Skip to content
  • Jim Keniston's avatar
    [PATCH] kprobes: Fix return probes on sys_execve · 8bf1101b
    Jim Keniston authored
    
    
    Fix a bug in kprobes that can cause an Oops or even a crash when a return
    probe is installed on one of the following functions: sys_execve,
    do_execve, load_*_binary, flush_old_exec, or flush_thread.  The fix is to
    remove the call to kprobe_flush_task() in flush_thread().  This fix has
    been tested on all architectures for which the return-probes feature has
    been implemented (i386, x86_64, ppc64, ia64).  Please apply.
    
    BACKGROUND
    
    Up to now, we have called kprobe_flush_task() under two situations: when a
    task exits, and when it execs.  Flushing kretprobe_instances on exit is
    correct because (a) do_exit() doesn't return, and (b) one or more
    return-probed functions may be active when a task calls do_exit().  Neither
    is the case for sys_execve() and its callees.
    
    Initially, the mistaken call to kprobe_flush_task() on exec was harmless
    because we put the "real" return address of each active probed function
    back in the stack, just to be safe, when we recycled its
    kretprobe_instance.  When support for ppc64 and ia64 was added, this safety
    measure couldn't be employed, and was eventually dropped even for i386 and
    x86_64.  sys_execve() and its callees were informally blacklisted for
    return probes until this fix was developed.
    
    Acked-by: default avatarPrasanna S Panchamukhi <prasanna@in.ibm.com>
    Signed-off-by: default avatarJim Keniston <jkenisto@us.ibm.com>
    Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    8bf1101b