From: Christian Brauner <brauner@kernel.org>
To: Amir Goldstein <amir73il@gmail.com>, linux-fsdevel@vger.kernel.org
Cc: Chris Down <chris@chrisdown.name>,
Miklos Szeredi <mszeredi@redhat.com>,
linux-unionfs@vger.kernel.org, linux-kernel@vger.kernel.org,
bpf@vger.kernel.org, linux-trace-kernel@vger.kernel.org,
linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org, linux-mm@kvack.org,
"Christian Brauner (Amutable)" <brauner@kernel.org>
Subject: [PATCH 03/13] tracing/uprobes: handle errors from resolving the real inode
Date: Sun, 15 Nov 2026 15:01:33 +0100 [thread overview]
Message-ID: <20261115-work-ovl-d_real-v1-3-ca155efbcb2e@kernel.org> (raw)
In-Reply-To: <20261115-work-ovl-d_real-v1-0-ca155efbcb2e@kernel.org>
d_real() is about to be able to fail for D_REAL_DATA. So switch
trace_uprobe from d_real_inode() to d_real_data_inode() and deal with
the error.
Currently, nothing checks whether the data can be resolved when a uprobe
is created. The first resolution happens in validate_ref_ctr_offset()
under event_mutex and the last one when the event is enabled. If the
data of a metacopy file in an overlayfs data-only layer can't be found
the event is created just fine and enabling it fails later with an -EIO
from uprobe_register() because the overlayfs inode has no
->read_folio().
Instead, resolve the inode hosting the data once in
__trace_uprobe_create() right after kern_path(). That happens outside
of event_mutex and if it fails the write to uprobe_events or
dynamic_events fails with the actual error and a new NO_FILE_DATA entry
in the error log. The resolved inode is passed down to
validate_ref_ctr_offset() and trace_uprobe_has_same_uprobe() so we don't
resolve it again under event_mutex.
Both functions still resolve the existing probes they compare against.
If that fails the existing probe can't be on the same inode so we just
skip it. For validate_ref_ctr_offset() that's fine because
uprobe_register() refuses a mismatching reference counter offset for the
same uprobe anyway.
trace_uprobe_enable() returns the error and probe_event_enable()
already unwinds the probes that were enabled before.
While at it, resolve the data in create_local_trace_uprobe() as well.
perf_event_open() of a uprobe PMU event registers the probe right away
so it would fail in trace_uprobe_enable() anyway. But this way the first
resolution happens before perf_uprobe_init() takes event_mutex just like
for uprobes created through tracefs.
This is a no-op until d_real() can actually fail.
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
kernel/trace/trace_probe.h | 1 +
kernel/trace/trace_uprobe.c | 57 ++++++++++++++++++++++++++++++++++-----------
2 files changed, 45 insertions(+), 13 deletions(-)
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index d1fb3520700fb..91bf3a66d834a 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -610,6 +610,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
C(NO_EVENT_FIELD, "This event field is not found."), \
C(NO_EVENT_INFO, "This requires both group and event name to attach"), \
C(NO_EVENT_NAME, "Event name is not specified"), \
+ C(NO_FILE_DATA, "Failed to resolve the data of the given file"), \
C(NO_GROUP_NAME, "Group name is not specified"), \
C(NO_PTR_STRCT, "This is not a pointer to union/structure."), \
C(NO_REGULAR_FILE, "Not a regular file"), \
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 22cc3c8181b86..34cd4392decfd 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -415,14 +415,15 @@ static int unregister_trace_uprobe(struct trace_uprobe *tu)
}
static bool trace_uprobe_has_same_uprobe(struct trace_uprobe *orig,
- struct trace_uprobe *comp)
+ struct trace_uprobe *comp,
+ struct inode *comp_inode)
{
struct trace_probe_event *tpe = orig->tp.event;
- struct inode *comp_inode = d_real_inode(comp->path.dentry);
int i;
list_for_each_entry(orig, &tpe->probes, tp.list) {
- if (comp_inode != d_real_inode(orig->path.dentry) ||
+ /* If @orig's data can't be resolved it can't be the same. */
+ if (comp_inode != d_real_data_inode(orig->path.dentry) ||
comp->offset != orig->offset)
continue;
@@ -443,7 +444,8 @@ static bool trace_uprobe_has_same_uprobe(struct trace_uprobe *orig,
return false;
}
-static int append_trace_uprobe(struct trace_uprobe *tu, struct trace_uprobe *to)
+static int append_trace_uprobe(struct trace_uprobe *tu, struct trace_uprobe *to,
+ struct inode *inode)
{
int ret;
@@ -454,7 +456,7 @@ static int append_trace_uprobe(struct trace_uprobe *tu, struct trace_uprobe *to)
trace_probe_log_err(0, DIFF_ARG_TYPE);
return -EEXIST;
}
- if (trace_uprobe_has_same_uprobe(to, tu)) {
+ if (trace_uprobe_has_same_uprobe(to, tu, inode)) {
trace_probe_log_set_index(0);
trace_probe_log_err(0, SAME_PROBE);
return -EEXIST;
@@ -477,14 +479,19 @@ static int append_trace_uprobe(struct trace_uprobe *tu, struct trace_uprobe *to)
* as the new one does not conflict with any other existing
* ones.
*/
-static int validate_ref_ctr_offset(struct trace_uprobe *new)
+static int validate_ref_ctr_offset(struct trace_uprobe *new,
+ struct inode *new_inode)
{
struct dyn_event *pos;
struct trace_uprobe *tmp;
- struct inode *new_inode = d_real_inode(new->path.dentry);
for_each_trace_uprobe(tmp, pos) {
- if (new_inode == d_real_inode(tmp->path.dentry) &&
+ /*
+ * If @tmp's data can't be resolved it isn't on @new_inode.
+ * uprobe_register() still refuses a mismatching reference
+ * counter offset for the same uprobe.
+ */
+ if (new_inode == d_real_data_inode(tmp->path.dentry) &&
new->offset == tmp->offset &&
new->ref_ctr_offset != tmp->ref_ctr_offset) {
pr_warn("Reference counter offset mismatch.");
@@ -495,14 +502,14 @@ static int validate_ref_ctr_offset(struct trace_uprobe *new)
}
/* Register a trace_uprobe and probe_event */
-static int register_trace_uprobe(struct trace_uprobe *tu)
+static int register_trace_uprobe(struct trace_uprobe *tu, struct inode *inode)
{
struct trace_uprobe *old_tu;
int ret;
guard(mutex)(&event_mutex);
- ret = validate_ref_ctr_offset(tu);
+ ret = validate_ref_ctr_offset(tu, inode);
if (ret)
return ret;
@@ -515,7 +522,7 @@ static int register_trace_uprobe(struct trace_uprobe *tu)
trace_probe_log_err(0, DIFF_PROBE_TYPE);
return -EEXIST;
}
- return append_trace_uprobe(tu, old_tu);
+ return append_trace_uprobe(tu, old_tu, inode);
}
ret = register_uprobe_event(tu);
@@ -553,6 +560,7 @@ static int __trace_uprobe_create(int argc, const char **argv)
char *buf __free(kfree) = NULL;
enum probe_print_type ptype;
bool is_return = false;
+ struct inode *inode;
int i, ret;
ref_ctr_offset = 0;
@@ -606,6 +614,17 @@ static int __trace_uprobe_create(int argc, const char **argv)
return -EINVAL;
}
+ /*
+ * Resolve the inode hosting the data now and outside of event_mutex.
+ * If that fails the probe is useless and the user should know right
+ * away instead of when the event is enabled.
+ */
+ inode = d_real_data_inode(path.dentry);
+ if (IS_ERR(inode)) {
+ trace_probe_log_err(0, NO_FILE_DATA);
+ return PTR_ERR(inode);
+ }
+
/* Parse reference counter offset if specified. */
rctr = strchr(arg, '(');
if (rctr) {
@@ -717,7 +736,7 @@ static int __trace_uprobe_create(int argc, const char **argv)
if (ret < 0)
return ret;
- ret = register_trace_uprobe(tu);
+ ret = register_trace_uprobe(tu, inode);
if (!ret)
tu = NULL;
@@ -1105,9 +1124,13 @@ typedef bool (*filter_func_t)(struct uprobe_consumer *self, struct mm_struct *mm
static int trace_uprobe_enable(struct trace_uprobe *tu, filter_func_t filter)
{
- struct inode *inode = d_real_inode(tu->path.dentry);
+ struct inode *inode;
struct uprobe *uprobe;
+ inode = d_real_data_inode(tu->path.dentry);
+ if (IS_ERR(inode))
+ return PTR_ERR(inode);
+
tu->consumer.filter = filter;
uprobe = uprobe_register(inode, tu->offset, tu->ref_ctr_offset, &tu->consumer);
if (IS_ERR(uprobe))
@@ -1630,6 +1653,7 @@ create_local_trace_uprobe(char *name, unsigned long offs,
{
enum probe_print_type ptype;
struct trace_uprobe *tu;
+ struct inode *inode;
struct path path;
int ret;
@@ -1642,6 +1666,13 @@ create_local_trace_uprobe(char *name, unsigned long offs,
return ERR_PTR(-EINVAL);
}
+ /* Fail early if the data of the file can't be resolved. */
+ inode = d_real_data_inode(path.dentry);
+ if (IS_ERR(inode)) {
+ path_put(&path);
+ return ERR_CAST(inode);
+ }
+
/*
* local trace_kprobes are not added to dyn_event, so they are never
* searched in find_trace_kprobe(). Therefore, there is no concern of
--
2.53.0
next prev parent reply other threads:[~2026-11-15 14:02 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-15 14:01 [PATCH 00/13] fs: let d_real() fail Christian Brauner
2026-11-15 14:01 ` [PATCH 01/13] ovl: don't warn when the lazy lowerdata lookup fails in ovl_d_real() Christian Brauner
2026-11-15 14:54 ` Amir Goldstein
2026-11-15 14:01 ` [PATCH 02/13] fs: add d_real_data_inode() and d_real_metadata_inode() Christian Brauner
2026-11-15 15:00 ` Amir Goldstein
2026-11-15 14:01 ` Christian Brauner [this message]
2026-11-15 14:01 ` [PATCH 04/13] bpf: handle errors from resolving the real inode in uprobe_multi Christian Brauner
2026-11-15 14:01 ` [PATCH 05/13] selftests/bpf: handle d_real_data_inode() errors in bpf_testmod Christian Brauner
2026-11-15 14:01 ` [PATCH 06/13] ima: handle errors from resolving the real inode Christian Brauner
2026-11-15 14:01 ` [PATCH 07/13] ima,evm: use d_real_metadata_inode() Christian Brauner
2026-11-15 14:01 ` [PATCH 08/13] ipe: handle errors from resolving the real inode Christian Brauner
2026-11-15 14:37 ` bot+bpf-ci
2026-11-15 14:01 ` [PATCH 09/13] bpf: return NULL from bpf_real_data_inode() on errors Christian Brauner
2026-11-15 14:01 ` [PATCH 10/13] ovl: return the error from the lazy lowerdata lookup in ovl_d_real() Christian Brauner
2026-11-15 14:47 ` Amir Goldstein
2026-11-15 14:01 ` [PATCH 11/13] fs: remove d_real_inode() Christian Brauner
2026-11-15 14:48 ` Amir Goldstein
2026-11-15 14:01 ` [PATCH 12/13] selftests/ftrace: add uprobe tests on overlayfs Christian Brauner
2026-11-15 14:18 ` sashiko-bot
2026-11-15 14:01 ` [PATCH 13/13] selftests/bpf: add uprobe_multi test on overlayfs without data Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261115-work-ovl-d_real-v1-3-ca155efbcb2e@kernel.org \
--to=brauner@kernel.org \
--cc=amir73il@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=chris@chrisdown.name \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=linux-unionfs@vger.kernel.org \
--cc=mszeredi@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox