Re: [RFC PATCH v2 04/11] ptwrite uprobes: Add support to tracing infrastructure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] trace: AA deadlock on event_mutex in trace_uprobe_enable()
--

commit 18294b1032dd2887acf440ab9d7029011a171000
Author: Andi Kleen <ak@kernel.org>

ptwrite uprobes: Add support to tracing infrastructure

This commit hooks up the low-level x86 ptwrite uprobes code to the generic
trace uprobes events parser. It introduces a new ptw: syntax to set up
trap-free ptwrite uprobes and handles architectures without the backend via
weak stubs.

> diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
> --- a/kernel/trace/trace_uprobe.c
> +++ b/kernel/trace/trace_uprobe.c
[ ... ]
> @@ -1107,9 +1241,26 @@ static int trace_uprobe_enable(struct trace_uprobe *tu, filter_func_t filter)
>  {
>  	struct inode *inode = d_real_inode(tu->path.dentry);
>  	struct uprobe *uprobe;
> +	struct file *file;
>  
> -	tu->consumer.filter = filter;
> -	uprobe = uprobe_register(inode, tu->offset, tu->ref_ctr_offset, &tu->consumer);
> +	if (tu->is_ptwrite) {
> +		if (filter) {
> +			/* PTWRITE probes have no kernel entry to evaluate a filter. */
> +			return -EINVAL;
> +		}
> +		file = dentry_open(&tu->path, O_RDONLY, current_cred());

[Severity: High]
Can this dentry_open() call cause an AA deadlock on event_mutex?

If a user creates a ptwrite uprobe targeting a tracefs file (like
events/sched/sched_switch/enable) and then writes 1 to the uprobe's enable
file, event_enable_write() acquires event_mutex before calling
trace_uprobe_enable().

When dentry_open() is called synchronously on that tracefs path, its
f_op->open (e.g. tracing_open_file_tr()) will attempt to acquire event_mutex
again, leading to a system hang.

> +		if (IS_ERR(file))
> +			return PTR_ERR(file);
> +		tu->ptwrite_desc.event_id =
> +			trace_probe_event_call(&tu->tp)->event.type;
> +		uprobe = uprobe_register_ptwrite(inode, file, tu->offset,
> +						 &tu->consumer, &tu->ptwrite_desc);
> +		fput(file);
> +	} else {
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917230127.924985-2-ak@kernel.org?part=4