[PATCH] uprobes: avoid postponing return-probe SRCU lease expiration

[PATCH] uprobes: avoid postponing return-probe SRCU lease expiration

[Avi Weiss]

prepare_uretprobe() reprograms the per-task return-instance timer on every
successfully installed return probe. If a traced outer function remains
active while nested traced calls arrive more frequently than the timeout,
the shared timer keeps moving forward and the outer instance can hold its
SRCU read-side lease indefinitely. This delays unrelated synchronous uprobe
unregister operations that must wait for the same SRCU grace period.

Use timer_reduce() to preserve the earliest pending expiry. Pair a full
memory barrier after publishing a return instance with one before the timer
callback traverses the list. A publisher that observes the earlier timer
as pending must then be visible to that callback - otherwise the producer
rearms the expired timer.

In an x86-64 QEMU reproducer with nested traced calls every 10 ms, an
unrelated tracefs event disable took 7,740 ms on the baseline and 70 ms
with the change. A corrected monotonic-clock regression run measured
2,210 ms versus 79 ms, with 15 additional long-lived timer-boundary
cases and process exit/exec checks passing. Narrow LKMM store-buffering
litmus tests observed the lost-rearm outcome without both barriers and
forbade it when both were present.

Fixes: dd1a7567784e ("uprobes: SRCU-protect uretprobe lifetime (with timeout)")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 kernel/events/uprobes.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index caf444762a27..82065863a6c1 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -2052,6 +2052,9 @@ static void ri_timer(struct timer_list *timer)
 	 */
 	raw_write_seqcount_begin(&utask->ri_seqcount);
 
+	/* Pair with prepare_uretprobe() to avoid a missed rearm. */
+	smp_mb();
+
 	for_each_ret_instance_rcu(ri, utask->return_instances)
 		hprobe_expire(&ri->hprobe, false);
 
@@ -2304,7 +2307,9 @@ static void prepare_uretprobe(struct uprobe *uprobe, struct pt_regs *regs,
 	ri->next = utask->return_instances;
 	rcu_assign_pointer(utask->return_instances, ri);
 
-	mod_timer(&utask->ri_timer, jiffies + RI_TIMER_PERIOD);
+	/* Pair with ri_timer() after publishing the instance. */
+	smp_mb();
+	timer_reduce(&utask->ri_timer, jiffies + RI_TIMER_PERIOD);
 
 	return;
 free:

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.53.0

Re: [PATCH] uprobes: avoid postponing return-probe SRCU lease expiration

[sashiko-bot]

> prepare_uretprobe() reprograms the per-task return-instance timer on every
> successfully installed return probe. If a traced outer function remains
> active while nested traced calls arrive more frequently than the timeout,
> the shared timer keeps moving forward and the outer instance can hold its
> SRCU read-side lease indefinitely. This delays unrelated synchronous uprobe
> unregister operations that must wait for the same SRCU grace period.
> 
> Use timer_reduce() to preserve the earliest pending expiry. Pair a full
> memory barrier after publishing a return instance with one before the timer
> callback traverses the list. A publisher that observes the earlier timer
> as pending must then be visible to that callback - otherwise the producer
> rearms the expired timer.
> 
> In an x86-64 QEMU reproducer with nested traced calls every 10 ms, an
> unrelated tracefs event disable took 7,740 ms on the baseline and 70 ms
> with the change. A corrected monotonic-clock regression run measured
> 2,210 ms versus 79 ms, with 15 additional long-lived timer-boundary
> cases and process exit/exec checks passing. Narrow LKMM store-buffering
> litmus tests observed the lost-rearm outcome without both barriers and
> forbade it when both were present.
> 
> Fixes: dd1a7567784e ("uprobes: SRCU-protect uretprobe lifetime (with timeout)")
> Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115155921.260878-1-thnkslprpt@gmail.com?part=1