kretprobes / activeness safety incompatibility #67
Description
This is from an email discussion with @mhiramat.
kretprobes removes the target function's caller from the stack, which means that the kpatch activeness safety check could fail to detect a function on the stack of a process.
I added a dump_stack() call to meminfo_proc_show. Here's the normal
case with no ftrace or kprobes:
[ 24.903293] [<ffffffff8168731c>] dump_stack+0x45/0x56
[ 24.903297] [<ffffffff81228585>] meminfo_proc_show+0x25/0x530
[ 24.903334] [<ffffffff811db90a>] seq_read+0x14a/0x390
[ 24.903338] [<ffffffff8121fa9d>] proc_reg_read+0x3d/0x80
[ 24.903340] [<ffffffff811b89b5>] vfs_read+0x95/0x160
[ 24.903342] [<ffffffff811b94c9>] SyS_read+0x49/0xa0
[ 24.903347] [<ffffffff816962e9>] system_call_fastpath+0x16/0x1b
Here it is with function_graph tracing enabled. Notice that seq_read is
still on the stack:
[ 92.606903] [<ffffffff8168731c>] dump_stack+0x45/0x56
[ 92.606907] [<ffffffff81228585>] meminfo_proc_show+0x25/0x530
[ 92.606945] [<ffffffff81696185>] ftrace_graph_caller+0x85/0x85
[ 92.606946] [<ffffffff811db90a>] seq_read+0x14a/0x390
[ 92.606952] [<ffffffff8121fa9d>] proc_reg_read+0x3d/0x80
[ 92.606955] [<ffffffff811b89b5>] vfs_read+0x95/0x160
[ 92.606957] [<ffffffff811b94c9>] SyS_read+0x49/0xa0
[ 92.606959] [<ffffffff816962e9>] system_call_fastpath+0x16/0x1b
And here it is with a kretprobe enabled. Now seq_read is no longer on
the stack, as it has been replaced with kretprobe_trampoline_holder:
[ 45.427144] [<ffffffff8168731c>] dump_stack+0x45/0x56
[ 45.427148] [<ffffffff81228585>] meminfo_proc_show+0x25/0x530
[ 45.427185] [<ffffffff81690269>] kretprobe_trampoline_holder+0x9/0x9
[ 45.427191] [<ffffffff8121fa9d>] proc_reg_read+0x3d/0x80
[ 45.427194] [<ffffffff811b89b5>] vfs_read+0x95/0x160
[ 45.427196] [<ffffffff811b94c9>] SyS_read+0x49/0xa0
[ 45.427199] [<ffffffff816962e9>] system_call_fastpath+0x16/0x1b
Some options:
- kretprobes somehow leaves seq_read on the stack
- kpatch can check for the presence of kretprobe_trampoline_holder on all the backtraces. Downside is that it could create a lot of false positive failures.
- kpatch uses a (new?) kprobe interface to detect any kretprobes on the target function.