History

ftrace: Fix removing of second function probe

When two function probes are added to set_ftrace_filter, and then one of them is removed, the update to the function locations is not performed, and the record keeping of the function states are corrupted, and causes an ftrace_bug() to occur. This is easily reproducable by adding two probes, removing one, and then adding it back again. # cd /sys/kernel/debug/tracing # echo schedule:traceoff > set_ftrace_filter # echo do_IRQ:traceoff > set_ftrace_filter # echo \!do_IRQ:traceoff > /debug/tracing/set_ftrace_filter # echo do_IRQ:traceoff > set_ftrace_filter Causes: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 1098 at kernel/trace/ftrace.c:2369 ftrace_get_addr_curr+0x143/0x220 Modules linked in: [...] CPU: 2 PID: 1098 Comm: bash Not tainted 4.10.0-test+ #405 Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v02.05 05/07/2012 Call Trace: dump_stack+0x68/0x9f __warn+0x111/0x130 ? trace_irq_work_interrupt+0xa0/0xa0 warn_slowpath_null+0x1d/0x20 ftrace_get_addr_curr+0x143/0x220 ? __fentry__+0x10/0x10 ftrace_replace_code+0xe3/0x4f0 ? ftrace_int3_handler+0x90/0x90 ? printk+0x99/0xb5 ? 0xffffffff81000000 ftrace_modify_all_code+0x97/0x110 arch_ftrace_update_code+0x10/0x20 ftrace_run_update_code+0x1c/0x60 ftrace_run_modify_code.isra.48.constprop.62+0x8e/0xd0 register_ftrace_function_probe+0x4b6/0x590 ? ftrace_startup+0x310/0x310 ? debug_lockdep_rcu_enabled.part.4+0x1a/0x30 ? update_stack_state+0x88/0x110 ? ftrace_regex_write.isra.43.part.44+0x1d3/0x320 ? preempt_count_sub+0x18/0xd0 ? mutex_lock_nested+0x104/0x800 ? ftrace_regex_write.isra.43.part.44+0x1d3/0x320 ? __unwind_start+0x1c0/0x1c0 ? _mutex_lock_nest_lock+0x800/0x800 ftrace_trace_probe_callback.isra.3+0xc0/0x130 ? func_set_flag+0xe0/0xe0 ? __lock_acquire+0x642/0x1790 ? __might_fault+0x1e/0x20 ? trace_get_user+0x398/0x470 ? strcmp+0x35/0x60 ftrace_trace_onoff_callback+0x48/0x70 ftrace_regex_write.isra.43.part.44+0x251/0x320 ? match_records+0x420/0x420 ftrace_filter_write+0x2b/0x30 __vfs_write+0xd7/0x330 ? do_loop_readv_writev+0x120/0x120 ? locks_remove_posix+0x90/0x2f0 ? do_lock_file_wait+0x160/0x160 ? __lock_is_held+0x93/0x100 ? rcu_read_lock_sched_held+0x5c/0xb0 ? preempt_count_sub+0x18/0xd0 ? __sb_start_write+0x10a/0x230 ? vfs_write+0x222/0x240 vfs_write+0xef/0x240 SyS_write+0xab/0x130 ? SyS_read+0x130/0x130 ? trace_hardirqs_on_caller+0x182/0x280 ? trace_hardirqs_on_thunk+0x1a/0x1c entry_SYSCALL_64_fastpath+0x18/0xad RIP: 0033:0x7fe61c157c30 RSP: 002b:00007ffe87890258 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: ffffffff8114a410 RCX: 00007fe61c157c30 RDX: 0000000000000010 RSI: 000055814798f5e0 RDI: 0000000000000001 RBP: ffff8800c9027f98 R08: 00007fe61c422740 R09: 00007fe61ca53700 R10: 0000000000000073 R11: 0000000000000246 R12: 0000558147a36400 R13: 00007ffe8788f160 R14: 0000000000000024 R15: 00007ffe8788f15c ? trace_hardirqs_off_caller+0xc0/0x110 ---[ end trace 99fa09b3d9869c2c ]--- Bad trampoline accounting at: ffffffff81cc3b00 (do_IRQ+0x0/0x150)

Steven Rostedt (VMware) committed 9 years ago

Commit 82cc4fc1 parent 62277de1 file · +16 −4Browse files

Unified · Split

kernel/trace/ftrace.c+16−4
@@ -3755,23 +3755,24 @@ static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash) · 3754 unmodified lines
37553755 ftrace_probe_registered = 1;
37563756 }
37573757
3758−static void __disable_ftrace_function_probe(void)
3758+static bool __disable_ftrace_function_probe(void)
37593759 {
37603760 int i;
37613761
37623762 if (!ftrace_probe_registered)
3763− return;
3763+ return false;
37643764
37653765 for (i = 0; i < FTRACE_FUNC_HASHSIZE; i++) {
37663766 struct hlist_head *hhd = &ftrace_func_hash[i];
37673767 if (hhd->first)
3768− return;
3768+ return false;
37693769 }
37703770
37713771 /* no more funcs left */
37723772 ftrace_shutdown(&trace_probe_ops, 0);
37733773
37743774 ftrace_probe_registered = 0;
3775+ return true;
37753776 }
37763777
37773778
@@ -3901,6 +3902,7 @@ static void · 123 unmodified lines
39013902 __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
39023903 void *data, int flags)
39033904 {
3905+ struct ftrace_ops_hash old_hash_ops;
39043906 struct ftrace_func_entry *rec_entry;
39053907 struct ftrace_func_probe *entry;
39063908 struct ftrace_func_probe *p;
@@ -3912,6 +3914,7 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, · 5 unmodified lines
39123914 struct hlist_node *tmp;
39133915 char str[KSYM_SYMBOL_LEN];
39143916 int i, ret;
3917+ bool disabled;
39153918
39163919 if (glob && (strcmp(glob, "*") == 0 || !strlen(glob)))
39173920 func_g.search = NULL;
@@ -3930,6 +3933,10 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, · 12 unmodified lines
39303933
39313934 mutex_lock(&trace_probe_ops.func_hash->regex_lock);
39323935
3936+ old_hash_ops.filter_hash = old_hash;
3937+ /* Probes only have filters */
3938+ old_hash_ops.notrace_hash = NULL;
3939+
39333940 hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, *orig_hash);
39343941 if (!hash)
39353942 /* Hmm, should report this somehow */
@@ -3967,12 +3974,17 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, · 31 unmodified lines
39673974 }
39683975 }
39693976 mutex_lock(&ftrace_lock);
3970− __disable_ftrace_function_probe();
3977+ disabled = __disable_ftrace_function_probe();
39713978 /*
39723979 * Remove after the disable is called. Otherwise, if the last
39733980 * probe is removed, a null hash means *all enabled*.
39743981 */
39753982 ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash);
3983+
3984+ /* still need to update the function call sites */
3985+ if (ftrace_enabled && !disabled)
3986+ ftrace_run_modify_code(&trace_probe_ops, FTRACE_UPDATE_CALLS,
3987+ &old_hash_ops);
39763988 synchronize_sched();
39773989 if (!ret)
39783990 free_ftrace_hash_rcu(old_hash);