Re: [PATCH 3/3] kprobes: Arm reused optprobe on cooling list

[Masami Hiramatsu (Google)]

On Tue, 03 Nov 2026 13:46:01 -0500, Mani Tofigh via B4 Relay <devnull+mt4022.columbia.edu@xxxxxxxxxx> wrote:

> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -536,6 +536,7 @@ static struct optprobe_generation optprobe_gens[OPTPROBE_GEN_MAX];
>  static int optprobe_cur_gen;
>  
>  static void optimize_kprobe(struct kprobe *p);
> +static void __arm_kprobe(struct kprobe *p);

If reuse_unused_kprobe() leaves arming to register_aggr_kprobe()
(via arm_kprobe()), this forward declaration of __arm_kprobe() will not be needed.

>  static struct task_struct *kprobe_optimizer_task;
>  static wait_queue_head_t kprobe_optimizer_wait;
>  static atomic_t optimizer_state;
> @@ -1067,6 +1068,13 @@ static int reuse_unused_kprobe(struct kprobe *ap)
>  	if (!kprobe_optready(ap))
>  		return -EINVAL;
>  
> +	if (optprobe_queued_cooling(op)) {

Instead of arming the probe directly here, consider let
register_aggr_kprobe() to arm it:


if (ret == 0 && kprobe_disabled(ap) && !kprobe_disabled(p)) {
	ap->flags &= ~KPROBE_FLAG_DISABLED;
	if (!kprobes_all_disarmed) {
		ret = arm_kprobe(ap);
		...


The reason a cooling probe didn't fire in the first place is that
reuse_unused_kprobe() unconditionally cleared KPROBE_FLAG_DISABLED.
Because a cooling probe was already unoptimized and disarmed,
it should remain disabled while on the cooling list.

If reuse_unused_kprobe() does not clear KPROBE_FLAG_DISABLED when
optprobe_queued_cooling(op) is true, register_aggr_kprobe() will
naturally arm the probe via arm_kprobe(ap) only if the newly attached
probe is enabled (!kprobe_disabled(p)), handle any error unwinding
if arm_kprobe() fails, and keep it disabled if 'p' is disabled.

> +		/* Already disarmed. It will be optimized again upon finalize */
> +		if (!kprobes_all_disarmed)
> +			__arm_kprobe(ap);

Arming the probe here unconditionally when it is on a cooling list
introduces a bug when the new probe 'p' being registered is disabled
(e.g., registered via tracefs before being enabled or with KPROBE_FLAG_DISABLED).

Thanks,

-- 
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>