In timerlat user-space mode (NO_OSNOISE_WORKLOAD) the workload is a user
task reading timerlat_fd, so there is no per-CPU kernel thread to run.
start_kthread() only checks for that in the osnoise branch:
if (timerlat_enabled()) {
snprintf(comm, 24, "timerlat/%d", cpu);
main = timerlat_main;
} else {
/* if no workload, just return */
if (!test_bit(OSN_WORKLOAD, &osnoise_options)) {
...
return 0;
}
...
}
start_per_cpu_kthreads() guards against this mode itself, but
osnoise_hotplug_workfn() calls start_kthread() directly. Bringing a CPU
online in user-space mode therefore starts a timerlat/N thread and sets
its bit in kthread_cpumask while OSN_WORKLOAD is clear.
stop_kthread() uses that bit to decide what the recorded task is:
if (cpumask_test_and_clear_cpu(cpu, &kthread_cpumask) &&
!WARN_ON(!test_bit(OSN_WORKLOAD, &osnoise_options))) {
kthread_stop(kthread);
} else if (!WARN_ON(test_bit(OSN_WORKLOAD, &osnoise_options))) {
kill_pid(kthread->thread_pid, SIGKILL, 1);
put_task_struct(kthread);
}
The bit is set but OSN_WORKLOAD is not, so the first WARN_ON() fires and
the && short-circuits into the user-task branch. A running kernel thread
is SIGKILLed and its task_struct is put without ever being stopped, so it
keeps executing until it is freed underneath itself.
Any write to osnoise/options reaches this: osnoise_options_write() stops
the per-CPU threads before applying the new value, so stop_kthread()
still sees OSN_WORKLOAD clear. Re-writing the value that is already set
triggers it just as well as changing it.
echo NO_OSNOISE_WORKLOAD > osnoise/options
echo timerlat > current_tracer
echo 0 > /sys/devices/system/cpu/cpu1/online
echo 1 > /sys/devices/system/cpu/cpu1/online
echo NO_OSNOISE_WORKLOAD > osnoise/options
The offline/online pair is required, otherwise no kthread is recorded and
no bit is set. Running this on 7.3-rc7 with KASAN gives a WARNING in
stop_kthread() followed by a slab-use-after-free in update_se(); leaving
out the hotplug step produces neither.
Keep the check in start_kthread(), where the related hotplug bug was
fixed in 0bb0a5c12ecf, instead of adding another copy to the callback.
Fixes: e88ed227f639 ("tracing/timerlat: Add user-space interface")
Cc: [email protected]
Signed-off-by: Chaosheng Qu <[email protected]>
---
kernel/trace/trace_osnoise.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c
index 0e1265acd..9715462ee 100644
--- a/kernel/trace/trace_osnoise.c
+++ b/kernel/trace/trace_osnoise.c
@@ -2038,6 +2038,14 @@ static int start_kthread(unsigned int cpu)
return 0;
if (timerlat_enabled()) {
+ /*
+ * In timerlat user-space mode the workload is the user task
+ * reading timerlat_fd, so there is no kernel thread to start.
+ * One started here would set its kthread_cpumask bit, which
+ * stop_kthread() reads as "osnoise workload kthread".
+ */
+ if (!test_bit(OSN_WORKLOAD, &osnoise_options))
+ return 0;
snprintf(comm, 24, "timerlat/%d", cpu);
main = timerlat_main;
} else {
--
2.43.0
