Re: [PATCH 0/8] kprobes: Fixes for registration errors, ftrace ops and optprobe state machine

[Masami Hiramatsu (Google)]

On Wed,  4 Nov 2026 08:58:18 +0900, Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx> wrote:
> Hi,
> 
> Here is a series of bug fixes for kprobes and optprobes, addressing error
> recovery, ftrace ops management, and optprobe asynchronous state machine
> edge cases:
> 
> 1. Registration & Unregistration Error Handling (Patches 1-3):
>    - In __register_kprobe(), when arm_kprobe() fails, the error code was
>      ignored and the instruction slot was leaked.
>    - In unregister_kretprobes(), failing __unregister_kprobe_top() still
>      invoked rethook/rph freeing, causing a double free or NULL deref.
>      Clearing rp->rh is also deferred until after synchronize_rcu() to
>      prevent racing with in-flight pre_handler_kretprobe() invocations.
>    - In register_kretprobe(), re-registration validation was skipped when
>      registered by symbol_name without an explicit addr, leading to
>      destruction of the live probe's rethook instance on failure.

I think these are urgent fixes. So I'll pick those to probes/fixes.

> 
> 2. Ftrace Ops Switching for Post-Handlers (Patch 4):
>    - When adding a second probe with a post_handler to an existing ftrace
>      kprobe, the aggregate probe's post_handler was set but remained armed
>      on kprobe_ftrace_ops. Subsequent disarming attempted to disarm from
>      kprobe_ipmodify_ops, failing with -ENOENT and leaking the armed probe.
>      Switch ftrace ops safely in register_aggr_kprobe() outside of
>      text_mutex and cpus_read_lock.

This should be updated to v2.

> 
> 3. Optprobe State Machine & Tasks RCU Quiescence (Patches 5-7):
>    - Forcibly unoptimized probes (unoptimize_kprobe(force = true)) were
>      not queued to cooling_list, causing kprobe_disarmed() to return true
>      prematurely and risking use-after-free in the optinsn detour buffer
>      before Tasks RCU completed.
>    - Re-arming an unoptimizing probe before the unoptimization pass ran
>      overwrote the first byte of the relative jump with a breakpoint,
>      corrupting the jump opcode in text.
>    - Probes killed at module unload while child probes were still active
>      were prematurely freed or improperly unhashed before Tasks RCU
>      quiescence elapsed.

I need to update these and rebase on Mani's fixes [1] after he fixed
problems, since that will fix the similar problems. These will be
probes/for-next branch.

[1] https://lore.kernel.org/r/20261103-kprobes-optprobe-state-v1-0-6aaac612abe6@xxxxxxxxxxxx

> 
> In addition to the bugfixes, the last patch adds KUnit test cases for
> these bugs. (Patch 8)

This also needs to be updated, but it will also go to probes/for-next.

Thanks,

-- 
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>