct kretprobe_instance *ri = NULL; >>> + unsigned long flags = 0; >>> + >>> + raw_spin_lock_irqsave(&rp->lock, flags); >>> + if (!hlist_empty(&rp->free_instances)) { >>> + ri = hlist_entry(rp->free_instances.first, >>> + struct kretprobe_instance, hlist); >>> + hlist_del(&ri->hlist); >>> + } >>> + raw_spin_unlock_irqrestore(&rp->lock, flags); >>> + >>> + /* Populate max active instance if possible */ >>> + if (!ri && rp->maxactive < KRETPROBE_MAXACTIVE_ALLOC) { >>> + ri = kmalloc(sizeof(*ri) + rp->data_size, GFP_ATOMIC); >>> + if (ri) >>> + rp->maxactive++; >>> + } >>> + >>> + return ri; >>> +} >>> /* >>> * This kprobe pre_handler is registered with every kretprobe. When probe >>> * hits it will set up the return probe. >>> @@ -1846,14 +1869,8 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs) >>> } >>> >>> /* TODO: consider to only swap the RA after the last pre_handler fired */ >>> - hash = hash_ptr(current, KPROBE_HASH_BITS); >>> - raw_spin_lock_irqsave(&rp->lock, flags); >>> - if (!hlist_empty(&rp->free_instances)) { >>> - ri = hlist_entry(rp->free_instances.first, >>> - struct kretprobe_instance, hlist); >>> - hlist_del(&ri->hlist); >>> - raw_spin_unlock_irqrestore(&rp->lock, flags); >>> - >>> + ri = kretprobe_alloc_instance(rp); >>> + if (ri) { >>> ri->rp = rp; >>> ri->task = current; >>> >>> @@ -1868,13 +1885,13 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs) >>> >>> /* XXX(hch): why is there no hlist_move_head? */ >>> INIT_HLIST_NODE(&ri->hlist); >>> + hash = hash_ptr(current, KPROBE_HASH_BITS); >>> kretprobe_table_lock(hash, &flags); >>> hlist_add_head(&ri->hlist, &kretprobe_inst_table[hash]); >>> kretprobe_table_unlock(hash, &flags); >>> - } else { >>> + } else >>> rp->nmissed++; >>> - raw_spin_unlock_irqrestore(&rp->lock, flags); >>> - } >>> + >>> return 0; >>> } >>> NOKPROBE_SYMBOL(pre_handler_kretprobe); >> >> So this is something I missed while the original code was merged, but the concept >> looks a bit weird: why do we do any "allocation" while a handler is executing? >> >> That's fundamentally fragile. What's the maximum number of parallel >> 'kretprobe_instance' required per kretprobe - one per CPU? > > It depends on the place where we put the probe. If the probed function will be > blocked (yield to other tasks), then we need a same number of threads on > the system which can invoke the function. So, ultimately, it is same > as function_graph tracer, we need it for each thread. Isn't it also possible that the function may be reentrant? Whether by plain recursion or an interrupt call, this leads to multiple live instances even for a given thread.
On Wed, 29 Mar 2017 10:18:48 -0700 Josh Stone <jistone@redhat.com> wrote: > On 03/29/2017 01:25 AM, Masami Hiramatsu wrote: > > On Wed, 29 Mar 2017 08:30:05 +0200 > > Ingo Molnar <mingo@kernel.org> wrote: > >> > >> * Masami Hiramatsu <mhiramat@kernel.org> wrote: > >> > >>> @@ -1824,6 +1823,30 @@ void unregister_jprobes(struct jprobe **jps, int num) > >>> EXPORT_SYMBOL_GPL(unregister_jprobes); > >>> > >>> #ifdef CONFIG_KRETPROBES > >>> + > >>> +/* Try to use free instance first, if failed, try to allocate new instance */ > >>> +struct kretprobe_instance *kretprobe_alloc_instance(struct kretprobe *rp) > >>> +{ > >>> + struct kretprobe_instance *ri = NULL; > >>> + unsigned long flags = 0; > >>> + > >>> + raw_spin_lock_irqsave(&rp->lock, flags); > >>> + if (!hlist_empty(&rp->free_instances)) { > >>> + ri = hlist_entry(rp->free_instances.first, > >>> + struct kretprobe_instance, hlist); > >>> + hlist_del(&ri->hlist); > >>> + } > >>> + raw_spin_unlock_irqrestore(&rp->lock, flags); > >>> + > >>> + /* Populate max active instance if possible */ > >>> + if (!ri && rp->maxactive < KRETPROBE_MAXACTIVE_ALLOC) { > >>> + ri = kmalloc(sizeof(*ri) + rp->data_size, GFP_ATOMIC); > >>> + if (ri) > >>> + rp->maxactive++; > >>> + } > >>> + > >>> + return ri; > >>> +} > >>> /* > >>> * This kprobe pre_handler is registered with every kretprobe. When probe > >>> * hits it will set up the return probe. > >>> @@ -1846,14 +1869,8 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs) > >>> } > >>> > >>> /* TODO: consider to only swap the RA after the last pre_handler fired */ > >>> - hash = hash_ptr(current, KPROBE_HASH_BITS); > >>> - raw_spin_lock_irqsave(&rp->lock, flags); > >>> - if (!hlist_empty(&rp->free_instances)) { > >>> - ri = hlist_entry(rp->free_instances.first, > >>> - struct kretprobe_instance, hlist); > >>> - hlist_del(&ri->hlist); > >>> - raw_spin_unlock_irqrestore(&rp->lock, flags); > >>> - > >>> + ri = kretprobe_alloc_instance(rp); > >>> + if (ri) { > >>> ri->rp = rp; > >>> ri->task = current; > >>> > >>> @@ -1868,13 +1885,13 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs) > >>> > >>> /* XXX(hch): why is there no hlist_move_head? */ > >>> INIT_HLIST_NODE(&ri->hlist); > >>> + hash = hash_ptr(current, KPROBE_HASH_BITS); > >>> kretprobe_table_lock(hash, &flags); > >>> hlist_add_head(&ri->hlist, &kretprobe_inst_table[hash]); > >>> kretprobe_table_unlock(hash, &flags); > >>> - } else { > >>> + } else > >>> rp->nmissed++; > >>> - raw_spin_unlock_irqrestore(&rp->lock, flags); > >>> - } > >>> + > >>> return 0; > >>> } > >>> NOKPROBE_SYMBOL(pre_handler_kretprobe); > >> > >> So this is something I missed while the original code was merged, but the concept > >> looks a bit weird: why do we do any "allocation" while a handler is executing? > >> > >> That's fundamentally fragile. What's the maximum number of parallel > >> 'kretprobe_instance' required per kretprobe - one per CPU? > > > > It depends on the place where we put the probe. If the probed function will be > > blocked (yield to other tasks), then we need a same number of threads on > > the system which can invoke the function. So, ultimately, it is same > > as function_graph tracer, we need it for each thread. > > Isn't it also possible that the function may be reentrant? Whether by > plain recursion or an interrupt call, this leads to multiple live > instances even for a given thread. Yes, that's another possible case, but I don't think that's so serious in kernel because we have very limited kernel stack, which means the recursion may not so deep. Thank you,
* Masami Hiramatsu <mhiramat@kernel.org> wrote: > > So this is something I missed while the original code was merged, but the concept > > looks a bit weird: why do we do any "allocation" while a handler is executing? > > > > That's fundamentally fragile. What's the maximum number of parallel > > 'kretprobe_instance' required per kretprobe - one per CPU? > > It depends on the place where we put the probe. If the probed function will be > blocked (yield to other tasks), then we need a same number of threads on > the system which can invoke the function. So, ultimately, it is same > as function_graph tracer, we need it for each thread. So then put it into task_struct (assuming there's no kretprobe-inside-kretprobe nesting allowed). There's just no way in hell we should be calling any complex kernel function from kernel probes! I mean, think about it, a kretprobe can be installed in a lot of places, and now we want to call get_free_pages() from it?? This would add a massive amount of fragility. Instrumentation must be _simple_, every patch that adds more complexity to the most fundamental code path of it should raise a red flag ... So let's make this more robust, ok? Thanks, Ingo
On Thu, 30 Mar 2017 08:53:32 +0200 Ingo Molnar <mingo@kernel.org> wrote: > > * Masami Hiramatsu <mhiramat@kernel.org> wrote: > > > > So this is something I missed while the original code was merged, but the concept > > > looks a bit weird: why do we do any "allocation" while a handler is executing? > > > > > > That's fundamentally fragile. What's the maximum number of parallel > > > 'kretprobe_instance' required per kretprobe - one per CPU? > > > > It depends on the place where we put the probe. If the probed function will be > > blocked (yield to other tasks), then we need a same number of threads on > > the system which can invoke the function. So, ultimately, it is same > > as function_graph tracer, we need it for each thread. > > So then put it into task_struct (assuming there's no kretprobe-inside-kretprobe > nesting allowed). No, that is possible to put several kretprobes on same thread, e.g. the func1() is called from func2(), user can put kretprobes for each function at same time. So the possible solution is to allocate new return-stack for each task_struct, and that is what the function-graph tracer did. Anyway, I'm considering to integrate kretprobe_instance with the ret_stack. It will increase memory usage for kretprobes, but can provide safer way to allocate kretprobe_instance. > There's just no way in hell we should be calling any complex > kernel function from kernel probes! OK, so let's drop this, since it may easily cause deadlock... > I mean, think about it, a kretprobe can be installed in a lot of places, and now > we want to call get_free_pages() from it?? This would add a massive amount of > fragility. I thought it was safe because GFP_ATOMIC is safe at interrupt handler. > Instrumentation must be _simple_, every patch that adds more complexity to the > most fundamental code path of it should raise a red flag ... > > So let's make this more robust, ok? Yeah, in that case, I think Alban's patch is enough at this point since it gives user to tune their kretprobe events not to be missed. Thank you, > > Thanks, > > Ingo
On Thu, Mar 30, 2017 at 8:53 AM, Ingo Molnar <mingo@kernel.org> wrote: > > * Masami Hiramatsu <mhiramat@kernel.org> wrote: > >> > So this is something I missed while the original code was merged, but the concept >> > looks a bit weird: why do we do any "allocation" while a handler is executing? >> > >> > That's fundamentally fragile. What's the maximum number of parallel >> > 'kretprobe_instance' required per kretprobe - one per CPU? >> >> It depends on the place where we put the probe. If the probed function will be >> blocked (yield to other tasks), then we need a same number of threads on >> the system which can invoke the function. So, ultimately, it is same >> as function_graph tracer, we need it for each thread. > > So then put it into task_struct (assuming there's no kretprobe-inside-kretprobe > nesting allowed). There's just no way in hell we should be calling any complex > kernel function from kernel probes! Some kprobes are called from an interruption context. We have a kprobe on tcp_set_state() and this is sometimes called when the network card receives a packet. > I mean, think about it, a kretprobe can be installed in a lot of places, and now > we want to call get_free_pages() from it?? This would add a massive amount of > fragility. > > Instrumentation must be _simple_, every patch that adds more complexity to the > most fundamental code path of it should raise a red flag ... > > So let's make this more robust, ok? > > Thanks, > > Ingo Thanks, Alban
* Masami Hiramatsu <mhiramat@kernel.org> wrote: > On Thu, 30 Mar 2017 08:53:32 +0200 > Ingo Molnar <mingo@kernel.org> wrote: > > > > > * Masami Hiramatsu <mhiramat@kernel.org> wrote: > > > > > > So this is something I missed while the original code was merged, but the concept > > > > looks a bit weird: why do we do any "allocation" while a handler is executing? > > > > > > > > That's fundamentally fragile. What's the maximum number of parallel > > > > 'kretprobe_instance' required per kretprobe - one per CPU? > > > > > > It depends on the place where we put the probe. If the probed function will be > > > blocked (yield to other tasks), then we need a same number of threads on > > > the system which can invoke the function. So, ultimately, it is same > > > as function_graph tracer, we need it for each thread. > > > > So then put it into task_struct (assuming there's no kretprobe-inside-kretprobe > > nesting allowed). > > No, that is possible to put several kretprobes on same thread, e.g. > the func1() is called from func2(), user can put kretprobes for each > function at same time. > So the possible solution is to allocate new return-stack for each task_struct, > and that is what the function-graph tracer did. > > Anyway, I'm considering to integrate kretprobe_instance with the ret_stack. > It will increase memory usage for kretprobes, but can provide safer way > to allocate kretprobe_instance. Ok, that sounds good to me. Thanks, Ingo
diff --git a/Documentation/kprobes.txt b/Documentation/kprobes.txt index 1f6d45a..2de6533 100644 --- a/Documentation/kprobes.txt +++ b/Documentation/kprobes.txt @@ -131,11 +131,13 @@ kretprobe, then sets the saved instruction pointer to the saved return address, and that's where execution resumes upon return from the trap. While the probed function is executing, its return address is -stored in an object of type kretprobe_instance. Before calling -register_kretprobe(), the user sets the maxactive field of the -kretprobe struct to specify how many instances of the specified -function can be probed simultaneously. register_kretprobe() -pre-allocates the indicated number of kretprobe_instance objects. +stored in an object of type kretprobe_instance. Usually, this +kretprobe_instance will be allocated dynamically. +Since the dynamic allocation can cause mis-hit of other probes +on memory allocation path, user can set maxactive field for pooling +pre-allocated instances before calling register_kretprobe(). +This maxactive indicates how many instances of the specified +function can be probed simultaneously. For example, if the function is non-recursive and is called with a spinlock held, maxactive = 1 should be enough. If the function is @@ -144,11 +146,14 @@ or preemption), NR_CPUS should be enough. If maxactive <= 0, it is set to a default value. If CONFIG_PREEMPT is enabled, the default is max(10, 2*NR_CPUS). Otherwise, the default is NR_CPUS. -It's not a disaster if you set maxactive too low; you'll just miss -some probes. In the kretprobe struct, the nmissed field is set to -zero when the return probe is registered, and is incremented every -time the probed function is entered but there is no kretprobe_instance -object available for establishing the return probe. +It's not a disaster if you set maxactive too low; you'll just see +some probes on memory allocation path missed if it exists. + +In the kretprobe struct, the nmissed field is set to zero when the +return probe is registered, and is incremented every time the probed +function is entered but there is no kretprobe_instance object available +and it fails to allocate new one, or hit the upper limit of maxactive +(KRETPROBE_MAXACTIVE_ALLOC, currently it is 4096.) 1.3.2 Kretprobe entry-handler diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h index 47e4da5..8064e14 100644 --- a/include/linux/kprobes.h +++ b/include/linux/kprobes.h @@ -192,6 +192,8 @@ struct kretprobe { struct hlist_head free_instances; raw_spinlock_t lock; }; +/* Upper limit of maxactive for dynamic allocation */ +#define KRETPROBE_MAXACTIVE_ALLOC 4096 struct kretprobe_instance { struct hlist_node hlist; diff --git a/kernel/kprobes.c b/kernel/kprobes.c index d733479..75c5390 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -57,7 +57,6 @@ #define KPROBE_HASH_BITS 6 #define KPROBE_TABLE_SIZE (1 << KPROBE_HASH_BITS) - /* * Some oddball architectures like 64bit powerpc have function descriptors * so this must be overridable. @@ -1824,6 +1823,30 @@ void unregister_jprobes(struct jprobe **jps, int num) EXPORT_SYMBOL_GPL(unregister_jprobes); #ifdef CONFIG_KRETPROBES + +/* Try to use free instance first, if failed, try to allocate new instance */ +struct kretprobe_instance *kretprobe_alloc_instance(struct kretprobe *rp) +{ + struct kretprobe_instance *ri = NULL; + unsigned long flags = 0; + + raw_spin_lock_irqsave(&rp->lock, flags); + if (!hlist_empty(&rp->free_instances)) { + ri = hlist_entry(rp->free_instances.first, + struct kretprobe_instance, hlist); + hlist_del(&ri->hlist); + } + raw_spin_unlock_irqrestore(&rp->lock, flags); + + /* Populate max active instance if possible */ + if (!ri && rp->maxactive < KRETPROBE_MAXACTIVE_ALLOC) { + ri = kmalloc(sizeof(*ri) + rp->data_size, GFP_ATOMIC); + if (ri) + rp->maxactive++; + } + + return ri; +} /* * This kprobe pre_handler is registered with every kretprobe. When probe * hits it will set up the return probe. @@ -1846,14 +1869,8 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs) } /* TODO: consider to only swap the RA after the last pre_handler fired */ - hash = hash_ptr(current, KPROBE_HASH_BITS); - raw_spin_lock_irqsave(&rp->lock, flags); - if (!hlist_empty(&rp->free_instances)) { - ri = hlist_entry(rp->free_instances.first, - struct kretprobe_instance, hlist); - hlist_del(&ri->hlist); - raw_spin_unlock_irqrestore(&rp->lock, flags); - + ri = kretprobe_alloc_instance(rp); + if (ri) { ri->rp = rp; ri->task = current; @@ -1868,13 +1885,13 @@ static int pre_handler_kretprobe(struct kprobe *p, struct pt_regs *regs) /* XXX(hch): why is there no hlist_move_head? */ INIT_HLIST_NODE(&ri->hlist); + hash = hash_ptr(current, KPROBE_HASH_BITS); kretprobe_table_lock(hash, &flags); hlist_add_head(&ri->hlist, &kretprobe_inst_table[hash]); kretprobe_table_unlock(hash, &flags); - } else { + } else rp->nmissed++; - raw_spin_unlock_irqrestore(&rp->lock, flags); - } + return 0; } NOKPROBE_SYMBOL(pre_handler_kretprobe);
Try to allocate kretprobe instance by GFP_ATOMIC if kretprobe's free list is empty. This can prevent kretprobe miss-hit on the function which can be heavily invoked and slept inside (like locking syscall entries.) NOTE: This may easily cause nested kprobe call which will be just skipped (but nmissed count is incremented), if someone probe functions on the memory allocation path. Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> --- Documentation/kprobes.txt | 25 +++++++++++++++---------- include/linux/kprobes.h | 2 ++ kernel/kprobes.c | 41 +++++++++++++++++++++++++++++------------ 3 files changed, 46 insertions(+), 22 deletions(-)