Hi Oleg, On 02/08/2016:10:30:35 PM, Oleg Nesterov wrote: > On 08/02, Pratyush Anand wrote: > > > > uprobe_pre_sstep_notifier and uprobe_post_sstep_notifier are called from > > debug exception handler, so blacklist them for kprobing. > > Let me add kprobes maintainers, I am a bit confused... > > > @@ -1997,6 +1998,7 @@ int uprobe_pre_sstep_notifier(struct pt_regs *regs) > > set_thread_flag(TIF_UPROBE); > > return 1; > > } > > +NOKPROBE_SYMBOL(uprobe_pre_sstep_notifier); > > > > /* > > * uprobe_post_sstep_notifier gets called in interrupt context as part of > > notifier > > @@ -2014,6 +2016,7 @@ int uprobe_post_sstep_notifier(struct pt_regs *regs) > > set_thread_flag(TIF_UPROBE); > > return 1; > > } > > +NOKPROBE_SYMBOL(uprobe_post_sstep_notifier); > > but if we need to blacklist uprobe_pre/post_sstep_notifier then we > also need to blacklist their caller, arch_uprobe_exception_notify() ?
I think yes, in ARM64 I have done that. However, arm64 does not use notifier method, so arch_uprobe_exception_notify() is just a dummy function for it. > > and every .notifier_call used in register_die_notifier() ? I tried to look into x86 notify path related to uprobe_pre/post_sstep_notifier(). I see that calling sequence is like do_int3()-> notify_die() -> atomic_notifier_call_chain() -> __atomic_notifier_call_chain() -> notifier_call_chain() -> arch_uprobe_exception_notify(). In this sequence, every function is blacklisted for kprobe except arch_uprobe_exception_notify(). So, I am unable to understand, if notifier_call_chain() is not safe for kprobe then how can it be safe for a function it calls. ~Pratyush
