From: Alexei Starovoitov <[email protected]> __arch_uprobe_optimize() and set_orig_insn() do WARN_ON_ONCE() when uprobe_write() fails, and user space can make it fail: - -EINTR from get_user_pages_remote() when current is being killed. - -ENOMEM when COW can't be broken, since memcg is at its limit. - -EINVAL from __update_ref_ctr() when the process cleared the semaphore of SDT probe.
Kill the processes that call probed nop10. It warns in 8 of 8 runs: WARNING: arch/x86/kernel/uprobes.c:1186 at arch_uprobe_optimize+0x291/0x3a0 uprobe_notify_resume+0x1c3/0x4c0 exit_to_user_mode_loop+0x63/0x4e0 exc_int3+0x1f3/0x250 The next patch calls set_orig_insn() from fork(). Kill the processes that fork and keep mmap_lock busy, while a trace event on nop10 is enabled and disabled. The kernel with the next two patches and without this one warns in 3 of 3 runs. The whole series in 0 of 3: WARNING: arch/x86/kernel/uprobes.c:1161 at set_orig_insn+0x161/0x170 register_one_mm+0x154/0x180 uprobe_dup_mmap+0x61/0xb0 dup_mmap+0x149/0x9f0 The callers handle the error. arch_uprobe_optimize() marks uprobe as not optimizable and byte 0 stays a breakpoint. set_orig_insn() returns the error. Drop both WARNs. This depends on the previous patch. Without it WARN was the only sign of the bytes that set_orig_insn() cannot restore. Hence no Fixes tag. Signed-off-by: Alexei Starovoitov <[email protected]> --- arch/x86/kernel/uprobes.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c index 62bbe41c6466..33c35bf07801 100644 --- a/arch/x86/kernel/uprobes.c +++ b/arch/x86/kernel/uprobes.c @@ -1170,11 +1170,8 @@ int set_orig_insn(struct arch_uprobe *auprobe, struct vm_area_struct *vma, int ret = is_optimized(vma->vm_mm, vaddr); if (ret < 0) return ret; - if (ret) { - ret = swbp_unoptimize(auprobe, vma, vaddr); - WARN_ON_ONCE(ret); - return ret; - } + if (ret) + return swbp_unoptimize(auprobe, vma, vaddr); } return uprobe_write_opcode(auprobe, vma, vaddr, *(uprobe_opcode_t *)&auprobe->insn, false /* is_register */); @@ -1197,7 +1194,7 @@ static int __arch_uprobe_optimize(struct arch_uprobe *auprobe, struct mm_struct if (IS_ERR(tramp)) return PTR_ERR(tramp); ret = swbp_optimize(auprobe, vma, vaddr, tramp->vm_start); - if (WARN_ON_ONCE(ret) && new_mapping) + if (ret && new_mapping) WARN_ON_ONCE(do_munmap(mm, tramp->vm_start, PAGE_SIZE, NULL)); return ret; } -- 2.55.0
