Re: [PATCH] rcu: Fix kernel stack overflow caused by kprobe on rcu_irq_enter_check_tick()

[Zheng Yejian]

On Mon, 5 Dec 2022 14:23:53 +0100, Frederic Weisbecker wrote:
> On Mon, Nov 21, 2022 at 11:57:03AM -0800, Paul E. McKenney wrote:
> > On Sat, Nov 19, 2022 at 12:00:49PM +0800, Zheng Yejian wrote:
> > > Register kprobe on __rcu_irq_enter_check_tick() can cause kernel stack
> > > overflow [1]. This issue is first found in v5.10 and can be reproduced
> > > by enabling CONFIG_NO_HZ_FULL and doing like:
> > >   # cd /sys/kernel/debug/tracing/
> > >   # echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events
> > >   # echo 1 > events/kprobes/enable
> > > 
> > > So __rcu_irq_enter_check_tick() should not be kprobed, mark it as noinstr.
> > 
> > Good catch!
> > 
> > I am inclined to queue this, but noticed that one of its callers need
> > it to be noinstr but that the others do not.
> > 
> > Need noinstr:
> > 
> > o	enter_from_kernel_mode() -> __enter_from_kernel_mode() ->
> >	rcu_irq_enter_check_tick() -> __rcu_irq_enter_check_tick()
> > 
> > Doesn't need noinstr:
> > 
> > o	ct_nmi_enter() -> rcu_irq_enter_check_tick() ->
> >	__rcu_irq_enter_check_tick(), courtesy of the call to
> >	instrumentation_begin() in ct_nmi_enter() that precedes the call
> >	to rcu_irq_enter_check_tick().
> > 
> > o	irqentry_enter() -> rcu_irq_enter_check_tick() ->
> >	__rcu_irq_enter_check_tick(), courtesy of the call to
> >	instrumentation_begin() in irqentry_enter() that precedes the
> >	call to rcu_irq_enter_check_tick().
> > 
> > Is tagging __rcu_irq_enter_check_tick() with noinstr as
> > proposed in this patch the right thing to do, or should there
> > be calls to instrumentation_begin() and instrumentation_end() in
> > enter_from_kernel_mode()?  Or something else entirely?
> 
> Tagging as noinstr doesn't look right as there are functions in
> __rcu_irq_enter_check_tick() that can be traced anyway. Also that
> function has the constraint that it can't be called while RCU is idle
> so it's up to the caller to call instrumentation_begin()/end().

This problem is due to __rcu_irq_enter_check_tick() being kprobe-ed, so
how about adding __rcu_irq_enter_check_tick() into kprobe blacklist by
tagging with NOKPROBE_SYMBOL:

  diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
  index cf34a961821a..41606d3ed083 100644
  --- a/kernel/rcu/tree.c
  +++ b/kernel/rcu/tree.c
  @@ -659,6 +659,7 @@ void __rcu_irq_enter_check_tick(void)
          }
          raw_spin_unlock_rcu_node(rdp->mynode);
   }
  +NOKPROBE_SYMBOL(__rcu_irq_enter_check_tick);
   #endif /* CONFIG_NO_HZ_FULL */

+Cc: <mhiramat@xxxxxxxxxx>

--
Best regards,
Zheng Yejian