Re: [RFC PATCH bpf-next 2/3] kprobes: mark ftrace-based kprobe ops permanent

[Masami Hiramatsu (Google) <mhiramat@kernel.org>]

On Tue, 28 Jul 2026 20:59:58 -0400
Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com> wrote:

> kernel.ftrace_enabled=0 silently kills ftrace-based kprobes/kretprobes
> the same way it does BPF trampolines: arm succeeds, the probe stops
> firing with no error, and re-enabling silently restores it. Unlike
> trampolines this is not a regression -- ftrace-based kprobes have
> never carried this protection, so the bug is long-standing.
> 
> kprobe_ftrace_ops/kprobe_ipmodify_ops are shared only among
> ftrace-based kprobe attachers, not with any other tracer, so the same
> unconditional FTRACE_OPS_FL_PERMANENT livepatch already uses applies
> cleanly here too, with no kernel/trace/ftrace.c changes needed.
> 
> Known limitation: kprobe.multi/kretprobe.multi/kprobe.session
> (fprobe-backed, kernel/trace/fprobe.c) are not covered. Entry-only
> fprobes could take the same fix, but return-capturing fprobes route
> through the function-graph tracer's shared subops manager, which is
> also used by unrelated tracers (function_graph, irqsoff, wakeup
> latency, function profiler) -- marking it permanent would block
> ftrace_enabled=0 for those too. Left for a follow-up.
> 

In the another thread, Steve and you agreed to just remove
ftrace_enabled, so I assume we will drop this patch.
But from the kprobes point of view this seems reasonable change.

Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>


Thank you,

> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-sonnet-5
> Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
> ---
>  kernel/kprobes.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> index bfc89083daa9..5a54511eee79 100644
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -1122,14 +1122,15 @@ static struct kprobe *alloc_aggr_kprobe(struct kprobe *p)
>  #endif /* CONFIG_OPTPROBES */
>  
>  #ifdef CONFIG_KPROBES_ON_FTRACE
> +/* Same protection livepatch gives its own ftrace_ops. */
>  static struct ftrace_ops kprobe_ftrace_ops __read_mostly = {
>  	.func = kprobe_ftrace_handler,
> -	.flags = FTRACE_OPS_FL_SAVE_REGS,
> +	.flags = FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_PERMANENT,
>  };
>  
>  static struct ftrace_ops kprobe_ipmodify_ops __read_mostly = {
>  	.func = kprobe_ftrace_handler,
> -	.flags = FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_IPMODIFY,
> +	.flags = FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_IPMODIFY | FTRACE_OPS_FL_PERMANENT,
>  };
>  
>  static int kprobe_ipmodify_enabled;
> -- 
> 2.34.1
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>