Re: [PATCH 2/2] kprobe: fix: Add ftrace_ops_assist_func to kprobe blacklist

[Steven Rostedt]

On Fri, 16 Mar 2018 11:18:25 -0400
Francis Deslauriers <francis.deslauriers@xxxxxxxxxxxx> wrote:

> Hi Steven,
> 
> I completely forgot about this issue until recently when I encountered it again.
> Instrumenting the ftrace_ops_assist_func symbol and some other symbol
> seems to be causing problems.
> 
> Placing kretprobes like in the following configuration crashes my
> kernel (4.16.0-rc5) on a Qemu/KVM virtual machine:
> 
> config 1:
> echo "r:event_1 __fdget" >> kprobe_events
> echo "r:event_2 ftrace_ops_assist_func" >> kprobe_events
> 
> config 2:
> echo "r:event_1 __fdget_pos" >> kprobe_events
> echo "r:event_2 ftrace_ops_assist_func" >> kprobe_events
> 
> config 3:
> echo 'r:event_1 arch_dup_task_struct' >> kprobe_events
> echo 'r:event_2 ftrace_ops_assist_func' >> kprobe_events
> 
> config 4:
> echo 'r:event_1 sys_open' >> kprobe_events
> echo 'r:event_2 ftrace_ops_assist_func' >> kprobe_events
> 
> Here is my kernel config [1]:
> 
> In a previous email [2], you mentioned that you would like to add the
> ftrace-related symbols to a section to un-blacklist them all at once
> on demand but wanted to discuss it at Linux Plumbers. Do you still
> think that it's the right approach?

We probably didn't discuss it (as there was a lot to discuss, and this
was probably overshadowed by that). But yes, you should not probe
ftrace called functions. That is guaranteed to crash and that crash is
not a bug, but a feature.

The ftrace and ring buffer files should be blacklisted from being
probed. Perhaps the entire directory.

Anyway, I don't see this as much of an urgent matter, as it's one of
those "Patient: Doc, it hurts when I do this. Doc: Don't do that"
cases. And there's a lot of urgent issues that currently need to be
dealt with.

-- Steve


> 
> I can easily test any patch regarding this issue.
> 
> [1] http://paste.ubuntu.com/p/BJWvgMnW8z/
> [2] https://lkml.org/lkml/2017/7/14/568
> 
> Thank you,
> 
> 2017-07-14 14:29 GMT-04:00 Steven Rostedt <rostedt@xxxxxxxxxxx>:
> > On Fri, 14 Jul 2017 10:58:35 -0400
> > Francis Deslauriers <francis.deslauriers@xxxxxxxxxxxx> wrote:
> >  
> >> This function is called when a kprobe is hit. Thus it should be
> >> blacklisted to prevent kprobe to be triggered by kprobes.
> >>
> >> Signed-off-by: Francis Deslauriers <francis.deslauriers@xxxxxxxxxxxx>
> >> ---
> >>  kernel/trace/ftrace.c | 2 ++
> >>  1 file changed, 2 insertions(+)
> >>
> >> diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
> >> index b308be3..c473d9b 100644
> >> --- a/kernel/trace/ftrace.c
> >> +++ b/kernel/trace/ftrace.c
> >> @@ -36,6 +36,7 @@
> >>
> >>  #include <trace/events/sched.h>
> >>
> >> +#include <asm/kprobes.h>
> >>  #include <asm/sections.h>
> >>  #include <asm/setup.h>
> >>
> >> @@ -5739,6 +5740,7 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip,
> >>       preempt_enable_notrace();
> >>       trace_clear_recursion(bit);
> >>  }
> >> +NOKPROBE_SYMBOL(ftrace_ops_assist_func);  
> >
> > Continuing from what I said in the other email, this is fixing a
> > symptom and not the problem. The real fix will be much more involved. I
> > have a good idea on how to accomplish it too.
> >
> > -- Steve
> >
> >  
> >>
> >>  /**
> >>   * ftrace_ops_get_func - get the function a trampoline should call  
> >  
> 
> 
>