On Thu, Oct 22, 2026 at 01:57:07AM +0000, Alexei Starovoitov wrote: > From: Alexei Starovoitov <[email protected]> > > __arch_uprobe_optimize() and set_orig_insn() do WARN_ON_ONCE() when > uprobe_write() fails, and user space can make it fail: > - -EINTR from get_user_pages_remote() when current is being killed. > - -ENOMEM when COW can't be broken, since memcg is at its limit. > - -EINVAL from __update_ref_ctr() when the process cleared the semaphore > of SDT probe. > > Kill the processes that call probed nop10. It warns in 8 of 8 runs: > > WARNING: arch/x86/kernel/uprobes.c:1186 at arch_uprobe_optimize+0x291/0x3a0 > uprobe_notify_resume+0x1c3/0x4c0 > exit_to_user_mode_loop+0x63/0x4e0 > exc_int3+0x1f3/0x250 > > The next patch calls set_orig_insn() from fork(). Kill the processes that > fork and keep mmap_lock busy, while a trace event on nop10 is enabled and > disabled. The kernel with the next two patches and without this one warns > in 3 of 3 runs. The whole series in 0 of 3: > > WARNING: arch/x86/kernel/uprobes.c:1161 at set_orig_insn+0x161/0x170 > register_one_mm+0x154/0x180 > uprobe_dup_mmap+0x61/0xb0 > dup_mmap+0x149/0x9f0 > > The callers handle the error. arch_uprobe_optimize() marks uprobe as not > optimizable and byte 0 stays a breakpoint. set_orig_insn() returns > the error. Drop both WARNs. > > This depends on the previous patch. Without it WARN was the only sign of > the bytes that set_orig_insn() cannot restore. Hence no Fixes tag. > > Signed-off-by: Alexei Starovoitov <[email protected]>
Acked-by: Jiri Olsa <[email protected]> thanks, jirka > --- > arch/x86/kernel/uprobes.c | 9 +++------ > 1 file changed, 3 insertions(+), 6 deletions(-) > > diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c > index 62bbe41c6466..33c35bf07801 100644 > --- a/arch/x86/kernel/uprobes.c > +++ b/arch/x86/kernel/uprobes.c > @@ -1170,11 +1170,8 @@ int set_orig_insn(struct arch_uprobe *auprobe, struct > vm_area_struct *vma, > int ret = is_optimized(vma->vm_mm, vaddr); > if (ret < 0) > return ret; > - if (ret) { > - ret = swbp_unoptimize(auprobe, vma, vaddr); > - WARN_ON_ONCE(ret); > - return ret; > - } > + if (ret) > + return swbp_unoptimize(auprobe, vma, vaddr); > } > return uprobe_write_opcode(auprobe, vma, vaddr, *(uprobe_opcode_t > *)&auprobe->insn, > false /* is_register */); > @@ -1197,7 +1194,7 @@ static int __arch_uprobe_optimize(struct arch_uprobe > *auprobe, struct mm_struct > if (IS_ERR(tramp)) > return PTR_ERR(tramp); > ret = swbp_optimize(auprobe, vma, vaddr, tramp->vm_start); > - if (WARN_ON_ONCE(ret) && new_mapping) > + if (ret && new_mapping) > WARN_ON_ONCE(do_munmap(mm, tramp->vm_start, PAGE_SIZE, NULL)); > return ret; > } > -- > 2.55.0 >
