[Bug kprobes/2162] New: kretprobe on kfree() will cause a deadlock.

["hiramatu at sdl dot hitachi dot co dot jp" <sourceware-bugzilla at sourceware dot org>]

How reproducible:
Always

Steps to reproduce:
1. insert two kretprobes on the kfree() and another function (i.e. sys_link()).
2. call unregister_kretprobe() to get rid of the probe from the latter function
(sys_link()).
Then the kernel is locked up. (I show the console log below).

Cause of the probrem:
unregister_kretprobe() invokes free_rp_inst() which calls kfree() with
kretprobe_lock spinlock acquired. At the entrance of kfree(),
pre_handler_kretprobe() is invoked. And it also tries to acquire the
kretprobe_lock spinlock again. So, it causes a deadlock.

Solutions:
I thought two solutions.
(A) Using rcu instead of spinlock. 
Additionally, this makes kretprobe lockless.
(B) Freeing kretprobe instances after releasing the kretprobe_lock.

The solution (B) is so simple.

I will attach the patch which implements the solution (B).

console log:

probe install to kfree()
probe install to c016d2e4
uninstall from c016d2e4
BUG: spinlock recursion on CPU#0, rmmod/13954
 lock: c045c5a0, .magic: dead4ead, .owner: rmmod/13954, .owner_cpu: 0
 [<c01039be>] dump_stack+0x17/0x19
 [<c024963a>] spin_bug+0x9a/0xae
 [<c024978c>] _raw_spin_lock+0x71/0x73
 [<c03d4321>] _spin_lock_irqsave+0xc/0x11
 [<c03d5f8e>] pre_handler_kretprobe+0x14/0x32
 [<c03d4bad>] kprobe_handler+0x203/0x2a8
 [<c03d4e1f>] kprobe_exceptions_notify+0x38/0x1a6
 [<c03d59aa>] notifier_call_chain+0x1a/0x30
 [<c03d4806>] do_int3+0x39/0x7b
 [<c03d4592>] int3+0x1e/0x24
 [<f88300b5>] uninstall_probe+0x29/0x4c [lock_kretprobe]
 [<c0135c8d>] sys_delete_module+0x12c/0x174
 [<c0102adf>] sysenter_past_esp+0x54/0x75

-- 
           Summary: kretprobe on kfree() will cause a deadlock.
           Product: systemtap
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: kprobes
        AssignedTo: systemtap at sources dot redhat dot com
        ReportedBy: hiramatu at sdl dot hitachi dot co dot jp


http://sourceware.org/bugzilla/show_bug.cgi?id=2162

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.