* Re: [PATCH 00/61] vfs: change inode->i_ino from unsigned long to u64
From: Jeff Layton @ 2026-02-27 17:19 UTC (permalink / raw)
To: Matthew Wilcox
Cc: Alexander Viro, Christian Brauner, Jan Kara, Steven Rostedt,
Masami Hiramatsu, Mathieu Desnoyers, Dan Williams, Eric Biggers,
Theodore Y. Ts'o, Muchun Song, Oscar Salvador,
David Hildenbrand, David Howells, Paulo Alcantara, Andreas Dilger,
Jan Kara, Jaegeuk Kim, Chao Yu, Trond Myklebust, Anna Schumaker,
Chuck Lever, NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey,
Steve French, Ronnie Sahlberg, Shyam Prasad N, Bharath SM,
Alexander Aring, Ryusuke Konishi, Viacheslav Dubeyko,
Eric Van Hensbergen, Latchesar Ionkov, Dominique Martinet,
Christian Schoenebeck, David Sterba, Marc Dionne, Ian Kent,
Luis de Bethencourt, Salah Triki, Tigran A. Aivazian,
Ilya Dryomov, Alex Markuze, Jan Harkes, coda, Nicolas Pitre,
Tyler Hicks, Amir Goldstein, Christoph Hellwig,
John Paul Adrian Glaubitz, Yangtao Li, Mikulas Patocka,
David Woodhouse, Richard Weinberger, Dave Kleikamp,
Konstantin Komarov, Mark Fasheh, Joel Becker, Joseph Qi,
Mike Marshall, Martin Brandenburg, Miklos Szeredi, Anders Larsen,
Zhihao Cheng, Damien Le Moal, Naohiro Aota, Johannes Thumshirn,
John Johansen, Paul Moore, James Morris, Serge E. Hallyn,
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Fan Wu,
Stephen Smalley, Ondrej Mosnacek, Casey Schaufler, Alex Deucher,
Christian König, David Airlie, Simona Vetter, Sumit Semwal,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
David S. Miller, Jakub Kicinski, Simon Horman, Oleg Nesterov,
Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, Darrick J. Wong,
Martin Schiller, linux-fsdevel, linux-kernel, linux-trace-kernel,
nvdimm, fsverity, linux-mm, netfs, linux-ext4, linux-f2fs-devel,
linux-nfs, linux-cifs, samba-technical, linux-nilfs, v9fs,
linux-afs, autofs, ceph-devel, codalist, ecryptfs, linux-mtd,
jfs-discussion, ntfs3, ocfs2-devel, devel, linux-unionfs,
apparmor, linux-security-module, linux-integrity, selinux,
amd-gfx, dri-devel, linux-media, linaro-mm-sig, netdev,
linux-perf-users, linux-fscrypt, linux-xfs, linux-hams, linux-x25
In-Reply-To: <aaB5lgKd8FOIizPg@casper.infradead.org>
On Thu, 2026-02-26 at 16:49 +0000, Matthew Wilcox wrote:
> On Thu, Feb 26, 2026 at 10:55:02AM -0500, Jeff Layton wrote:
> > The bulk of the changes are to format strings and tracepoints, since the
> > kernel itself doesn't care that much about the i_ino field. The first
> > patch changes some vfs function arguments, so check that one out
> > carefully.
>
> Why are the format strings all done as separate patches? Don't we get
> bisection hazards by splitting it apart this way?
Circling back to this...
I have a v2 series (~107 patches) that I'm testing now that does this
more bisectably with the typedef and macro scaffolding that Mathieu
suggested. I'll probably send it early next week.
I had done it this way originally since I figured it was best to break
this up by subsystem. Should I continue with this series as a set of
patches broken up this way, or is it preferable to combine the pile of
format changes into fewer patches?
--
Jeff Layton <jlayton@kernel.org>
^ permalink raw reply
* Re: [PATCHv6 bpf-next 9/9] bpf,x86: Use single ftrace_ops for direct calls
From: Ihor Solodrai @ 2026-02-27 17:40 UTC (permalink / raw)
To: Jiri Olsa, Steven Rostedt, Florent Revest, Mark Rutland
Cc: bpf, linux-kernel, linux-trace-kernel, linux-arm-kernel,
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
Menglong Dong, Song Liu, Kumar Kartikeya Dwivedi
In-Reply-To: <20251230145010.103439-10-jolsa@kernel.org>
On 12/30/25 6:50 AM, Jiri Olsa wrote:
> Using single ftrace_ops for direct calls update instead of allocating
> ftrace_ops object for each trampoline.
>
> With single ftrace_ops object we can use update_ftrace_direct_* api
> that allows multiple ip sites updates on single ftrace_ops object.
>
> Adding HAVE_SINGLE_FTRACE_DIRECT_OPS config option to be enabled on
> each arch that supports this.
>
> At the moment we can enable this only on x86 arch, because arm relies
> on ftrace_ops object representing just single trampoline image (stored
> in ftrace_ops::direct_call). Archs that do not support this will continue
> to use *_ftrace_direct api.
>
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Hi Jiri,
Me and Kumar stumbled on kernel splats with "ftrace failed to modify",
and if running with KASAN:
BUG: KASAN: slab-use-after-free in __get_valid_kprobe+0x224/0x2a0
Pasting a full splat example at the bottom.
I was able to create a reproducer with AI, and then used it to bisect
to this patch. You can run it with ./test_progs -t ftrace_direct_race
Below is my (human-generated, haha) summary of AI's analysis of what's
happening. It makes sense to me conceptually, but I don't know enough
details here to call bullshit. Please take a look:
With CONFIG_HAVE_SINGLE_FTRACE_DIRECT_OPS ftrace_replace_code()
operates on all call sites in the shared ops. Then if a concurrent
ftrace user (like kprobe) modifies a call site in between
ftrace_replace_code's verify pass and its patch pass, then ftrace_bug
fires and sets ftrace_disabled to 1.
Once ftrace is disabled, direct_ops_del silently fails to unregister
the direct call, and the call site still redirects to the stale
trampoline. After the BPF program is freed, we'll get use-after-free
on the next trace hit.
The reproducer is not great, because if everything is fine it just hangs.
But with the bug the kernel crashes pretty fast.
Maybe it makes sense to refine it to a proper "stress" selftest?
Reproducer patch:
From c595ef5a0ad9bc62d768080ff09502bc982c40e6 Mon Sep 17 00:00:00 2001
From: Ihor Solodrai <ihor.solodrai@linux.dev>
Date: Thu, 26 Feb 2026 17:00:39 -0800
Subject: [PATCH] reproducer
---
.../bpf/prog_tests/ftrace_direct_race.c | 243 ++++++++++++++++++
1 file changed, 243 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/ftrace_direct_race.c
diff --git a/tools/testing/selftests/bpf/prog_tests/ftrace_direct_race.c b/tools/testing/selftests/bpf/prog_tests/ftrace_direct_race.c
new file mode 100644
index 000000000000..369c55364d05
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/ftrace_direct_race.c
@@ -0,0 +1,243 @@
+// SPDX-License-Identifier: GPL-2.0
+/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
+
+/* Test to reproduce ftrace race between BPF trampoline attach/detach
+ * and kprobe attach/detach on the same function.
+ *
+ * With CONFIG_HAVE_SINGLE_FTRACE_DIRECT_OPS, all BPF trampolines share
+ * a single ftrace_ops. Concurrent modifications (BPF trampoline vs kprobe)
+ * can race in ftrace_replace_code's verify-then-patch sequence, causing
+ * ftrace to become permanently disabled and leaving stale trampolines
+ * that reference freed BPF programs.
+ *
+ * Run with: ./test_progs -t ftrace_direct_race
+ */
+#include <test_progs.h>
+#include <bpf/libbpf.h>
+#include <pthread.h>
+#include <sys/ioctl.h>
+#include <linux/perf_event.h>
+#include <sys/syscall.h>
+
+#include "fentry_test.lskel.h"
+
+#define NUM_ITERATIONS 200
+
+static volatile bool stop;
+
+/* Thread 1: Rapidly attach and detach fentry BPF trampolines */
+static void *fentry_thread_fn(void *arg)
+{
+ int i;
+
+ for (i = 0; i < NUM_ITERATIONS && !stop; i++) {
+ struct fentry_test_lskel *skel;
+ int err;
+
+ skel = fentry_test_lskel__open();
+ if (!skel)
+ continue;
+
+ skel->keyring_id = KEY_SPEC_SESSION_KEYRING;
+ err = fentry_test_lskel__load(skel);
+ if (err) {
+ fentry_test_lskel__destroy(skel);
+ continue;
+ }
+
+ err = fentry_test_lskel__attach(skel);
+ if (err) {
+ fentry_test_lskel__destroy(skel);
+ continue;
+ }
+
+ /* Brief sleep to let the trampoline be live while kprobes race */
+ usleep(100 + rand() % 500);
+
+ fentry_test_lskel__detach(skel);
+ fentry_test_lskel__destroy(skel);
+ }
+
+ return NULL;
+}
+
+/* Thread 2: Rapidly create and destroy kprobes via tracefs on
+ * bpf_fentry_test* functions (the same functions the fentry thread targets).
+ * Creating/removing kprobe events goes through the ftrace code patching
+ * path that can race with BPF trampoline direct call operations.
+ */
+static void *kprobe_thread_fn(void *arg)
+{
+ const char *funcs[] = {
+ "bpf_fentry_test1",
+ "bpf_fentry_test2",
+ "bpf_fentry_test3",
+ "bpf_fentry_test4",
+ "bpf_fentry_test5",
+ "bpf_fentry_test6",
+ };
+ int i;
+
+ for (i = 0; i < NUM_ITERATIONS && !stop; i++) {
+ int j;
+
+ for (j = 0; j < 6 && !stop; j++) {
+ char cmd[256];
+
+ /* Create kprobe via tracefs */
+ snprintf(cmd, sizeof(cmd),
+ "echo 'p:kprobe_race_%d %s' >> /sys/kernel/debug/tracing/kprobe_events 2>/dev/null",
+ j, funcs[j]);
+ system(cmd);
+
+ /* Small delay */
+ usleep(50 + rand() % 200);
+
+ /* Remove kprobe */
+ snprintf(cmd, sizeof(cmd),
+ "echo '-:kprobe_race_%d' >> /sys/kernel/debug/tracing/kprobe_events 2>/dev/null",
+ j);
+ system(cmd);
+ }
+ }
+
+ return NULL;
+}
+
+/* Thread 3: Create kprobes via perf_event_open (the ftrace-based kind)
+ * which go through the arm_kprobe / disarm_kprobe ftrace path.
+ */
+static void *perf_kprobe_thread_fn(void *arg)
+{
+ const char *funcs[] = {
+ "bpf_fentry_test1",
+ "bpf_fentry_test2",
+ "bpf_fentry_test3",
+ };
+ int i;
+
+ for (i = 0; i < NUM_ITERATIONS && !stop; i++) {
+ int fds[3] = {-1, -1, -1};
+ int j;
+
+ for (j = 0; j < 3 && !stop; j++) {
+ struct perf_event_attr attr = {};
+ char path[256];
+ char buf[32];
+ char cmd[256];
+ int id_fd, id;
+
+ /* Create kprobe event */
+ snprintf(cmd, sizeof(cmd),
+ "echo 'p:perf_race_%d %s' >> /sys/kernel/debug/tracing/kprobe_events 2>/dev/null",
+ j, funcs[j]);
+ system(cmd);
+
+ /* Try to get the event id */
+ snprintf(path, sizeof(path),
+ "/sys/kernel/debug/tracing/events/kprobes/perf_race_%d/id", j);
+ id_fd = open(path, O_RDONLY);
+ if (id_fd < 0)
+ continue;
+
+ memset(buf, 0, sizeof(buf));
+ if (read(id_fd, buf, sizeof(buf) - 1) > 0)
+ id = atoi(buf);
+ else
+ id = -1;
+ close(id_fd);
+
+ if (id < 0)
+ continue;
+
+ /* Open perf event to arm the kprobe via ftrace */
+ attr.type = PERF_TYPE_TRACEPOINT;
+ attr.size = sizeof(attr);
+ attr.config = id;
+ attr.sample_type = PERF_SAMPLE_RAW;
+ attr.sample_period = 1;
+ attr.wakeup_events = 1;
+
+ fds[j] = syscall(__NR_perf_event_open, &attr, -1, 0, -1, 0);
+ if (fds[j] >= 0)
+ ioctl(fds[j], PERF_EVENT_IOC_ENABLE, 0);
+ }
+
+ usleep(100 + rand() % 300);
+
+ /* Close perf events (disarms kprobes via ftrace) */
+ for (j = 0; j < 3; j++) {
+ char cmd[256];
+
+ if (fds[j] >= 0)
+ close(fds[j]);
+
+ snprintf(cmd, sizeof(cmd),
+ "echo '-:perf_race_%d' >> /sys/kernel/debug/tracing/kprobe_events 2>/dev/null",
+ j);
+ system(cmd);
+ }
+ }
+
+ return NULL;
+}
+
+void test_ftrace_direct_race(void)
+{
+ pthread_t fentry_tid, kprobe_tid, perf_kprobe_tid;
+ int err;
+
+ /* Check if ftrace is currently operational */
+ if (!ASSERT_OK(access("/sys/kernel/debug/tracing/kprobe_events", W_OK),
+ "tracefs_access"))
+ return;
+
+ stop = false;
+
+ err = pthread_create(&fentry_tid, NULL, fentry_thread_fn, NULL);
+ if (!ASSERT_OK(err, "create_fentry_thread"))
+ return;
+
+ err = pthread_create(&kprobe_tid, NULL, kprobe_thread_fn, NULL);
+ if (!ASSERT_OK(err, "create_kprobe_thread")) {
+ stop = true;
+ pthread_join(fentry_tid, NULL);
+ return;
+ }
+
+ err = pthread_create(&perf_kprobe_tid, NULL, perf_kprobe_thread_fn, NULL);
+ if (!ASSERT_OK(err, "create_perf_kprobe_thread")) {
+ stop = true;
+ pthread_join(fentry_tid, NULL);
+ pthread_join(kprobe_tid, NULL);
+ return;
+ }
+
+ pthread_join(fentry_tid, NULL);
+ pthread_join(kprobe_tid, NULL);
+ pthread_join(perf_kprobe_tid, NULL);
+
+ /* If we get here without a kernel panic/oops, the test passed.
+ * The real check is in dmesg: look for
+ * "WARNING: arch/x86/kernel/ftrace.c" or
+ * "BUG: KASAN: vmalloc-out-of-bounds in __bpf_prog_enter_recur"
+ *
+ * A more robust check: verify ftrace is still operational.
+ */
+ ASSERT_OK(access("/sys/kernel/debug/tracing/kprobe_events", W_OK),
+ "ftrace_still_operational");
+
+ /* Check that ftrace wasn't disabled */
+ {
+ char buf[64] = {};
+ int fd = open("/proc/sys/kernel/ftrace_enabled", O_RDONLY);
+
+ if (ASSERT_GE(fd, 0, "open_ftrace_enabled")) {
+ int n = read(fd, buf, sizeof(buf) - 1);
+
+ close(fd);
+ if (n > 0)
+ ASSERT_EQ(atoi(buf), 1, "ftrace_enabled");
+ }
+ }
+}
--
2.47.3
----
Splat:
[ 24.170803] ------------[ cut here ]------------
[ 24.171055] WARNING: kernel/trace/ftrace.c:2715 at ftrace_get_addr_curr+0x149/0x190, CPU#13: kworker/13:6/873
[ 24.171315] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
[ 24.171561] CPU: 13 UID: 0 PID: 873 Comm: kworker/13:6 Tainted: G OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
[ 24.171827] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 24.171941] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
[ 24.172132] Workqueue: events bpf_link_put_deferred
[ 24.172261] RIP: 0010:ftrace_get_addr_curr+0x149/0x190
[ 24.172376] Code: 00 4c 89 f7 e8 88 f8 ff ff 84 c0 75 92 4d 8b 7f 08 e8 fb b3 c1 00 4d 85 ff 0f 94 c0 49 81 ff b0 1c 6e 83 0f 94 c1 08 c1 74 96 <0f> 0b c6 05
62 e8 2b 02 01 c7 05 54 e8 2b 02 00 00 00 00 48 c7 05
[ 24.172745] RSP: 0018:ffa0000504cafb78 EFLAGS: 00010202
[ 24.172861] RAX: 0000000000000000 RBX: ff110001000e48d0 RCX: ff1100011cd3a201
[ 24.173034] RDX: 6e21cb51d943709c RSI: 0000000000000000 RDI: ffffffff81d416d4
[ 24.173194] RBP: 0000000000000001 R08: 0000000080000000 R09: ffffffffffffffff
[ 24.173366] R10: ffffffff81285522 R11: 0000000000000000 R12: ff110001000e48d0
[ 24.173530] R13: ffffffff81d416d4 R14: ffffffff81d416d4 R15: ffffffff836e1cb0
[ 24.173691] FS: 0000000000000000(0000) GS:ff1100203becc000(0000) knlGS:0000000000000000
[ 24.173849] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 24.173995] CR2: 00007f615e966270 CR3: 000000010bd9d005 CR4: 0000000000771ef0
[ 24.174155] PKRU: 55555554
[ 24.174214] Call Trace:
[ 24.174285] <TASK>
[ 24.174348] ftrace_replace_code+0x7e/0x210
[ 24.174443] ftrace_modify_all_code+0x59/0x110
[ 24.174553] __ftrace_hash_move_and_update_ops+0x227/0x2c0
[ 24.174659] ? kfree+0x1ac/0x4c0
[ 24.174751] ? srso_return_thunk+0x5/0x5f
[ 24.174834] ? kfree+0x250/0x4c0
[ 24.174926] ? kfree+0x1ac/0x4c0
[ 24.175010] ? bpf_lsm_sk_alloc_security+0x4/0x20
[ 24.175132] ftrace_update_ops+0x40/0x80
[ 24.175217] update_ftrace_direct_del+0x263/0x290
[ 24.175341] ? bpf_lsm_sk_alloc_security+0x4/0x20
[ 24.175456] ? 0xffffffffc0006a80
[ 24.175543] bpf_trampoline_update+0x1fb/0x810
[ 24.175654] bpf_trampoline_unlink_prog+0x103/0x1a0
[ 24.175767] ? process_scheduled_works+0x271/0x640
[ 24.175886] bpf_shim_tramp_link_release+0x20/0x40
[ 24.176001] bpf_link_free+0x54/0xd0
[ 24.176092] process_scheduled_works+0x2c2/0x640
[ 24.176222] worker_thread+0x22a/0x340 21:11:27 [422/10854]
[ 24.176319] ? srso_return_thunk+0x5/0x5f
[ 24.176405] ? __pfx_worker_thread+0x10/0x10
[ 24.176522] kthread+0x10c/0x140
[ 24.176611] ? __pfx_kthread+0x10/0x10
[ 24.176698] ret_from_fork+0x148/0x290
[ 24.176785] ? __pfx_kthread+0x10/0x10
[ 24.176872] ret_from_fork_asm+0x1a/0x30
[ 24.176985] </TASK>
[ 24.177043] irq event stamp: 6965
[ 24.177126] hardirqs last enabled at (6973): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
[ 24.177325] hardirqs last disabled at (6982): [<ffffffff81360071>] __console_unlock+0x41/0x70
[ 24.177520] softirqs last enabled at (6524): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.177675] softirqs last disabled at (6123): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.177844] ---[ end trace 0000000000000000 ]---
[ 24.177963] Bad trampoline accounting at: 000000003143da54 (bpf_fentry_test3+0x4/0x20)
[ 24.178134] ------------[ cut here ]------------
[ 24.178261] WARNING: arch/x86/kernel/ftrace.c:105 at ftrace_replace_code+0xf7/0x210, CPU#13: kworker/13:6/873
[ 24.178476] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
[ 24.178680] CPU: 13 UID: 0 PID: 873 Comm: kworker/13:6 Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
[ 24.178925] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 24.179059] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
[ 24.179258] Workqueue: events bpf_link_put_deferred
[ 24.179374] RIP: 0010:ftrace_replace_code+0xf7/0x210
[ 24.179485] Code: c0 0f 85 ec 00 00 00 8b 44 24 03 41 33 45 00 0f b6 4c 24 07 41 32 4d 04 0f b6 c9 09 c1 0f 84 49 ff ff ff 4c 89 2d b9 df 8b 03 <0f> 0b bf ea
ff ff ff e9 c4 00 00 00 e8 f8 e5 19 00 48 85 c0 0f 84
[ 24.179847] RSP: 0018:ffa0000504cafb98 EFLAGS: 00010202
[ 24.179965] RAX: 0000000038608000 RBX: 0000000000000001 RCX: 00000000386080c1
[ 24.180126] RDX: ffffffff81d41000 RSI: 0000000000000005 RDI: ffffffff81d416d4
[ 24.180295] RBP: 0000000000000001 R08: 000000000000ffff R09: ffffffff82e98430
[ 24.180455] R10: 000000000002fffd R11: 00000000fffeffff R12: ff110001000e48d0
[ 24.180617] R13: ffffffff83ec0f2d R14: ffffffff84b43820 R15: ffa0000504cafb9b
[ 24.180777] FS: 0000000000000000(0000) GS:ff1100203becc000(0000) knlGS:0000000000000000
[ 24.180939] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 24.181077] CR2: 00007f615e966270 CR3: 000000010bd9d005 CR4: 0000000000771ef0
[ 24.181247] PKRU: 55555554
[ 24.181303] Call Trace:
[ 24.181360] <TASK>
[ 24.181424] ftrace_modify_all_code+0x59/0x110
[ 24.181536] __ftrace_hash_move_and_update_ops+0x227/0x2c0
[ 24.181650] ? kfree+0x1ac/0x4c0
[ 24.181743] ? srso_return_thunk+0x5/0x5f
[ 24.181828] ? kfree+0x250/0x4c0
[ 24.181916] ? kfree+0x1ac/0x4c0
[ 24.182004] ? bpf_lsm_sk_alloc_security+0x4/0x20
[ 24.182123] ftrace_update_ops+0x40/0x80
[ 24.182213] update_ftrace_direct_del+0x263/0x290
[ 24.182337] ? bpf_lsm_sk_alloc_security+0x4/0x20
[ 24.182455] ? 0xffffffffc0006a80
[ 24.182543] bpf_trampoline_update+0x1fb/0x810
[ 24.182655] bpf_trampoline_unlink_prog+0x103/0x1a0
[ 24.182768] ? process_scheduled_works+0x271/0x640
[ 24.182887] bpf_shim_tramp_link_release+0x20/0x40
[ 24.183001] bpf_link_free+0x54/0xd0
[ 24.183088] process_scheduled_works+0x2c2/0x640
[ 24.183220] worker_thread+0x22a/0x340 21:11:27 [367/10854]
[ 24.183319] ? srso_return_thunk+0x5/0x5f
[ 24.183405] ? __pfx_worker_thread+0x10/0x10
[ 24.183521] kthread+0x10c/0x140
[ 24.183610] ? __pfx_kthread+0x10/0x10
[ 24.183697] ret_from_fork+0x148/0x290
[ 24.183783] ? __pfx_kthread+0x10/0x10
[ 24.183868] ret_from_fork_asm+0x1a/0x30
[ 24.183979] </TASK>
[ 24.184056] irq event stamp: 7447
[ 24.184138] hardirqs last enabled at (7455): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
[ 24.184339] hardirqs last disabled at (7464): [<ffffffff81360071>] __console_unlock+0x41/0x70
[ 24.184522] softirqs last enabled at (6524): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.184675] softirqs last disabled at (6123): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.184836] ---[ end trace 0000000000000000 ]---
[ 24.185177] ------------[ ftrace bug ]------------
[ 24.185310] ftrace failed to modify
[ 24.185312] [<ffffffff81d416d4>] bpf_fentry_test3+0x4/0x20
[ 24.185544] actual: e8:27:29:6c:3e
[ 24.185627] expected: e8:a7:49:54:ff
[ 24.185717] ftrace record flags: e8180000
[ 24.185798] (0) R tramp: ERROR!
[ 24.185798] expected tramp: ffffffffc0404000
[ 24.185975] ------------[ cut here ]------------
[ 24.186086] WARNING: kernel/trace/ftrace.c:2254 at ftrace_bug+0x101/0x290, CPU#13: kworker/13:6/873
[ 24.186285] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
[ 24.186484] CPU: 13 UID: 0 PID: 873 Comm: kworker/13:6 Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
[ 24.186728] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 24.186863] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
[ 24.187057] Workqueue: events bpf_link_put_deferred
[ 24.187172] RIP: 0010:ftrace_bug+0x101/0x290
[ 24.187294] Code: 05 72 03 83 f8 02 7f 13 83 f8 01 74 46 83 f8 02 75 13 48 c7 c7 41 a3 69 82 eb 51 83 f8 03 74 3c 83 f8 04 74 40 48 85 db 75 4c <0f> 0b c6 05
ba eb 2b 02 01 c7 05 ac eb 2b 02 00 00 00 00 48 c7 05
[ 24.187663] RSP: 0018:ffa0000504cafb70 EFLAGS: 00010246
[ 24.187772] RAX: 0000000000000022 RBX: ff110001000e48d0 RCX: e5ff63967b168c00
[ 24.187934] RDX: 0000000000000000 RSI: 00000000fffeffff RDI: ffffffff83018490
[ 24.188096] RBP: 00000000ffffffea R08: 000000000000ffff R09: ffffffff82e98430
[ 24.188267] R10: 000000000002fffd R11: 00000000fffeffff R12: ff110001000e48d0
[ 24.188423] R13: ffffffff83ec0f2d R14: ffffffff81d416d4 R15: ffffffff836e1cb0
[ 24.188581] FS: 0000000000000000(0000) GS:ff1100203becc000(0000) knlGS:0000000000000000
[ 24.188738] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 24.188870] CR2: 00007f615e966270 CR3: 000000010bd9d005 CR4: 0000000000771ef0
[ 24.189032] PKRU: 55555554
[ 24.189088] Call Trace:
[ 24.189144] <TASK>
[ 24.189204] ftrace_replace_code+0x1d6/0x210
[ 24.189335] ftrace_modify_all_code+0x59/0x110
[ 24.189443] __ftrace_hash_move_and_update_ops+0x227/0x2c0
[ 24.189554] ? kfree+0x1ac/0x4c0
[ 24.189638] ? srso_return_thunk+0x5/0x5f
[ 24.189720] ? kfree+0x250/0x4c0
[ 24.189802] ? kfree+0x1ac/0x4c0
[ 24.189889] ? bpf_lsm_sk_alloc_security+0x4/0x20
[ 24.190010] ftrace_update_ops+0x40/0x80
[ 24.190095] update_ftrace_direct_del+0x263/0x290
[ 24.190205] ? bpf_lsm_sk_alloc_security+0x4/0x20 21:11:28 [312/10854]
[ 24.190335] ? 0xffffffffc0006a80
[ 24.190422] bpf_trampoline_update+0x1fb/0x810
[ 24.190542] bpf_trampoline_unlink_prog+0x103/0x1a0
[ 24.190651] ? process_scheduled_works+0x271/0x640
[ 24.190764] bpf_shim_tramp_link_release+0x20/0x40
[ 24.190871] bpf_link_free+0x54/0xd0
[ 24.190964] process_scheduled_works+0x2c2/0x640
[ 24.191093] worker_thread+0x22a/0x340
[ 24.191177] ? srso_return_thunk+0x5/0x5f
[ 24.191274] ? __pfx_worker_thread+0x10/0x10
[ 24.191388] kthread+0x10c/0x140
[ 24.191478] ? __pfx_kthread+0x10/0x10
[ 24.191565] ret_from_fork+0x148/0x290
[ 24.191641] ? __pfx_kthread+0x10/0x10
[ 24.191729] ret_from_fork_asm+0x1a/0x30
[ 24.191833] </TASK>
[ 24.191896] irq event stamp: 8043
[ 24.191979] hardirqs last enabled at (8051): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
[ 24.192167] hardirqs last disabled at (8058): [<ffffffff81360071>] __console_unlock+0x41/0x70
[ 24.192368] softirqs last enabled at (7828): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.192528] softirqs last disabled at (7817): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.192689] ---[ end trace 0000000000000000 ]---
[ 24.193549] ------------[ cut here ]------------
[ 24.193773] WARNING: kernel/trace/ftrace.c:2709 at ftrace_get_addr_curr+0x6c/0x190, CPU#10: test_progs/311
[ 24.193973] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
[ 24.194206] CPU: 10 UID: 0 PID: 311 Comm: test_progs Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
[ 24.194461] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 24.194594] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
[ 24.194778] RIP: 0010:ftrace_get_addr_curr+0x6c/0x190
[ 24.194891] Code: 48 0f 44 ce 4c 8b 3c c8 e8 e1 b4 c1 00 4d 85 ff 74 18 4d 39 77 10 74 05 4d 8b 3f eb eb 49 8b 47 18 48 85 c0 0f 85 19 01 00 00 <0f> 0b 48 8b
43 08 a9 00 00 00 08 75 1c a9 00 00 00 20 48 c7 c1 80
[ 24.195270] RSP: 0018:ffa0000000d4bb38 EFLAGS: 00010246
[ 24.195381] RAX: 0000000000000001 RBX: ff11000100125710 RCX: ff1100010b28a2c0
[ 24.195540] RDX: 0000000000000003 RSI: 0000000000000003 RDI: ff11000100125710
[ 24.195698] RBP: 0000000000000001 R08: 0000000080000000 R09: ffffffffffffffff
[ 24.195863] R10: ffffffff82046a38 R11: 0000000000000000 R12: ff11000100125710
[ 24.196033] R13: ffffffff81529fc4 R14: ffffffff81529fc4 R15: 0000000000000000
[ 24.196199] FS: 00007f46532a54c0(0000) GS:ff1100203be0c000(0000) knlGS:0000000000000000
[ 24.196374] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 24.196509] CR2: 000055e885be1470 CR3: 000000010eef9003 CR4: 0000000000771ef0
[ 24.196663] PKRU: 55555554
[ 24.196720] Call Trace:
[ 24.196778] <TASK>
[ 24.196844] ftrace_replace_code+0x7e/0x210
[ 24.196948] ftrace_modify_all_code+0x59/0x110
[ 24.197059] __ftrace_hash_move_and_update_ops+0x227/0x2c0
[ 24.197174] ? srso_return_thunk+0x5/0x5f
[ 24.197271] ? __mutex_lock+0x22a/0xc60
[ 24.197360] ? kfree+0x1ac/0x4c0
[ 24.197455] ? srso_return_thunk+0x5/0x5f
[ 24.197538] ? kfree+0x250/0x4c0
[ 24.197626] ? bpf_fentry_test3+0x4/0x20
[ 24.197712] ftrace_set_hash+0x13c/0x3d0
[ 24.197811] ftrace_set_filter_ip+0x88/0xb0
[ 24.197909] ? bpf_fentry_test3+0x4/0x20 21:11:28 [257/10854]
[ 24.198000] disarm_kprobe_ftrace+0x83/0xd0
[ 24.198089] __disable_kprobe+0x129/0x160
[ 24.198178] disable_kprobe+0x27/0x60
[ 24.198272] kprobe_register+0xa2/0xe0
[ 24.198362] perf_trace_event_unreg+0x33/0xd0
[ 24.198473] perf_kprobe_destroy+0x3b/0x80
[ 24.198557] __free_event+0x119/0x290
[ 24.198640] perf_event_release_kernel+0x1ef/0x220
[ 24.198758] perf_release+0x12/0x20
[ 24.198843] __fput+0x11b/0x2a0
[ 24.198946] task_work_run+0x8b/0xc0
[ 24.199035] exit_to_user_mode_loop+0x107/0x4d0
[ 24.199155] do_syscall_64+0x25b/0x390
[ 24.199249] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 24.199360] ? trace_irq_disable+0x1d/0xc0
[ 24.199451] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 24.199559] RIP: 0033:0x7f46530ff85b
[ 24.199675] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 e3 83 f8 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0
ff ff 77 35 44 89 c7 89 44 24 0c e8 41 84 f8 ff 8b 44
[ 24.200034] RSP: 002b:00007ffc40859770 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 24.200192] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46530ff85b
[ 24.200382] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000019
[ 24.200552] RBP: 00007ffc408597c0 R08: 0000000000000000 R09: 00007ffc40859757
[ 24.200702] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffc4085ddc8
[ 24.200855] R13: 000055e8800de120 R14: 000055e88118d390 R15: 00007f46533de000
[ 24.201035] </TASK>
[ 24.201091] irq event stamp: 200379
[ 24.201208] hardirqs last enabled at (200387): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
[ 24.201453] hardirqs last disabled at (200396): [<ffffffff81360071>] __console_unlock+0x41/0x70
[ 24.201667] softirqs last enabled at (200336): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.201890] softirqs last disabled at (200329): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.202121] ---[ end trace 0000000000000000 ]---
[ 24.202398] ------------[ cut here ]------------
[ 24.202534] WARNING: kernel/trace/ftrace.c:2715 at ftrace_get_addr_curr+0x149/0x190, CPU#10: test_progs/311
[ 24.202753] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
[ 24.202962] CPU: 10 UID: 0 PID: 311 Comm: test_progs Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
[ 24.203203] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 24.203344] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
[ 24.203526] RIP: 0010:ftrace_get_addr_curr+0x149/0x190
[ 24.203629] Code: 00 4c 89 f7 e8 88 f8 ff ff 84 c0 75 92 4d 8b 7f 08 e8 fb b3 c1 00 4d 85 ff 0f 94 c0 49 81 ff b0 1c 6e 83 0f 94 c1 08 c1 74 96 <0f> 0b c6 05
62 e8 2b 02 01 c7 05 54 e8 2b 02 00 00 00 00 48 c7 05
[ 24.203996] RSP: 0018:ffa0000000d4bb38 EFLAGS: 00010202
[ 24.204110] RAX: 0000000000000000 RBX: ff11000100125710 RCX: ff1100010b28a201
[ 24.204280] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff81529fc4
[ 24.204437] RBP: 0000000000000001 R08: 0000000080000000 R09: ffffffffffffffff
[ 24.204595] R10: ffffffff82046a38 R11: 0000000000000000 R12: ff11000100125710
[ 24.204755] R13: ffffffff81529fc4 R14: ffffffff81529fc4 R15: ffffffff836e1cb0
[ 24.204914] FS: 00007f46532a54c0(0000) GS:ff1100203be0c000(0000) knlGS:0000000000000000
[ 24.205072] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 24.205204] CR2: 000055e885be1470 CR3: 000000010eef9003 CR4: 0000000000771ef0
[ 24.205386] PKRU: 55555554
[ 24.205443] Call Trace:
[ 24.205503] <TASK>
[ 24.205565] ftrace_replace_code+0x7e/0x210
[ 24.205669] ftrace_modify_all_code+0x59/0x110 21:11:28 [202/10854]
[ 24.205784] __ftrace_hash_move_and_update_ops+0x227/0x2c0
[ 24.205902] ? srso_return_thunk+0x5/0x5f
[ 24.205987] ? __mutex_lock+0x22a/0xc60
[ 24.206072] ? kfree+0x1ac/0x4c0
[ 24.206163] ? srso_return_thunk+0x5/0x5f
[ 24.206254] ? kfree+0x250/0x4c0
[ 24.206344] ? bpf_fentry_test3+0x4/0x20
[ 24.206428] ftrace_set_hash+0x13c/0x3d0
[ 24.206523] ftrace_set_filter_ip+0x88/0xb0
[ 24.206614] ? bpf_fentry_test3+0x4/0x20
[ 24.206703] disarm_kprobe_ftrace+0x83/0xd0
[ 24.206789] __disable_kprobe+0x129/0x160
[ 24.206880] disable_kprobe+0x27/0x60
[ 24.206972] kprobe_register+0xa2/0xe0
[ 24.207057] perf_trace_event_unreg+0x33/0xd0
[ 24.207169] perf_kprobe_destroy+0x3b/0x80
[ 24.207262] __free_event+0x119/0x290
[ 24.207348] perf_event_release_kernel+0x1ef/0x220
[ 24.207461] perf_release+0x12/0x20
[ 24.207543] __fput+0x11b/0x2a0
[ 24.207626] task_work_run+0x8b/0xc0
[ 24.207711] exit_to_user_mode_loop+0x107/0x4d0
[ 24.207827] do_syscall_64+0x25b/0x390
[ 24.207915] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 24.208021] ? trace_irq_disable+0x1d/0xc0
[ 24.208110] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 24.208215] RIP: 0033:0x7f46530ff85b
[ 24.208307] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 e3 83 f8 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0
ff ff 77 35 44 89 c7 89 44 24 0c e8 41 84 f8 ff 8b 44
[ 24.208657] RSP: 002b:00007ffc40859770 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 24.208816] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46530ff85b
[ 24.208978] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000019
[ 24.209133] RBP: 00007ffc408597c0 R08: 0000000000000000 R09: 00007ffc40859757
[ 24.209300] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffc4085ddc8
[ 24.209457] R13: 000055e8800de120 R14: 000055e88118d390 R15: 00007f46533de000
[ 24.209633] </TASK>
[ 24.209689] irq event stamp: 200963
[ 24.209770] hardirqs last enabled at (200971): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
[ 24.209971] hardirqs last disabled at (200978): [<ffffffff81360071>] __console_unlock+0x41/0x70
[ 24.210156] softirqs last enabled at (200568): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.210370] softirqs last disabled at (200557): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.210554] ---[ end trace 0000000000000000 ]---
[ 24.210665] Bad trampoline accounting at: 00000000ab641fec (bpf_lsm_sk_alloc_security+0x4/0x20)
[ 24.210866] ------------[ cut here ]------------
[ 24.210993] WARNING: arch/x86/kernel/ftrace.c:105 at ftrace_replace_code+0xf7/0x210, CPU#10: test_progs/311
[ 24.211182] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
[ 24.211412] CPU: 10 UID: 0 PID: 311 Comm: test_progs Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
[ 24.211656] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 24.211788] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
[ 24.211980] RIP: 0010:ftrace_replace_code+0xf7/0x210
[ 24.212091] Code: c0 0f 85 ec 00 00 00 8b 44 24 03 41 33 45 00 0f b6 4c 24 07 41 32 4d 04 0f b6 c9 09 c1 0f 84 49 ff ff ff 4c 89 2d b9 df 8b 03 <0f> 0b bf ea
ff ff ff e9 c4 00 00 00 e8 f8 e5 19 00 48 85 c0 0f 84
[ 24.212503] RSP: 0018:ffa0000000d4bb58 EFLAGS: 00010202
[ 24.212628] RAX: 00000000780a0001 RBX: 0000000000000001 RCX: 00000000780a00c1
[ 24.212798] RDX: ffffffff81529000 RSI: 0000000000000005 RDI: ffffffff81529fc4
[ 24.212970] RBP: 0000000000000001 R08: 000000000000ffff R09: ffffffff82e98430
[ 24.213130] R10: 000000000002fffd R11: 00000000fffeffff R12: ff11000100125710
[ 24.213317] R13: ffffffff83ec0f2d R14: ffffffff84b43820 R15: ffa0000000d4bb5b
[ 24.213488] FS: 00007f46532a54c0(0000) GS:ff1100203be0c000(0000) knlGS:0000000000000000
[ 24.213674] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 24.213813] CR2: 000055e885be1470 CR3: 000000010eef9003 CR4: 0000000000771ef0
[ 24.213986] PKRU: 55555554
[ 24.214044] Call Trace:
[ 24.214100] <TASK>
[ 24.214167] ftrace_modify_all_code+0x59/0x110
[ 24.214301] __ftrace_hash_move_and_update_ops+0x227/0x2c0
[ 24.214415] ? srso_return_thunk+0x5/0x5f
[ 24.214502] ? __mutex_lock+0x22a/0xc60
[ 24.214588] ? kfree+0x1ac/0x4c0
[ 24.214682] ? srso_return_thunk+0x5/0x5f
[ 24.214765] ? kfree+0x250/0x4c0
[ 24.214855] ? bpf_fentry_test3+0x4/0x20
[ 24.214943] ftrace_set_hash+0x13c/0x3d0
[ 24.215041] ftrace_set_filter_ip+0x88/0xb0
[ 24.215132] ? bpf_fentry_test3+0x4/0x20
[ 24.215221] disarm_kprobe_ftrace+0x83/0xd0
[ 24.215328] __disable_kprobe+0x129/0x160
[ 24.215418] disable_kprobe+0x27/0x60
[ 24.215507] kprobe_register+0xa2/0xe0
[ 24.215594] perf_trace_event_unreg+0x33/0xd0
[ 24.215701] perf_kprobe_destroy+0x3b/0x80
[ 24.215790] __free_event+0x119/0x290
[ 24.215888] perf_event_release_kernel+0x1ef/0x220
[ 24.216007] perf_release+0x12/0x20
[ 24.216091] __fput+0x11b/0x2a0
[ 24.216183] task_work_run+0x8b/0xc0
[ 24.216293] exit_to_user_mode_loop+0x107/0x4d0
[ 24.216411] do_syscall_64+0x25b/0x390
[ 24.216497] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 24.216606] ? trace_irq_disable+0x1d/0xc0
[ 24.216699] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 24.216807] RIP: 0033:0x7f46530ff85b
[ 24.216895] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 e3 83 f8 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0
ff ff 77 35 44 89 c7 89 44 24 0c e8 41 84 f8 ff 8b 44
[ 24.217293] RSP: 002b:00007ffc40859770 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 24.217461] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46530ff85b
[ 24.217627] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000019
[ 24.217785] RBP: 00007ffc408597c0 R08: 0000000000000000 R09: 00007ffc40859757
[ 24.217950] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffc4085ddc8
[ 24.218107] R13: 000055e8800de120 R14: 000055e88118d390 R15: 00007f46533de000
[ 24.218306] </TASK>
[ 24.218363] irq event stamp: 201623
[ 24.218445] hardirqs last enabled at (201631): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
[ 24.218625] hardirqs last disabled at (201638): [<ffffffff81360071>] __console_unlock+0x41/0x70
[ 24.218810] softirqs last enabled at (201612): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.219012] softirqs last disabled at (201601): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.219208] ---[ end trace 0000000000000000 ]---
[ 24.219693] ------------[ ftrace bug ]------------
[ 24.219801] ftrace failed to modify
[ 24.219804] [<ffffffff81529fc4>] bpf_lsm_sk_alloc_security+0x4/0x20
[ 24.220022] actual: e9:b7:ca:ad:3e
[ 24.220113] expected: e8:b7:c0:d5:ff
[ 24.220203] ftrace record flags: e8980000
[ 24.220307] (0) R tramp: ERROR!
[ 24.220321] ------------[ cut here ]------------
[ 24.220507] WARNING: kernel/trace/ftrace.c:2715 at ftrace_get_addr_curr+0x149/0x190, CPU#10: test_progs/311
[ 24.220693] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
[ 24.220895] CPU: 10 UID: 0 PID: 311 Comm: test_progs Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
[ 24.221135] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 24.221284] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
[ 24.221467] RIP: 0010:ftrace_get_addr_curr+0x149/0x190
[ 24.221577] Code: 00 4c 89 f7 e8 88 f8 ff ff 84 c0 75 92 4d 8b 7f 08 e8 fb b3 c1 00 4d 85 ff 0f 94 c0 49 81 ff b0 1c 6e 83 0f 94 c1 08 c1 74 96 <0f> 0b c6 05
62 e8 2b 02 01 c7 05 54 e8 2b 02 00 00 00 00 48 c7 05
[ 24.221938] RSP: 0018:ffa0000000d4bb10 EFLAGS: 00010202
[ 24.222052] RAX: 0000000000000000 RBX: ff11000100125710 RCX: ff1100010b28a201
[ 24.222205] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff81529fc4
[ 24.222384] RBP: 00000000ffffffea R08: 000000000000ffff R09: ffffffff82e98430
[ 24.222542] R10: 000000000002fffd R11: 00000000fffeffff R12: ff11000100125710
[ 24.222708] R13: ffffffff83ec0f2d R14: ffffffff81529fc4 R15: ffffffff836e1cb0
[ 24.222866] FS: 00007f46532a54c0(0000) GS:ff1100203be0c000(0000) knlGS:0000000000000000
[ 24.223034] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 24.223171] CR2: 000055e885be1470 CR3: 000000010eef9003 CR4: 0000000000771ef0
[ 24.223341] PKRU: 55555554
[ 24.223397] Call Trace:
[ 24.223454] <TASK>
[ 24.223511] ? bpf_lsm_sk_alloc_security+0x4/0x20
[ 24.223623] ftrace_bug+0x1ff/0x290
[ 24.223710] ftrace_replace_code+0x1d6/0x210
[ 24.223829] ftrace_modify_all_code+0x59/0x110
[ 24.223946] __ftrace_hash_move_and_update_ops+0x227/0x2c0
[ 24.224060] ? srso_return_thunk+0x5/0x5f
[ 24.224148] ? __mutex_lock+0x22a/0xc60
[ 24.224245] ? kfree+0x1ac/0x4c0
[ 24.224337] ? srso_return_thunk+0x5/0x5f
[ 24.224420] ? kfree+0x250/0x4c0
[ 24.224512] ? bpf_fentry_test3+0x4/0x20
[ 24.224597] ftrace_set_hash+0x13c/0x3d0
[ 24.224690] ftrace_set_filter_ip+0x88/0xb0
[ 24.224776] ? bpf_fentry_test3+0x4/0x20
[ 24.224869] disarm_kprobe_ftrace+0x83/0xd0
[ 24.224965] __disable_kprobe+0x129/0x160
[ 24.225051] disable_kprobe+0x27/0x60
[ 24.225136] kprobe_register+0xa2/0xe0
[ 24.225223] perf_trace_event_unreg+0x33/0xd0
[ 24.225346] perf_kprobe_destroy+0x3b/0x80
[ 24.225431] __free_event+0x119/0x290
[ 24.225518] perf_event_release_kernel+0x1ef/0x220
[ 24.225631] perf_release+0x12/0x20
[ 24.225715] __fput+0x11b/0x2a0
[ 24.225804] task_work_run+0x8b/0xc0
[ 24.225895] exit_to_user_mode_loop+0x107/0x4d0
[ 24.226016] do_syscall_64+0x25b/0x390
[ 24.226099] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 24.226207] ? trace_irq_disable+0x1d/0xc0
[ 24.226308] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 24.226415] RIP: 0033:0x7f46530ff85b
[ 24.226498] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 e3 83 f8 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0
ff ff 77 35 44 89 c7 89 44 24 0c e8 41 84 f8 ff 8b 44
[ 24.226851] RSP: 002b:00007ffc40859770 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 24.227016] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46530ff85b
[ 24.227173] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000019
[ 24.227341] RBP: 00007ffc408597c0 R08: 0000000000000000 R09: 00007ffc40859757
[ 24.227500] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffc4085ddc8
[ 24.227652] R13: 000055e8800de120 R14: 000055e88118d390 R15: 00007f46533de000
[ 24.227830] </TASK>
[ 24.227891] irq event stamp: 202299
[ 24.227974] hardirqs last enabled at (202307): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
[ 24.228162] hardirqs last disabled at (202314): [<ffffffff81360071>] __console_unlock+0x41/0x70
[ 24.228357] softirqs last enabled at (201682): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.228540] softirqs last disabled at (201671): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
[ 24.228716] ---[ end trace 0000000000000000 ]---
[ 24.228834] Bad trampoline accounting at: 00000000ab641fec (bpf_lsm_sk_alloc_security+0x4/0x20)
[ 24.229029]
[ 24.229029] expected tramp: ffffffff81286080
[ 24.261301] BUG: unable to handle page fault for address: ffa00000004b9050
[ 24.261436] #PF: supervisor read access in kernel mode
[ 24.261528] #PF: error_code(0x0000) - not-present page
[ 24.261621] PGD 100000067 P4D 100832067 PUD 100833067 PMD 100efb067 PTE 0
[ 24.261745] Oops: Oops: 0000 [#1] SMP NOPTI
[ 24.261821] CPU: 9 UID: 0 PID: 1338 Comm: ip Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
[ 24.262006] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 24.262119] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
[ 24.262281] RIP: 0010:__cgroup_bpf_run_lsm_current+0xc5/0x2f0
[ 24.262393] Code: a6 6f 1a 02 01 48 c7 c7 31 5b 71 82 be bf 01 00 00 48 c7 c2 d3 70 65 82 e8 d8 53 ce ff 4d 8b 7f 60 4d 85 ff 0f 84 14 02 00 00 <49> 8b 46 f0
4c 63 b0 34 05 00 00 c7 44 24 10 00 00 00 00 41 0f b7
[ 24.262693] RSP: 0018:ffa0000004dfbc98 EFLAGS: 00010282
[ 24.262784] RAX: 0000000000000001 RBX: ffa0000004dfbd10 RCX: 0000000000000001
[ 24.262923] RDX: 00000000d7c4159d RSI: ffffffff8359b368 RDI: ff1100011b5c50c8
[ 24.263055] RBP: ffa0000004dfbd30 R08: 0000000000020000 R09: ffffffffffffffff
[ 24.263187] R10: ffffffff814f76b3 R11: 0000000000000000 R12: ff1100011b5c4580
[ 24.263325] R13: 0000000000000000 R14: ffa00000004b9060 R15: ffffffff835b3040
[ 24.263465] FS: 00007f0007064800(0000) GS:ff1100203bdcc000(0000) knlGS:0000000000000000
[ 24.263599] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 24.263709] CR2: ffa00000004b9050 CR3: 0000000120f4d002 CR4: 0000000000771ef0
[ 24.263841] PKRU: 55555554
[ 24.263890] Call Trace:
[ 24.263938] <TASK>
[ 24.263992] bpf_trampoline_6442513766+0x6a/0x10d
[ 24.264088] security_sk_alloc+0x83/0xd0
[ 24.264162] sk_prot_alloc+0xf4/0x150
[ 24.264236] sk_alloc+0x34/0x2a0
[ 24.264305] ? srso_return_thunk+0x5/0x5f
[ 24.264375] ? _raw_spin_unlock_irqrestore+0x35/0x50
[ 24.264465] ? srso_return_thunk+0x5/0x5f
[ 24.264533] ? __wake_up_common_lock+0xa8/0xd0
[ 24.264625] __netlink_create+0x2f/0xf0
[ 24.264695] netlink_create+0x1c4/0x230
[ 24.264765] ? __pfx_rtnetlink_bind+0x10/0x10
[ 24.264858] __sock_create+0x21d/0x400
[ 24.264937] __sys_socket+0x65/0x100
[ 24.265007] ? srso_return_thunk+0x5/0x5f
[ 24.265077] __x64_sys_socket+0x19/0x30
[ 24.265146] do_syscall_64+0xde/0x390
[ 24.265216] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 24.265307] ? trace_irq_disable+0x1d/0xc0
[ 24.265379] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 24.265469] RIP: 0033:0x7f0006f112ab
[ 24.265538] Code: 73 01 c3 48 8b 0d 6d 8b 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 29 00 00 00 0f 05 <48> 3d 01 f0
ff ff 73 01 c3 48 8b 0d 3d 8b 0e 00 f7 d8 64 89 01 48
[ 24.265822] RSP: 002b:00007ffd8ecb3be8 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
[ 24.265960] RAX: ffffffffffffffda RBX: 000056212b30d040 RCX: 00007f0006f112ab
[ 24.266088] RDX: 0000000000000000 RSI: 0000000000080003 RDI: 0000000000000010
[ 24.266217] RBP: 0000000000000000 R08: 00007ffd8ecb3bc0 R09: 0000000000000000
[ 24.266346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 24.266474] R13: 000056212b30d040 R14: 00007ffd8ecb3d88 R15: 0000000000000004
[ 24.266617] </TASK>
[ 24.266663] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
[ 24.266824] CR2: ffa00000004b9050
[ 24.266897] ---[ end trace 0000000000000000 ]---
[ 24.266989] RIP: 0010:__cgroup_bpf_run_lsm_current+0xc5/0x2f0
[ 24.267101] Code: a6 6f 1a 02 01 48 c7 c7 31 5b 71 82 be bf 01 00 00 48 c7 c2 d3 70 65 82 e8 d8 53 ce ff 4d 8b 7f 60 4d 85 ff 0f 84 14 02 00 00 <49> 8b 46 f0
4c 63 b0 34 05 00 00 c7 44 24 10 00 00 00 00 41 0f b7
[ 24.267406] RSP: 0018:ffa0000004dfbc98 EFLAGS: 00010282
[ 24.267499] RAX: 0000000000000001 RBX: ffa0000004dfbd10 RCX: 0000000000000001
[ 24.267629] RDX: 00000000d7c4159d RSI: ffffffff8359b368 RDI: ff1100011b5c50c8
[ 24.267758] RBP: ffa0000004dfbd30 R08: 0000000000020000 R09: ffffffffffffffff
[ 24.267897] R10: ffffffff814f76b3 R11: 0000000000000000 R12: ff1100011b5c4580
[ 24.268030] R13: 0000000000000000 R14: ffa00000004b9060 R15: ffffffff835b3040
[ 24.268167] FS: 00007f0007064800(0000) GS:ff1100203bdcc000(0000) knlGS:0000000000000000
[ 24.268311] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 24.268428] CR2: ffa00000004b9050 CR3: 0000000120f4d002 CR4: 0000000000771ef0
[ 24.268565] PKRU: 55555554
[ 24.268613] Kernel panic - not syncing: Fatal exception
[ 24.268977] Kernel Offset: disabled
[ 24.269046] ---[ end Kernel panic - not syncing: Fatal exception ]---
> ---
> arch/x86/Kconfig | 1 +
> kernel/bpf/trampoline.c | 220 ++++++++++++++++++++++++++++++++++------
> kernel/trace/Kconfig | 3 +
> kernel/trace/ftrace.c | 7 +-
> 4 files changed, 200 insertions(+), 31 deletions(-)
>
> [...]
^ permalink raw reply related
* Re: [PATCH 00/61] vfs: change inode->i_ino from unsigned long to u64
From: Mathieu Desnoyers @ 2026-02-27 19:01 UTC (permalink / raw)
To: Jeff Layton, Matthew Wilcox
Cc: Alexander Viro, Christian Brauner, Jan Kara, Steven Rostedt,
Masami Hiramatsu, Dan Williams, Eric Biggers,
Theodore Y. Ts'o, Muchun Song, Oscar Salvador,
David Hildenbrand, David Howells, Paulo Alcantara, Andreas Dilger,
Jan Kara, Jaegeuk Kim, Chao Yu, Trond Myklebust, Anna Schumaker,
Chuck Lever, NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey,
Steve French, Ronnie Sahlberg, Shyam Prasad N, Bharath SM,
Alexander Aring, Ryusuke Konishi, Viacheslav Dubeyko,
Eric Van Hensbergen, Latchesar Ionkov, Dominique Martinet,
Christian Schoenebeck, David Sterba, Marc Dionne, Ian Kent,
Luis de Bethencourt, Salah Triki, Tigran A. Aivazian,
Ilya Dryomov, Alex Markuze, Jan Harkes, coda, Nicolas Pitre,
Tyler Hicks, Amir Goldstein, Christoph Hellwig,
John Paul Adrian Glaubitz, Yangtao Li, Mikulas Patocka,
David Woodhouse, Richard Weinberger, Dave Kleikamp,
Konstantin Komarov, Mark Fasheh, Joel Becker, Joseph Qi,
Mike Marshall, Martin Brandenburg, Miklos Szeredi, Anders Larsen,
Zhihao Cheng, Damien Le Moal, Naohiro Aota, Johannes Thumshirn,
John Johansen, Paul Moore, James Morris, Serge E. Hallyn,
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Fan Wu,
Stephen Smalley, Ondrej Mosnacek, Casey Schaufler, Alex Deucher,
Christian König, David Airlie, Simona Vetter, Sumit Semwal,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
David S. Miller, Jakub Kicinski, Simon Horman, Oleg Nesterov,
Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, Darrick J. Wong,
Martin Schiller, linux-fsdevel, linux-kernel, linux-trace-kernel,
nvdimm, fsverity, linux-mm, netfs, linux-ext4, linux-f2fs-devel,
linux-nfs, linux-cifs, samba-technical, linux-nilfs, v9fs,
linux-afs, autofs, ceph-devel, codalist, ecryptfs, linux-mtd,
jfs-discussion, ntfs3, ocfs2-devel, devel, linux-unionfs,
apparmor, linux-security-module, linux-integrity, selinux,
amd-gfx, dri-devel, linux-media, linaro-mm-sig, netdev,
linux-perf-users, linux-fscrypt, linux-xfs, linux-hams, linux-x25
In-Reply-To: <4a462d40899698586c110add96ce3fab6ddac30b.camel@kernel.org>
On 2026-02-27 12:19, Jeff Layton wrote:
> On Thu, 2026-02-26 at 16:49 +0000, Matthew Wilcox wrote:
>> On Thu, Feb 26, 2026 at 10:55:02AM -0500, Jeff Layton wrote:
>>> The bulk of the changes are to format strings and tracepoints, since the
>>> kernel itself doesn't care that much about the i_ino field. The first
>>> patch changes some vfs function arguments, so check that one out
>>> carefully.
>>
>> Why are the format strings all done as separate patches? Don't we get
>> bisection hazards by splitting it apart this way?
>
> Circling back to this...
>
> I have a v2 series (~107 patches) that I'm testing now that does this
> more bisectably with the typedef and macro scaffolding that Mathieu
> suggested. I'll probably send it early next week.
>
> I had done it this way originally since I figured it was best to break
> this up by subsystem. Should I continue with this series as a set of
> patches broken up this way, or is it preferable to combine the pile of
> format changes into fewer patches?
Here is the approach I would recommend to maximize signal over noise
for the follow up email thread discussions:
Now that your series is bisectable, you could post a [RFC PATCH v2]
series with the following:
- Patch 00 introduces the series, points to your git branch implementing
the whole series,
- The first few patches introduce the new type (kino_t) and macro to
do the format string transition. Initially kino_t would typedef to
unsigned long (no changes).
- Followed by patches implementing the type + format string changes for
a few key subsystems.
- The final patch would change kino_t and the format string macro to
64-bit integers.
Once everyone agree on those core changes, you could proceed to post
patches that change additional subsystems in a subsequent round.
One more comment: have you tried using Coccinelle to do this kind of
semantic code change ?
Thanks,
Mathieu
--
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com
^ permalink raw reply
* Re: [PATCH] blktrace: fix __this_cpu_read/write in preemptible context
From: Steven Rostedt @ 2026-02-27 19:19 UTC (permalink / raw)
To: Chaitanya Kulkarni
Cc: axboe, mhiramat, mathieu.desnoyers, shinichiro.kawasaki,
linux-block, linux-trace-kernel
In-Reply-To: <20260227050303.10945-1-kch@nvidia.com>
On Thu, 26 Feb 2026 21:03:03 -0800
Chaitanya Kulkarni <kch@nvidia.com> wrote:
> diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
> index 3b7c102a6eb3..488552036583 100644
> --- a/kernel/trace/blktrace.c
> +++ b/kernel/trace/blktrace.c
> @@ -383,7 +383,9 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
> cpu = raw_smp_processor_id();
>
> if (blk_tracer) {
> + preempt_disable_notrace();
> tracing_record_cmdline(current);
> + preempt_enable_notrace();
>
> buffer = blk_tr->array_buffer.buffer;
> trace_ctx = tracing_gen_ctx_flags(0);
Do you know when this started? rcu_read_lock() doesn't disable preemption
in PREEMPT environments, and hasn't for a very long time. I'm surprised it
took this long to detect this? Perhaps this was a bug from day one?
Anyway, the tracing_record_cmdline() is to update the COMM cache so that
the trace has way to show the task->comm based on the saved PID in the
trace. It sets a flag to record the COMM from the sched_switch event if a
trace event happened. It's not needed if no trace event occurred. That
means, instead of adding preempt_disable() here, just move it after the
ring buffer event is reserved, as that means preemption is disabled until
the event is committed.
i.e.
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index e6988929ead2..3735cbc1f99f 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -383,8 +383,6 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
cpu = raw_smp_processor_id();
if (blk_tracer) {
- tracing_record_cmdline(current);
-
buffer = blk_tr->array_buffer.buffer;
trace_ctx = tracing_gen_ctx_flags(0);
switch (bt->version) {
@@ -419,6 +417,8 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
if (!event)
return;
+ tracing_record_cmdline(current);
+
switch (bt->version) {
case 1:
record_blktrace_event(ring_buffer_event_data(event),
-- Steve
^ permalink raw reply related
* Re: [PATCH 00/61] vfs: change inode->i_ino from unsigned long to u64
From: Jeff Layton @ 2026-02-27 19:35 UTC (permalink / raw)
To: Mathieu Desnoyers, Matthew Wilcox
Cc: Alexander Viro, Christian Brauner, Jan Kara, Steven Rostedt,
Masami Hiramatsu, Dan Williams, Eric Biggers,
Theodore Y. Ts'o, Muchun Song, Oscar Salvador,
David Hildenbrand, David Howells, Paulo Alcantara, Andreas Dilger,
Jan Kara, Jaegeuk Kim, Chao Yu, Trond Myklebust, Anna Schumaker,
Chuck Lever, NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey,
Steve French, Ronnie Sahlberg, Shyam Prasad N, Bharath SM,
Alexander Aring, Ryusuke Konishi, Viacheslav Dubeyko,
Eric Van Hensbergen, Latchesar Ionkov, Dominique Martinet,
Christian Schoenebeck, David Sterba, Marc Dionne, Ian Kent,
Luis de Bethencourt, Salah Triki, Tigran A. Aivazian,
Ilya Dryomov, Alex Markuze, Jan Harkes, coda, Nicolas Pitre,
Tyler Hicks, Amir Goldstein, Christoph Hellwig,
John Paul Adrian Glaubitz, Yangtao Li, Mikulas Patocka,
David Woodhouse, Richard Weinberger, Dave Kleikamp,
Konstantin Komarov, Mark Fasheh, Joel Becker, Joseph Qi,
Mike Marshall, Martin Brandenburg, Miklos Szeredi, Anders Larsen,
Zhihao Cheng, Damien Le Moal, Naohiro Aota, Johannes Thumshirn,
John Johansen, Paul Moore, James Morris, Serge E. Hallyn,
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Fan Wu,
Stephen Smalley, Ondrej Mosnacek, Casey Schaufler, Alex Deucher,
Christian König, David Airlie, Simona Vetter, Sumit Semwal,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
David S. Miller, Jakub Kicinski, Simon Horman, Oleg Nesterov,
Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, Darrick J. Wong,
Martin Schiller, linux-fsdevel, linux-kernel, linux-trace-kernel,
nvdimm, fsverity, linux-mm, netfs, linux-ext4, linux-f2fs-devel,
linux-nfs, linux-cifs, samba-technical, linux-nilfs, v9fs,
linux-afs, autofs, ceph-devel, codalist, ecryptfs, linux-mtd,
jfs-discussion, ntfs3, ocfs2-devel, devel, linux-unionfs,
apparmor, linux-security-module, linux-integrity, selinux,
amd-gfx, dri-devel, linux-media, linaro-mm-sig, netdev,
linux-perf-users, linux-fscrypt, linux-xfs, linux-hams, linux-x25
In-Reply-To: <b808e186-3eeb-46ed-9826-b0ae6cdcdb8b@efficios.com>
On Fri, 2026-02-27 at 14:01 -0500, Mathieu Desnoyers wrote:
> On 2026-02-27 12:19, Jeff Layton wrote:
> > On Thu, 2026-02-26 at 16:49 +0000, Matthew Wilcox wrote:
> > > On Thu, Feb 26, 2026 at 10:55:02AM -0500, Jeff Layton wrote:
> > > > The bulk of the changes are to format strings and tracepoints, since the
> > > > kernel itself doesn't care that much about the i_ino field. The first
> > > > patch changes some vfs function arguments, so check that one out
> > > > carefully.
> > >
> > > Why are the format strings all done as separate patches? Don't we get
> > > bisection hazards by splitting it apart this way?
> >
> > Circling back to this...
> >
> > I have a v2 series (~107 patches) that I'm testing now that does this
> > more bisectably with the typedef and macro scaffolding that Mathieu
> > suggested. I'll probably send it early next week.
> >
> > I had done it this way originally since I figured it was best to break
> > this up by subsystem. Should I continue with this series as a set of
> > patches broken up this way, or is it preferable to combine the pile of
> > format changes into fewer patches?
>
> Here is the approach I would recommend to maximize signal over noise
> for the follow up email thread discussions:
>
> Now that your series is bisectable, you could post a [RFC PATCH v2]
> series with the following:
>
> - Patch 00 introduces the series, points to your git branch implementing
> the whole series,
> - The first few patches introduce the new type (kino_t) and macro to
> do the format string transition. Initially kino_t would typedef to
> unsigned long (no changes).
> - Followed by patches implementing the type + format string changes for
> a few key subsystems.
> - The final patch would change kino_t and the format string macro to
> 64-bit integers.
>
That's pretty much the approach the set I have takes. The current set
is here:
https://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux.git/log/?h=iino-u64
My question was more about whether I should batch some of the changes
together. My inclination is that doing it in small, incremental patches
is a good thing, but I figured I'd ask before I spam everyone with a
100+ patch series.
> Once everyone agree on those core changes, you could proceed to post
> patches that change additional subsystems in a subsequent round.
>
> One more comment: have you tried using Coccinelle to do this kind of
> semantic code change ?
I've use coccinelle before for this sort of change, but my skills with
it are pretty primitive. The problem I saw with using it here is that
the main set of changes involved format strings, and that didn't look
straightforward to do with coccinelle. The LLM seems to have sorted it
out with no trouble though.
On a related note, has anyone has taught an LLM how to use Coccinelle.
I wonder if it might give it a better tool for its toolbox, since
Claude at least seems to mostly use bash, perl or python to make
changes across the tree.
--
Jeff Layton <jlayton@kernel.org>
^ permalink raw reply
* [PATCH] tracefs: Simplify get_dname() with kmemdup_nul()
From: AnishMulay @ 2026-02-27 19:44 UTC (permalink / raw)
To: rostedt, mhiramat
Cc: mathieu.desnoyers, linux-trace-kernel, linux-kernel, AnishMulay
In fs/tracefs/inode.c, get_dname() allocates a buffer with kmalloc()
to hold a dentry name, followed by a memcpy() and manual
null-termination.
Replace this open-coded pattern with the standard kmemdup_nul() helper.
Additionally, remove the now single-use local variables `dname` and
`len`. This simplifies the function to a single line, reducing visual
clutter and making the memory-safety intent immediately obvious without
changing any functional behavior.
Testing:
Booted a custom kernel natively in virtme-ng (ARM64). Triggered tracefs
inode and dentry allocation by creating and removing a custom directory
under a temporary tracefs mount. Verified that the instance is created
successfully and that no memory errors or warnings are emitted in dmesg.
Signed-off-by: AnishMulay <anishm7030@gmail.com>
---
fs/tracefs/inode.c | 12 +-----------
1 file changed, 1 insertion(+), 11 deletions(-)
diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index d9d8932a7b9c9..86ba8dc25aaef 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c
@@ -96,17 +96,7 @@ static struct tracefs_dir_ops {
static char *get_dname(struct dentry *dentry)
{
- const char *dname;
- char *name;
- int len = dentry->d_name.len;
-
- dname = dentry->d_name.name;
- name = kmalloc(len + 1, GFP_KERNEL);
- if (!name)
- return NULL;
- memcpy(name, dname, len);
- name[len] = 0;
- return name;
+ return kmemdup_nul(dentry->d_name.name, dentry->d_name.len, GFP_KERNEL);
}
static struct dentry *tracefs_syscall_mkdir(struct mnt_idmap *idmap,
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v4 5/5] mm: add tracepoints for zone lock
From: Steven Rostedt @ 2026-02-27 19:46 UTC (permalink / raw)
To: Dmitry Ilvokhin
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R. Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Axel Rasmussen, Yuanchu Xie,
Wei Xu, Masami Hiramatsu, Mathieu Desnoyers, Rafael J. Wysocki,
Pavel Machek, Len Brown, Brendan Jackman, Johannes Weiner, Zi Yan,
Oscar Salvador, Qi Zheng, Shakeel Butt, linux-kernel, linux-mm,
linux-trace-kernel, linux-pm, "linux-cxl
In-Reply-To: <ae145fe890f028409f727b4921904b547346fa0b.1772206930.git.d@ilvokhin.com>
On Fri, 27 Feb 2026 16:00:27 +0000
Dmitry Ilvokhin <d@ilvokhin.com> wrote:
> static inline void zone_lock_init(struct zone *zone)
> {
> @@ -12,26 +59,41 @@ static inline void zone_lock_init(struct zone *zone)
>
> #define zone_lock_irqsave(zone, flags) \
> do { \
> + bool success = true; \
> + \
> + __zone_lock_trace_start_locking(zone); \
> spin_lock_irqsave(&(zone)->_lock, flags); \
> + __zone_lock_trace_acquire_returned(zone, success); \
Why the "success" variable and not just:
__zone_lock_trace_acquire_returned(zone, true);
?
> } while (0)
>
> #define zone_trylock_irqsave(zone, flags) \
> ({ \
> - spin_trylock_irqsave(&(zone)->_lock, flags); \
> + bool success; \
> + \
> + __zone_lock_trace_start_locking(zone); \
> + success = spin_trylock_irqsave(&(zone)->_lock, flags); \
> + __zone_lock_trace_acquire_returned(zone, success); \
> + success; \
> })
>
> static inline void zone_unlock_irqrestore(struct zone *zone, unsigned long flags)
> {
> + __zone_lock_trace_released(zone);
> spin_unlock_irqrestore(&zone->_lock, flags);
> }
>
> static inline void zone_lock_irq(struct zone *zone)
> {
> + bool success = true;
> +
> + __zone_lock_trace_start_locking(zone);
> spin_lock_irq(&zone->_lock);
> + __zone_lock_trace_acquire_returned(zone, success);
Same here.
> }
>
> static inline void zone_unlock_irq(struct zone *zone)
> {
> + __zone_lock_trace_released(zone);
> spin_unlock_irq(&zone->_lock);
> }
>
-- Steve
^ permalink raw reply
* Re: [PATCH] tracefs: Simplify get_dname() with kmemdup_nul()
From: Al Viro @ 2026-02-27 20:18 UTC (permalink / raw)
To: AnishMulay
Cc: rostedt, mhiramat, mathieu.desnoyers, linux-trace-kernel,
linux-kernel
In-Reply-To: <20260227194453.213095-1-anishm7030@gmail.com>
On Fri, Feb 27, 2026 at 02:44:53PM -0500, AnishMulay wrote:
> index d9d8932a7b9c9..86ba8dc25aaef 100644
> --- a/fs/tracefs/inode.c
> +++ b/fs/tracefs/inode.c
> @@ -96,17 +96,7 @@ static struct tracefs_dir_ops {
>
> static char *get_dname(struct dentry *dentry)
> {
> - const char *dname;
> - char *name;
> - int len = dentry->d_name.len;
> -
> - dname = dentry->d_name.name;
> - name = kmalloc(len + 1, GFP_KERNEL);
> - if (!name)
> - return NULL;
> - memcpy(name, dname, len);
> - name[len] = 0;
> - return name;
> + return kmemdup_nul(dentry->d_name.name, dentry->d_name.len, GFP_KERNEL);
> }
Why not have the callers use {take,release}_dentry_name_snapshot()
instead of doing any allocations at all?
I mean,
static struct dentry *tracefs_syscall_mkdir(struct mnt_idmap *idmap,
struct inode *inode, struct dentry *dentry,
umode_t mode)
{
struct tracefs_inode *ti;
struct name_snapshot s;
int ret;
take_dentry_name_snapshot(&s, dentry);
...
ret = tracefs_ops.mkdir(s.name.name);
release_dentry_name_snapshot(&s);
...
}
and similar on the rmdir side. Then remove get_dname()...
^ permalink raw reply
* Re: [PATCH v4 1/5] mm: introduce zone lock wrappers
From: David Hildenbrand (Arm) @ 2026-02-27 20:36 UTC (permalink / raw)
To: Dmitry Ilvokhin, Andrew Morton, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Axel Rasmussen, Yuanchu Xie, Wei Xu, Steven Rostedt,
Masami Hiramatsu, Mathieu Desnoyers, Rafael J. Wysocki,
Pavel Machek, Len Brown, Brendan Jackman, Johannes Weiner, Zi Yan,
Oscar Salvador, Qi Zheng, Shakeel Butt
Cc: linux-kernel, linux-mm, linux-trace-kernel, linux-pm,
"linux-cxl
In-Reply-To: <849dee9c47df1e6fba97c9933af0d5a08b8e15d3.1772206930.git.d@ilvokhin.com>
On 2/27/26 17:00, Dmitry Ilvokhin wrote:
> Add thin wrappers around zone lock acquire/release operations. This
> prepares the code for future tracepoint instrumentation without
> modifying individual call sites.
>
> Centralizing zone lock operations behind wrappers allows future
> instrumentation or debugging hooks to be added without touching
> all users.
>
> No functional change intended. The wrappers are introduced in
> preparation for subsequent patches and are not yet used.
>
> Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
> Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
> ---
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
--
Cheers,
David
^ permalink raw reply
* Re: [PATCHv6 bpf-next 9/9] bpf,x86: Use single ftrace_ops for direct calls
From: Jiri Olsa @ 2026-02-27 20:37 UTC (permalink / raw)
To: Ihor Solodrai
Cc: Steven Rostedt, Florent Revest, Mark Rutland, bpf, linux-kernel,
linux-trace-kernel, linux-arm-kernel, Alexei Starovoitov,
Daniel Borkmann, Andrii Nakryiko, Menglong Dong, Song Liu,
Kumar Kartikeya Dwivedi
In-Reply-To: <1b58ffb2-92ae-433a-ba46-95294d6edea2@linux.dev>
On Fri, Feb 27, 2026 at 09:40:12AM -0800, Ihor Solodrai wrote:
> On 12/30/25 6:50 AM, Jiri Olsa wrote:
> > Using single ftrace_ops for direct calls update instead of allocating
> > ftrace_ops object for each trampoline.
> >
> > With single ftrace_ops object we can use update_ftrace_direct_* api
> > that allows multiple ip sites updates on single ftrace_ops object.
> >
> > Adding HAVE_SINGLE_FTRACE_DIRECT_OPS config option to be enabled on
> > each arch that supports this.
> >
> > At the moment we can enable this only on x86 arch, because arm relies
> > on ftrace_ops object representing just single trampoline image (stored
> > in ftrace_ops::direct_call). Archs that do not support this will continue
> > to use *_ftrace_direct api.
> >
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
>
> Hi Jiri,
>
> Me and Kumar stumbled on kernel splats with "ftrace failed to modify",
> and if running with KASAN:
>
> BUG: KASAN: slab-use-after-free in __get_valid_kprobe+0x224/0x2a0
>
> Pasting a full splat example at the bottom.
>
> I was able to create a reproducer with AI, and then used it to bisect
> to this patch. You can run it with ./test_progs -t ftrace_direct_race
>
> Below is my (human-generated, haha) summary of AI's analysis of what's
> happening. It makes sense to me conceptually, but I don't know enough
> details here to call bullshit. Please take a look:
hi, nice :)
>
> With CONFIG_HAVE_SINGLE_FTRACE_DIRECT_OPS ftrace_replace_code()
> operates on all call sites in the shared ops. Then if a concurrent
> ftrace user (like kprobe) modifies a call site in between
> ftrace_replace_code's verify pass and its patch pass, then ftrace_bug
> fires and sets ftrace_disabled to 1.
hum, I'd think that's all under ftrace_lock/direct_mutex,
but we might be missing some paths
>
> Once ftrace is disabled, direct_ops_del silently fails to unregister
> the direct call, and the call site still redirects to the stale
> trampoline. After the BPF program is freed, we'll get use-after-free
> on the next trace hit.
>
> The reproducer is not great, because if everything is fine it just hangs.
> But with the bug the kernel crashes pretty fast.
perfect, I reproduced it on first run.. will check
> Maybe it makes sense to refine it to a proper "stress" selftest?
it might, let's see what's the problem
great report, thanks a lot for all the details and reproducer,
jirka
>
> Reproducer patch:
>
> From c595ef5a0ad9bc62d768080ff09502bc982c40e6 Mon Sep 17 00:00:00 2001
> From: Ihor Solodrai <ihor.solodrai@linux.dev>
> Date: Thu, 26 Feb 2026 17:00:39 -0800
> Subject: [PATCH] reproducer
>
> ---
> .../bpf/prog_tests/ftrace_direct_race.c | 243 ++++++++++++++++++
> 1 file changed, 243 insertions(+)
> create mode 100644 tools/testing/selftests/bpf/prog_tests/ftrace_direct_race.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/ftrace_direct_race.c b/tools/testing/selftests/bpf/prog_tests/ftrace_direct_race.c
> new file mode 100644
> index 000000000000..369c55364d05
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/ftrace_direct_race.c
> @@ -0,0 +1,243 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2026 Meta Platforms, Inc. and affiliates. */
> +
> +/* Test to reproduce ftrace race between BPF trampoline attach/detach
> + * and kprobe attach/detach on the same function.
> + *
> + * With CONFIG_HAVE_SINGLE_FTRACE_DIRECT_OPS, all BPF trampolines share
> + * a single ftrace_ops. Concurrent modifications (BPF trampoline vs kprobe)
> + * can race in ftrace_replace_code's verify-then-patch sequence, causing
> + * ftrace to become permanently disabled and leaving stale trampolines
> + * that reference freed BPF programs.
> + *
> + * Run with: ./test_progs -t ftrace_direct_race
> + */
> +#include <test_progs.h>
> +#include <bpf/libbpf.h>
> +#include <pthread.h>
> +#include <sys/ioctl.h>
> +#include <linux/perf_event.h>
> +#include <sys/syscall.h>
> +
> +#include "fentry_test.lskel.h"
> +
> +#define NUM_ITERATIONS 200
> +
> +static volatile bool stop;
> +
> +/* Thread 1: Rapidly attach and detach fentry BPF trampolines */
> +static void *fentry_thread_fn(void *arg)
> +{
> + int i;
> +
> + for (i = 0; i < NUM_ITERATIONS && !stop; i++) {
> + struct fentry_test_lskel *skel;
> + int err;
> +
> + skel = fentry_test_lskel__open();
> + if (!skel)
> + continue;
> +
> + skel->keyring_id = KEY_SPEC_SESSION_KEYRING;
> + err = fentry_test_lskel__load(skel);
> + if (err) {
> + fentry_test_lskel__destroy(skel);
> + continue;
> + }
> +
> + err = fentry_test_lskel__attach(skel);
> + if (err) {
> + fentry_test_lskel__destroy(skel);
> + continue;
> + }
> +
> + /* Brief sleep to let the trampoline be live while kprobes race */
> + usleep(100 + rand() % 500);
> +
> + fentry_test_lskel__detach(skel);
> + fentry_test_lskel__destroy(skel);
> + }
> +
> + return NULL;
> +}
> +
> +/* Thread 2: Rapidly create and destroy kprobes via tracefs on
> + * bpf_fentry_test* functions (the same functions the fentry thread targets).
> + * Creating/removing kprobe events goes through the ftrace code patching
> + * path that can race with BPF trampoline direct call operations.
> + */
> +static void *kprobe_thread_fn(void *arg)
> +{
> + const char *funcs[] = {
> + "bpf_fentry_test1",
> + "bpf_fentry_test2",
> + "bpf_fentry_test3",
> + "bpf_fentry_test4",
> + "bpf_fentry_test5",
> + "bpf_fentry_test6",
> + };
> + int i;
> +
> + for (i = 0; i < NUM_ITERATIONS && !stop; i++) {
> + int j;
> +
> + for (j = 0; j < 6 && !stop; j++) {
> + char cmd[256];
> +
> + /* Create kprobe via tracefs */
> + snprintf(cmd, sizeof(cmd),
> + "echo 'p:kprobe_race_%d %s' >> /sys/kernel/debug/tracing/kprobe_events 2>/dev/null",
> + j, funcs[j]);
> + system(cmd);
> +
> + /* Small delay */
> + usleep(50 + rand() % 200);
> +
> + /* Remove kprobe */
> + snprintf(cmd, sizeof(cmd),
> + "echo '-:kprobe_race_%d' >> /sys/kernel/debug/tracing/kprobe_events 2>/dev/null",
> + j);
> + system(cmd);
> + }
> + }
> +
> + return NULL;
> +}
> +
> +/* Thread 3: Create kprobes via perf_event_open (the ftrace-based kind)
> + * which go through the arm_kprobe / disarm_kprobe ftrace path.
> + */
> +static void *perf_kprobe_thread_fn(void *arg)
> +{
> + const char *funcs[] = {
> + "bpf_fentry_test1",
> + "bpf_fentry_test2",
> + "bpf_fentry_test3",
> + };
> + int i;
> +
> + for (i = 0; i < NUM_ITERATIONS && !stop; i++) {
> + int fds[3] = {-1, -1, -1};
> + int j;
> +
> + for (j = 0; j < 3 && !stop; j++) {
> + struct perf_event_attr attr = {};
> + char path[256];
> + char buf[32];
> + char cmd[256];
> + int id_fd, id;
> +
> + /* Create kprobe event */
> + snprintf(cmd, sizeof(cmd),
> + "echo 'p:perf_race_%d %s' >> /sys/kernel/debug/tracing/kprobe_events 2>/dev/null",
> + j, funcs[j]);
> + system(cmd);
> +
> + /* Try to get the event id */
> + snprintf(path, sizeof(path),
> + "/sys/kernel/debug/tracing/events/kprobes/perf_race_%d/id", j);
> + id_fd = open(path, O_RDONLY);
> + if (id_fd < 0)
> + continue;
> +
> + memset(buf, 0, sizeof(buf));
> + if (read(id_fd, buf, sizeof(buf) - 1) > 0)
> + id = atoi(buf);
> + else
> + id = -1;
> + close(id_fd);
> +
> + if (id < 0)
> + continue;
> +
> + /* Open perf event to arm the kprobe via ftrace */
> + attr.type = PERF_TYPE_TRACEPOINT;
> + attr.size = sizeof(attr);
> + attr.config = id;
> + attr.sample_type = PERF_SAMPLE_RAW;
> + attr.sample_period = 1;
> + attr.wakeup_events = 1;
> +
> + fds[j] = syscall(__NR_perf_event_open, &attr, -1, 0, -1, 0);
> + if (fds[j] >= 0)
> + ioctl(fds[j], PERF_EVENT_IOC_ENABLE, 0);
> + }
> +
> + usleep(100 + rand() % 300);
> +
> + /* Close perf events (disarms kprobes via ftrace) */
> + for (j = 0; j < 3; j++) {
> + char cmd[256];
> +
> + if (fds[j] >= 0)
> + close(fds[j]);
> +
> + snprintf(cmd, sizeof(cmd),
> + "echo '-:perf_race_%d' >> /sys/kernel/debug/tracing/kprobe_events 2>/dev/null",
> + j);
> + system(cmd);
> + }
> + }
> +
> + return NULL;
> +}
> +
> +void test_ftrace_direct_race(void)
> +{
> + pthread_t fentry_tid, kprobe_tid, perf_kprobe_tid;
> + int err;
> +
> + /* Check if ftrace is currently operational */
> + if (!ASSERT_OK(access("/sys/kernel/debug/tracing/kprobe_events", W_OK),
> + "tracefs_access"))
> + return;
> +
> + stop = false;
> +
> + err = pthread_create(&fentry_tid, NULL, fentry_thread_fn, NULL);
> + if (!ASSERT_OK(err, "create_fentry_thread"))
> + return;
> +
> + err = pthread_create(&kprobe_tid, NULL, kprobe_thread_fn, NULL);
> + if (!ASSERT_OK(err, "create_kprobe_thread")) {
> + stop = true;
> + pthread_join(fentry_tid, NULL);
> + return;
> + }
> +
> + err = pthread_create(&perf_kprobe_tid, NULL, perf_kprobe_thread_fn, NULL);
> + if (!ASSERT_OK(err, "create_perf_kprobe_thread")) {
> + stop = true;
> + pthread_join(fentry_tid, NULL);
> + pthread_join(kprobe_tid, NULL);
> + return;
> + }
> +
> + pthread_join(fentry_tid, NULL);
> + pthread_join(kprobe_tid, NULL);
> + pthread_join(perf_kprobe_tid, NULL);
> +
> + /* If we get here without a kernel panic/oops, the test passed.
> + * The real check is in dmesg: look for
> + * "WARNING: arch/x86/kernel/ftrace.c" or
> + * "BUG: KASAN: vmalloc-out-of-bounds in __bpf_prog_enter_recur"
> + *
> + * A more robust check: verify ftrace is still operational.
> + */
> + ASSERT_OK(access("/sys/kernel/debug/tracing/kprobe_events", W_OK),
> + "ftrace_still_operational");
> +
> + /* Check that ftrace wasn't disabled */
> + {
> + char buf[64] = {};
> + int fd = open("/proc/sys/kernel/ftrace_enabled", O_RDONLY);
> +
> + if (ASSERT_GE(fd, 0, "open_ftrace_enabled")) {
> + int n = read(fd, buf, sizeof(buf) - 1);
> +
> + close(fd);
> + if (n > 0)
> + ASSERT_EQ(atoi(buf), 1, "ftrace_enabled");
> + }
> + }
> +}
> --
> 2.47.3
>
>
> ----
>
> Splat:
>
> [ 24.170803] ------------[ cut here ]------------
> [ 24.171055] WARNING: kernel/trace/ftrace.c:2715 at ftrace_get_addr_curr+0x149/0x190, CPU#13: kworker/13:6/873
> [ 24.171315] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
> [ 24.171561] CPU: 13 UID: 0 PID: 873 Comm: kworker/13:6 Tainted: G OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
> [ 24.171827] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 24.171941] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
> [ 24.172132] Workqueue: events bpf_link_put_deferred
> [ 24.172261] RIP: 0010:ftrace_get_addr_curr+0x149/0x190
> [ 24.172376] Code: 00 4c 89 f7 e8 88 f8 ff ff 84 c0 75 92 4d 8b 7f 08 e8 fb b3 c1 00 4d 85 ff 0f 94 c0 49 81 ff b0 1c 6e 83 0f 94 c1 08 c1 74 96 <0f> 0b c6 05
> 62 e8 2b 02 01 c7 05 54 e8 2b 02 00 00 00 00 48 c7 05
> [ 24.172745] RSP: 0018:ffa0000504cafb78 EFLAGS: 00010202
> [ 24.172861] RAX: 0000000000000000 RBX: ff110001000e48d0 RCX: ff1100011cd3a201
> [ 24.173034] RDX: 6e21cb51d943709c RSI: 0000000000000000 RDI: ffffffff81d416d4
> [ 24.173194] RBP: 0000000000000001 R08: 0000000080000000 R09: ffffffffffffffff
> [ 24.173366] R10: ffffffff81285522 R11: 0000000000000000 R12: ff110001000e48d0
> [ 24.173530] R13: ffffffff81d416d4 R14: ffffffff81d416d4 R15: ffffffff836e1cb0
> [ 24.173691] FS: 0000000000000000(0000) GS:ff1100203becc000(0000) knlGS:0000000000000000
> [ 24.173849] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 24.173995] CR2: 00007f615e966270 CR3: 000000010bd9d005 CR4: 0000000000771ef0
> [ 24.174155] PKRU: 55555554
> [ 24.174214] Call Trace:
> [ 24.174285] <TASK>
> [ 24.174348] ftrace_replace_code+0x7e/0x210
> [ 24.174443] ftrace_modify_all_code+0x59/0x110
> [ 24.174553] __ftrace_hash_move_and_update_ops+0x227/0x2c0
> [ 24.174659] ? kfree+0x1ac/0x4c0
> [ 24.174751] ? srso_return_thunk+0x5/0x5f
> [ 24.174834] ? kfree+0x250/0x4c0
> [ 24.174926] ? kfree+0x1ac/0x4c0
> [ 24.175010] ? bpf_lsm_sk_alloc_security+0x4/0x20
> [ 24.175132] ftrace_update_ops+0x40/0x80
> [ 24.175217] update_ftrace_direct_del+0x263/0x290
> [ 24.175341] ? bpf_lsm_sk_alloc_security+0x4/0x20
> [ 24.175456] ? 0xffffffffc0006a80
> [ 24.175543] bpf_trampoline_update+0x1fb/0x810
> [ 24.175654] bpf_trampoline_unlink_prog+0x103/0x1a0
> [ 24.175767] ? process_scheduled_works+0x271/0x640
> [ 24.175886] bpf_shim_tramp_link_release+0x20/0x40
> [ 24.176001] bpf_link_free+0x54/0xd0
> [ 24.176092] process_scheduled_works+0x2c2/0x640
> [ 24.176222] worker_thread+0x22a/0x340 21:11:27 [422/10854]
> [ 24.176319] ? srso_return_thunk+0x5/0x5f
> [ 24.176405] ? __pfx_worker_thread+0x10/0x10
> [ 24.176522] kthread+0x10c/0x140
> [ 24.176611] ? __pfx_kthread+0x10/0x10
> [ 24.176698] ret_from_fork+0x148/0x290
> [ 24.176785] ? __pfx_kthread+0x10/0x10
> [ 24.176872] ret_from_fork_asm+0x1a/0x30
> [ 24.176985] </TASK>
> [ 24.177043] irq event stamp: 6965
> [ 24.177126] hardirqs last enabled at (6973): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
> [ 24.177325] hardirqs last disabled at (6982): [<ffffffff81360071>] __console_unlock+0x41/0x70
> [ 24.177520] softirqs last enabled at (6524): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.177675] softirqs last disabled at (6123): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.177844] ---[ end trace 0000000000000000 ]---
> [ 24.177963] Bad trampoline accounting at: 000000003143da54 (bpf_fentry_test3+0x4/0x20)
> [ 24.178134] ------------[ cut here ]------------
> [ 24.178261] WARNING: arch/x86/kernel/ftrace.c:105 at ftrace_replace_code+0xf7/0x210, CPU#13: kworker/13:6/873
> [ 24.178476] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
> [ 24.178680] CPU: 13 UID: 0 PID: 873 Comm: kworker/13:6 Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
> [ 24.178925] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 24.179059] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
> [ 24.179258] Workqueue: events bpf_link_put_deferred
> [ 24.179374] RIP: 0010:ftrace_replace_code+0xf7/0x210
> [ 24.179485] Code: c0 0f 85 ec 00 00 00 8b 44 24 03 41 33 45 00 0f b6 4c 24 07 41 32 4d 04 0f b6 c9 09 c1 0f 84 49 ff ff ff 4c 89 2d b9 df 8b 03 <0f> 0b bf ea
> ff ff ff e9 c4 00 00 00 e8 f8 e5 19 00 48 85 c0 0f 84
> [ 24.179847] RSP: 0018:ffa0000504cafb98 EFLAGS: 00010202
> [ 24.179965] RAX: 0000000038608000 RBX: 0000000000000001 RCX: 00000000386080c1
> [ 24.180126] RDX: ffffffff81d41000 RSI: 0000000000000005 RDI: ffffffff81d416d4
> [ 24.180295] RBP: 0000000000000001 R08: 000000000000ffff R09: ffffffff82e98430
> [ 24.180455] R10: 000000000002fffd R11: 00000000fffeffff R12: ff110001000e48d0
> [ 24.180617] R13: ffffffff83ec0f2d R14: ffffffff84b43820 R15: ffa0000504cafb9b
> [ 24.180777] FS: 0000000000000000(0000) GS:ff1100203becc000(0000) knlGS:0000000000000000
> [ 24.180939] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 24.181077] CR2: 00007f615e966270 CR3: 000000010bd9d005 CR4: 0000000000771ef0
> [ 24.181247] PKRU: 55555554
> [ 24.181303] Call Trace:
> [ 24.181360] <TASK>
> [ 24.181424] ftrace_modify_all_code+0x59/0x110
> [ 24.181536] __ftrace_hash_move_and_update_ops+0x227/0x2c0
> [ 24.181650] ? kfree+0x1ac/0x4c0
> [ 24.181743] ? srso_return_thunk+0x5/0x5f
> [ 24.181828] ? kfree+0x250/0x4c0
> [ 24.181916] ? kfree+0x1ac/0x4c0
> [ 24.182004] ? bpf_lsm_sk_alloc_security+0x4/0x20
> [ 24.182123] ftrace_update_ops+0x40/0x80
> [ 24.182213] update_ftrace_direct_del+0x263/0x290
> [ 24.182337] ? bpf_lsm_sk_alloc_security+0x4/0x20
> [ 24.182455] ? 0xffffffffc0006a80
> [ 24.182543] bpf_trampoline_update+0x1fb/0x810
> [ 24.182655] bpf_trampoline_unlink_prog+0x103/0x1a0
> [ 24.182768] ? process_scheduled_works+0x271/0x640
> [ 24.182887] bpf_shim_tramp_link_release+0x20/0x40
> [ 24.183001] bpf_link_free+0x54/0xd0
> [ 24.183088] process_scheduled_works+0x2c2/0x640
> [ 24.183220] worker_thread+0x22a/0x340 21:11:27 [367/10854]
> [ 24.183319] ? srso_return_thunk+0x5/0x5f
> [ 24.183405] ? __pfx_worker_thread+0x10/0x10
> [ 24.183521] kthread+0x10c/0x140
> [ 24.183610] ? __pfx_kthread+0x10/0x10
> [ 24.183697] ret_from_fork+0x148/0x290
> [ 24.183783] ? __pfx_kthread+0x10/0x10
> [ 24.183868] ret_from_fork_asm+0x1a/0x30
> [ 24.183979] </TASK>
> [ 24.184056] irq event stamp: 7447
> [ 24.184138] hardirqs last enabled at (7455): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
> [ 24.184339] hardirqs last disabled at (7464): [<ffffffff81360071>] __console_unlock+0x41/0x70
> [ 24.184522] softirqs last enabled at (6524): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.184675] softirqs last disabled at (6123): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.184836] ---[ end trace 0000000000000000 ]---
> [ 24.185177] ------------[ ftrace bug ]------------
> [ 24.185310] ftrace failed to modify
> [ 24.185312] [<ffffffff81d416d4>] bpf_fentry_test3+0x4/0x20
> [ 24.185544] actual: e8:27:29:6c:3e
> [ 24.185627] expected: e8:a7:49:54:ff
> [ 24.185717] ftrace record flags: e8180000
> [ 24.185798] (0) R tramp: ERROR!
> [ 24.185798] expected tramp: ffffffffc0404000
> [ 24.185975] ------------[ cut here ]------------
> [ 24.186086] WARNING: kernel/trace/ftrace.c:2254 at ftrace_bug+0x101/0x290, CPU#13: kworker/13:6/873
> [ 24.186285] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
> [ 24.186484] CPU: 13 UID: 0 PID: 873 Comm: kworker/13:6 Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
> [ 24.186728] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 24.186863] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
> [ 24.187057] Workqueue: events bpf_link_put_deferred
> [ 24.187172] RIP: 0010:ftrace_bug+0x101/0x290
> [ 24.187294] Code: 05 72 03 83 f8 02 7f 13 83 f8 01 74 46 83 f8 02 75 13 48 c7 c7 41 a3 69 82 eb 51 83 f8 03 74 3c 83 f8 04 74 40 48 85 db 75 4c <0f> 0b c6 05
> ba eb 2b 02 01 c7 05 ac eb 2b 02 00 00 00 00 48 c7 05
> [ 24.187663] RSP: 0018:ffa0000504cafb70 EFLAGS: 00010246
> [ 24.187772] RAX: 0000000000000022 RBX: ff110001000e48d0 RCX: e5ff63967b168c00
> [ 24.187934] RDX: 0000000000000000 RSI: 00000000fffeffff RDI: ffffffff83018490
> [ 24.188096] RBP: 00000000ffffffea R08: 000000000000ffff R09: ffffffff82e98430
> [ 24.188267] R10: 000000000002fffd R11: 00000000fffeffff R12: ff110001000e48d0
> [ 24.188423] R13: ffffffff83ec0f2d R14: ffffffff81d416d4 R15: ffffffff836e1cb0
> [ 24.188581] FS: 0000000000000000(0000) GS:ff1100203becc000(0000) knlGS:0000000000000000
> [ 24.188738] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 24.188870] CR2: 00007f615e966270 CR3: 000000010bd9d005 CR4: 0000000000771ef0
> [ 24.189032] PKRU: 55555554
> [ 24.189088] Call Trace:
> [ 24.189144] <TASK>
> [ 24.189204] ftrace_replace_code+0x1d6/0x210
> [ 24.189335] ftrace_modify_all_code+0x59/0x110
> [ 24.189443] __ftrace_hash_move_and_update_ops+0x227/0x2c0
> [ 24.189554] ? kfree+0x1ac/0x4c0
> [ 24.189638] ? srso_return_thunk+0x5/0x5f
> [ 24.189720] ? kfree+0x250/0x4c0
> [ 24.189802] ? kfree+0x1ac/0x4c0
> [ 24.189889] ? bpf_lsm_sk_alloc_security+0x4/0x20
> [ 24.190010] ftrace_update_ops+0x40/0x80
> [ 24.190095] update_ftrace_direct_del+0x263/0x290
> [ 24.190205] ? bpf_lsm_sk_alloc_security+0x4/0x20 21:11:28 [312/10854]
> [ 24.190335] ? 0xffffffffc0006a80
> [ 24.190422] bpf_trampoline_update+0x1fb/0x810
> [ 24.190542] bpf_trampoline_unlink_prog+0x103/0x1a0
> [ 24.190651] ? process_scheduled_works+0x271/0x640
> [ 24.190764] bpf_shim_tramp_link_release+0x20/0x40
> [ 24.190871] bpf_link_free+0x54/0xd0
> [ 24.190964] process_scheduled_works+0x2c2/0x640
> [ 24.191093] worker_thread+0x22a/0x340
> [ 24.191177] ? srso_return_thunk+0x5/0x5f
> [ 24.191274] ? __pfx_worker_thread+0x10/0x10
> [ 24.191388] kthread+0x10c/0x140
> [ 24.191478] ? __pfx_kthread+0x10/0x10
> [ 24.191565] ret_from_fork+0x148/0x290
> [ 24.191641] ? __pfx_kthread+0x10/0x10
> [ 24.191729] ret_from_fork_asm+0x1a/0x30
> [ 24.191833] </TASK>
> [ 24.191896] irq event stamp: 8043
> [ 24.191979] hardirqs last enabled at (8051): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
> [ 24.192167] hardirqs last disabled at (8058): [<ffffffff81360071>] __console_unlock+0x41/0x70
> [ 24.192368] softirqs last enabled at (7828): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.192528] softirqs last disabled at (7817): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.192689] ---[ end trace 0000000000000000 ]---
> [ 24.193549] ------------[ cut here ]------------
> [ 24.193773] WARNING: kernel/trace/ftrace.c:2709 at ftrace_get_addr_curr+0x6c/0x190, CPU#10: test_progs/311
> [ 24.193973] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
> [ 24.194206] CPU: 10 UID: 0 PID: 311 Comm: test_progs Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
> [ 24.194461] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 24.194594] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
> [ 24.194778] RIP: 0010:ftrace_get_addr_curr+0x6c/0x190
> [ 24.194891] Code: 48 0f 44 ce 4c 8b 3c c8 e8 e1 b4 c1 00 4d 85 ff 74 18 4d 39 77 10 74 05 4d 8b 3f eb eb 49 8b 47 18 48 85 c0 0f 85 19 01 00 00 <0f> 0b 48 8b
> 43 08 a9 00 00 00 08 75 1c a9 00 00 00 20 48 c7 c1 80
> [ 24.195270] RSP: 0018:ffa0000000d4bb38 EFLAGS: 00010246
> [ 24.195381] RAX: 0000000000000001 RBX: ff11000100125710 RCX: ff1100010b28a2c0
> [ 24.195540] RDX: 0000000000000003 RSI: 0000000000000003 RDI: ff11000100125710
> [ 24.195698] RBP: 0000000000000001 R08: 0000000080000000 R09: ffffffffffffffff
> [ 24.195863] R10: ffffffff82046a38 R11: 0000000000000000 R12: ff11000100125710
> [ 24.196033] R13: ffffffff81529fc4 R14: ffffffff81529fc4 R15: 0000000000000000
> [ 24.196199] FS: 00007f46532a54c0(0000) GS:ff1100203be0c000(0000) knlGS:0000000000000000
> [ 24.196374] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 24.196509] CR2: 000055e885be1470 CR3: 000000010eef9003 CR4: 0000000000771ef0
> [ 24.196663] PKRU: 55555554
> [ 24.196720] Call Trace:
> [ 24.196778] <TASK>
> [ 24.196844] ftrace_replace_code+0x7e/0x210
> [ 24.196948] ftrace_modify_all_code+0x59/0x110
> [ 24.197059] __ftrace_hash_move_and_update_ops+0x227/0x2c0
> [ 24.197174] ? srso_return_thunk+0x5/0x5f
> [ 24.197271] ? __mutex_lock+0x22a/0xc60
> [ 24.197360] ? kfree+0x1ac/0x4c0
> [ 24.197455] ? srso_return_thunk+0x5/0x5f
> [ 24.197538] ? kfree+0x250/0x4c0
> [ 24.197626] ? bpf_fentry_test3+0x4/0x20
> [ 24.197712] ftrace_set_hash+0x13c/0x3d0
> [ 24.197811] ftrace_set_filter_ip+0x88/0xb0
> [ 24.197909] ? bpf_fentry_test3+0x4/0x20 21:11:28 [257/10854]
> [ 24.198000] disarm_kprobe_ftrace+0x83/0xd0
> [ 24.198089] __disable_kprobe+0x129/0x160
> [ 24.198178] disable_kprobe+0x27/0x60
> [ 24.198272] kprobe_register+0xa2/0xe0
> [ 24.198362] perf_trace_event_unreg+0x33/0xd0
> [ 24.198473] perf_kprobe_destroy+0x3b/0x80
> [ 24.198557] __free_event+0x119/0x290
> [ 24.198640] perf_event_release_kernel+0x1ef/0x220
> [ 24.198758] perf_release+0x12/0x20
> [ 24.198843] __fput+0x11b/0x2a0
> [ 24.198946] task_work_run+0x8b/0xc0
> [ 24.199035] exit_to_user_mode_loop+0x107/0x4d0
> [ 24.199155] do_syscall_64+0x25b/0x390
> [ 24.199249] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 24.199360] ? trace_irq_disable+0x1d/0xc0
> [ 24.199451] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 24.199559] RIP: 0033:0x7f46530ff85b
> [ 24.199675] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 e3 83 f8 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0
> ff ff 77 35 44 89 c7 89 44 24 0c e8 41 84 f8 ff 8b 44
> [ 24.200034] RSP: 002b:00007ffc40859770 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 24.200192] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46530ff85b
> [ 24.200382] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000019
> [ 24.200552] RBP: 00007ffc408597c0 R08: 0000000000000000 R09: 00007ffc40859757
> [ 24.200702] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffc4085ddc8
> [ 24.200855] R13: 000055e8800de120 R14: 000055e88118d390 R15: 00007f46533de000
> [ 24.201035] </TASK>
> [ 24.201091] irq event stamp: 200379
> [ 24.201208] hardirqs last enabled at (200387): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
> [ 24.201453] hardirqs last disabled at (200396): [<ffffffff81360071>] __console_unlock+0x41/0x70
> [ 24.201667] softirqs last enabled at (200336): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.201890] softirqs last disabled at (200329): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.202121] ---[ end trace 0000000000000000 ]---
> [ 24.202398] ------------[ cut here ]------------
> [ 24.202534] WARNING: kernel/trace/ftrace.c:2715 at ftrace_get_addr_curr+0x149/0x190, CPU#10: test_progs/311
> [ 24.202753] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
> [ 24.202962] CPU: 10 UID: 0 PID: 311 Comm: test_progs Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
> [ 24.203203] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 24.203344] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
> [ 24.203526] RIP: 0010:ftrace_get_addr_curr+0x149/0x190
> [ 24.203629] Code: 00 4c 89 f7 e8 88 f8 ff ff 84 c0 75 92 4d 8b 7f 08 e8 fb b3 c1 00 4d 85 ff 0f 94 c0 49 81 ff b0 1c 6e 83 0f 94 c1 08 c1 74 96 <0f> 0b c6 05
> 62 e8 2b 02 01 c7 05 54 e8 2b 02 00 00 00 00 48 c7 05
> [ 24.203996] RSP: 0018:ffa0000000d4bb38 EFLAGS: 00010202
> [ 24.204110] RAX: 0000000000000000 RBX: ff11000100125710 RCX: ff1100010b28a201
> [ 24.204280] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff81529fc4
> [ 24.204437] RBP: 0000000000000001 R08: 0000000080000000 R09: ffffffffffffffff
> [ 24.204595] R10: ffffffff82046a38 R11: 0000000000000000 R12: ff11000100125710
> [ 24.204755] R13: ffffffff81529fc4 R14: ffffffff81529fc4 R15: ffffffff836e1cb0
> [ 24.204914] FS: 00007f46532a54c0(0000) GS:ff1100203be0c000(0000) knlGS:0000000000000000
> [ 24.205072] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 24.205204] CR2: 000055e885be1470 CR3: 000000010eef9003 CR4: 0000000000771ef0
> [ 24.205386] PKRU: 55555554
> [ 24.205443] Call Trace:
> [ 24.205503] <TASK>
> [ 24.205565] ftrace_replace_code+0x7e/0x210
> [ 24.205669] ftrace_modify_all_code+0x59/0x110 21:11:28 [202/10854]
> [ 24.205784] __ftrace_hash_move_and_update_ops+0x227/0x2c0
> [ 24.205902] ? srso_return_thunk+0x5/0x5f
> [ 24.205987] ? __mutex_lock+0x22a/0xc60
> [ 24.206072] ? kfree+0x1ac/0x4c0
> [ 24.206163] ? srso_return_thunk+0x5/0x5f
> [ 24.206254] ? kfree+0x250/0x4c0
> [ 24.206344] ? bpf_fentry_test3+0x4/0x20
> [ 24.206428] ftrace_set_hash+0x13c/0x3d0
> [ 24.206523] ftrace_set_filter_ip+0x88/0xb0
> [ 24.206614] ? bpf_fentry_test3+0x4/0x20
> [ 24.206703] disarm_kprobe_ftrace+0x83/0xd0
> [ 24.206789] __disable_kprobe+0x129/0x160
> [ 24.206880] disable_kprobe+0x27/0x60
> [ 24.206972] kprobe_register+0xa2/0xe0
> [ 24.207057] perf_trace_event_unreg+0x33/0xd0
> [ 24.207169] perf_kprobe_destroy+0x3b/0x80
> [ 24.207262] __free_event+0x119/0x290
> [ 24.207348] perf_event_release_kernel+0x1ef/0x220
> [ 24.207461] perf_release+0x12/0x20
> [ 24.207543] __fput+0x11b/0x2a0
> [ 24.207626] task_work_run+0x8b/0xc0
> [ 24.207711] exit_to_user_mode_loop+0x107/0x4d0
> [ 24.207827] do_syscall_64+0x25b/0x390
> [ 24.207915] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 24.208021] ? trace_irq_disable+0x1d/0xc0
> [ 24.208110] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 24.208215] RIP: 0033:0x7f46530ff85b
> [ 24.208307] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 e3 83 f8 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0
> ff ff 77 35 44 89 c7 89 44 24 0c e8 41 84 f8 ff 8b 44
> [ 24.208657] RSP: 002b:00007ffc40859770 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 24.208816] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46530ff85b
> [ 24.208978] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000019
> [ 24.209133] RBP: 00007ffc408597c0 R08: 0000000000000000 R09: 00007ffc40859757
> [ 24.209300] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffc4085ddc8
> [ 24.209457] R13: 000055e8800de120 R14: 000055e88118d390 R15: 00007f46533de000
> [ 24.209633] </TASK>
> [ 24.209689] irq event stamp: 200963
> [ 24.209770] hardirqs last enabled at (200971): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
> [ 24.209971] hardirqs last disabled at (200978): [<ffffffff81360071>] __console_unlock+0x41/0x70
> [ 24.210156] softirqs last enabled at (200568): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.210370] softirqs last disabled at (200557): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.210554] ---[ end trace 0000000000000000 ]---
> [ 24.210665] Bad trampoline accounting at: 00000000ab641fec (bpf_lsm_sk_alloc_security+0x4/0x20)
> [ 24.210866] ------------[ cut here ]------------
> [ 24.210993] WARNING: arch/x86/kernel/ftrace.c:105 at ftrace_replace_code+0xf7/0x210, CPU#10: test_progs/311
> [ 24.211182] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
> [ 24.211412] CPU: 10 UID: 0 PID: 311 Comm: test_progs Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
> [ 24.211656] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 24.211788] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
> [ 24.211980] RIP: 0010:ftrace_replace_code+0xf7/0x210
> [ 24.212091] Code: c0 0f 85 ec 00 00 00 8b 44 24 03 41 33 45 00 0f b6 4c 24 07 41 32 4d 04 0f b6 c9 09 c1 0f 84 49 ff ff ff 4c 89 2d b9 df 8b 03 <0f> 0b bf ea
> ff ff ff e9 c4 00 00 00 e8 f8 e5 19 00 48 85 c0 0f 84
> [ 24.212503] RSP: 0018:ffa0000000d4bb58 EFLAGS: 00010202
> [ 24.212628] RAX: 00000000780a0001 RBX: 0000000000000001 RCX: 00000000780a00c1
> [ 24.212798] RDX: ffffffff81529000 RSI: 0000000000000005 RDI: ffffffff81529fc4
> [ 24.212970] RBP: 0000000000000001 R08: 000000000000ffff R09: ffffffff82e98430
> [ 24.213130] R10: 000000000002fffd R11: 00000000fffeffff R12: ff11000100125710
> [ 24.213317] R13: ffffffff83ec0f2d R14: ffffffff84b43820 R15: ffa0000000d4bb5b
> [ 24.213488] FS: 00007f46532a54c0(0000) GS:ff1100203be0c000(0000) knlGS:0000000000000000
> [ 24.213674] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 24.213813] CR2: 000055e885be1470 CR3: 000000010eef9003 CR4: 0000000000771ef0
> [ 24.213986] PKRU: 55555554
> [ 24.214044] Call Trace:
> [ 24.214100] <TASK>
> [ 24.214167] ftrace_modify_all_code+0x59/0x110
> [ 24.214301] __ftrace_hash_move_and_update_ops+0x227/0x2c0
> [ 24.214415] ? srso_return_thunk+0x5/0x5f
> [ 24.214502] ? __mutex_lock+0x22a/0xc60
> [ 24.214588] ? kfree+0x1ac/0x4c0
> [ 24.214682] ? srso_return_thunk+0x5/0x5f
> [ 24.214765] ? kfree+0x250/0x4c0
> [ 24.214855] ? bpf_fentry_test3+0x4/0x20
> [ 24.214943] ftrace_set_hash+0x13c/0x3d0
> [ 24.215041] ftrace_set_filter_ip+0x88/0xb0
> [ 24.215132] ? bpf_fentry_test3+0x4/0x20
> [ 24.215221] disarm_kprobe_ftrace+0x83/0xd0
> [ 24.215328] __disable_kprobe+0x129/0x160
> [ 24.215418] disable_kprobe+0x27/0x60
> [ 24.215507] kprobe_register+0xa2/0xe0
> [ 24.215594] perf_trace_event_unreg+0x33/0xd0
> [ 24.215701] perf_kprobe_destroy+0x3b/0x80
> [ 24.215790] __free_event+0x119/0x290
> [ 24.215888] perf_event_release_kernel+0x1ef/0x220
> [ 24.216007] perf_release+0x12/0x20
> [ 24.216091] __fput+0x11b/0x2a0
> [ 24.216183] task_work_run+0x8b/0xc0
> [ 24.216293] exit_to_user_mode_loop+0x107/0x4d0
> [ 24.216411] do_syscall_64+0x25b/0x390
> [ 24.216497] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 24.216606] ? trace_irq_disable+0x1d/0xc0
> [ 24.216699] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 24.216807] RIP: 0033:0x7f46530ff85b
> [ 24.216895] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 e3 83 f8 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0
> ff ff 77 35 44 89 c7 89 44 24 0c e8 41 84 f8 ff 8b 44
> [ 24.217293] RSP: 002b:00007ffc40859770 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 24.217461] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46530ff85b
> [ 24.217627] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000019
> [ 24.217785] RBP: 00007ffc408597c0 R08: 0000000000000000 R09: 00007ffc40859757
> [ 24.217950] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffc4085ddc8
> [ 24.218107] R13: 000055e8800de120 R14: 000055e88118d390 R15: 00007f46533de000
> [ 24.218306] </TASK>
> [ 24.218363] irq event stamp: 201623
> [ 24.218445] hardirqs last enabled at (201631): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
> [ 24.218625] hardirqs last disabled at (201638): [<ffffffff81360071>] __console_unlock+0x41/0x70
> [ 24.218810] softirqs last enabled at (201612): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.219012] softirqs last disabled at (201601): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.219208] ---[ end trace 0000000000000000 ]---
> [ 24.219693] ------------[ ftrace bug ]------------
> [ 24.219801] ftrace failed to modify
> [ 24.219804] [<ffffffff81529fc4>] bpf_lsm_sk_alloc_security+0x4/0x20
> [ 24.220022] actual: e9:b7:ca:ad:3e
> [ 24.220113] expected: e8:b7:c0:d5:ff
> [ 24.220203] ftrace record flags: e8980000
> [ 24.220307] (0) R tramp: ERROR!
> [ 24.220321] ------------[ cut here ]------------
> [ 24.220507] WARNING: kernel/trace/ftrace.c:2715 at ftrace_get_addr_curr+0x149/0x190, CPU#10: test_progs/311
> [ 24.220693] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
> [ 24.220895] CPU: 10 UID: 0 PID: 311 Comm: test_progs Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
> [ 24.221135] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 24.221284] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
> [ 24.221467] RIP: 0010:ftrace_get_addr_curr+0x149/0x190
> [ 24.221577] Code: 00 4c 89 f7 e8 88 f8 ff ff 84 c0 75 92 4d 8b 7f 08 e8 fb b3 c1 00 4d 85 ff 0f 94 c0 49 81 ff b0 1c 6e 83 0f 94 c1 08 c1 74 96 <0f> 0b c6 05
> 62 e8 2b 02 01 c7 05 54 e8 2b 02 00 00 00 00 48 c7 05
> [ 24.221938] RSP: 0018:ffa0000000d4bb10 EFLAGS: 00010202
> [ 24.222052] RAX: 0000000000000000 RBX: ff11000100125710 RCX: ff1100010b28a201
> [ 24.222205] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff81529fc4
> [ 24.222384] RBP: 00000000ffffffea R08: 000000000000ffff R09: ffffffff82e98430
> [ 24.222542] R10: 000000000002fffd R11: 00000000fffeffff R12: ff11000100125710
> [ 24.222708] R13: ffffffff83ec0f2d R14: ffffffff81529fc4 R15: ffffffff836e1cb0
> [ 24.222866] FS: 00007f46532a54c0(0000) GS:ff1100203be0c000(0000) knlGS:0000000000000000
> [ 24.223034] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 24.223171] CR2: 000055e885be1470 CR3: 000000010eef9003 CR4: 0000000000771ef0
> [ 24.223341] PKRU: 55555554
> [ 24.223397] Call Trace:
> [ 24.223454] <TASK>
> [ 24.223511] ? bpf_lsm_sk_alloc_security+0x4/0x20
> [ 24.223623] ftrace_bug+0x1ff/0x290
> [ 24.223710] ftrace_replace_code+0x1d6/0x210
> [ 24.223829] ftrace_modify_all_code+0x59/0x110
> [ 24.223946] __ftrace_hash_move_and_update_ops+0x227/0x2c0
> [ 24.224060] ? srso_return_thunk+0x5/0x5f
> [ 24.224148] ? __mutex_lock+0x22a/0xc60
> [ 24.224245] ? kfree+0x1ac/0x4c0
> [ 24.224337] ? srso_return_thunk+0x5/0x5f
> [ 24.224420] ? kfree+0x250/0x4c0
> [ 24.224512] ? bpf_fentry_test3+0x4/0x20
> [ 24.224597] ftrace_set_hash+0x13c/0x3d0
> [ 24.224690] ftrace_set_filter_ip+0x88/0xb0
> [ 24.224776] ? bpf_fentry_test3+0x4/0x20
> [ 24.224869] disarm_kprobe_ftrace+0x83/0xd0
> [ 24.224965] __disable_kprobe+0x129/0x160
> [ 24.225051] disable_kprobe+0x27/0x60
> [ 24.225136] kprobe_register+0xa2/0xe0
> [ 24.225223] perf_trace_event_unreg+0x33/0xd0
> [ 24.225346] perf_kprobe_destroy+0x3b/0x80
> [ 24.225431] __free_event+0x119/0x290
> [ 24.225518] perf_event_release_kernel+0x1ef/0x220
> [ 24.225631] perf_release+0x12/0x20
> [ 24.225715] __fput+0x11b/0x2a0
> [ 24.225804] task_work_run+0x8b/0xc0
> [ 24.225895] exit_to_user_mode_loop+0x107/0x4d0
> [ 24.226016] do_syscall_64+0x25b/0x390
> [ 24.226099] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 24.226207] ? trace_irq_disable+0x1d/0xc0
> [ 24.226308] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 24.226415] RIP: 0033:0x7f46530ff85b
> [ 24.226498] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 e3 83 f8 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0
> ff ff 77 35 44 89 c7 89 44 24 0c e8 41 84 f8 ff 8b 44
> [ 24.226851] RSP: 002b:00007ffc40859770 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
> [ 24.227016] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007f46530ff85b
> [ 24.227173] RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000019
> [ 24.227341] RBP: 00007ffc408597c0 R08: 0000000000000000 R09: 00007ffc40859757
> [ 24.227500] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffc4085ddc8
> [ 24.227652] R13: 000055e8800de120 R14: 000055e88118d390 R15: 00007f46533de000
> [ 24.227830] </TASK>
> [ 24.227891] irq event stamp: 202299
> [ 24.227974] hardirqs last enabled at (202307): [<ffffffff8136008c>] __console_unlock+0x5c/0x70
> [ 24.228162] hardirqs last disabled at (202314): [<ffffffff81360071>] __console_unlock+0x41/0x70
> [ 24.228357] softirqs last enabled at (201682): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.228540] softirqs last disabled at (201671): [<ffffffff812b8b97>] __irq_exit_rcu+0x47/0xc0
> [ 24.228716] ---[ end trace 0000000000000000 ]---
> [ 24.228834] Bad trampoline accounting at: 00000000ab641fec (bpf_lsm_sk_alloc_security+0x4/0x20)
> [ 24.229029]
> [ 24.229029] expected tramp: ffffffff81286080
> [ 24.261301] BUG: unable to handle page fault for address: ffa00000004b9050
> [ 24.261436] #PF: supervisor read access in kernel mode
> [ 24.261528] #PF: error_code(0x0000) - not-present page
> [ 24.261621] PGD 100000067 P4D 100832067 PUD 100833067 PMD 100efb067 PTE 0
> [ 24.261745] Oops: Oops: 0000 [#1] SMP NOPTI
> [ 24.261821] CPU: 9 UID: 0 PID: 1338 Comm: ip Tainted: G W OE 7.0.0-rc1-gda78c0a81eea #83 PREEMPT(full)
> [ 24.262006] Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 24.262119] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-5.el9 11/05/2023
> [ 24.262281] RIP: 0010:__cgroup_bpf_run_lsm_current+0xc5/0x2f0
> [ 24.262393] Code: a6 6f 1a 02 01 48 c7 c7 31 5b 71 82 be bf 01 00 00 48 c7 c2 d3 70 65 82 e8 d8 53 ce ff 4d 8b 7f 60 4d 85 ff 0f 84 14 02 00 00 <49> 8b 46 f0
> 4c 63 b0 34 05 00 00 c7 44 24 10 00 00 00 00 41 0f b7
> [ 24.262693] RSP: 0018:ffa0000004dfbc98 EFLAGS: 00010282
> [ 24.262784] RAX: 0000000000000001 RBX: ffa0000004dfbd10 RCX: 0000000000000001
> [ 24.262923] RDX: 00000000d7c4159d RSI: ffffffff8359b368 RDI: ff1100011b5c50c8
> [ 24.263055] RBP: ffa0000004dfbd30 R08: 0000000000020000 R09: ffffffffffffffff
> [ 24.263187] R10: ffffffff814f76b3 R11: 0000000000000000 R12: ff1100011b5c4580
> [ 24.263325] R13: 0000000000000000 R14: ffa00000004b9060 R15: ffffffff835b3040
> [ 24.263465] FS: 00007f0007064800(0000) GS:ff1100203bdcc000(0000) knlGS:0000000000000000
> [ 24.263599] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 24.263709] CR2: ffa00000004b9050 CR3: 0000000120f4d002 CR4: 0000000000771ef0
> [ 24.263841] PKRU: 55555554
> [ 24.263890] Call Trace:
> [ 24.263938] <TASK>
> [ 24.263992] bpf_trampoline_6442513766+0x6a/0x10d
> [ 24.264088] security_sk_alloc+0x83/0xd0
> [ 24.264162] sk_prot_alloc+0xf4/0x150
> [ 24.264236] sk_alloc+0x34/0x2a0
> [ 24.264305] ? srso_return_thunk+0x5/0x5f
> [ 24.264375] ? _raw_spin_unlock_irqrestore+0x35/0x50
> [ 24.264465] ? srso_return_thunk+0x5/0x5f
> [ 24.264533] ? __wake_up_common_lock+0xa8/0xd0
> [ 24.264625] __netlink_create+0x2f/0xf0
> [ 24.264695] netlink_create+0x1c4/0x230
> [ 24.264765] ? __pfx_rtnetlink_bind+0x10/0x10
> [ 24.264858] __sock_create+0x21d/0x400
> [ 24.264937] __sys_socket+0x65/0x100
> [ 24.265007] ? srso_return_thunk+0x5/0x5f
> [ 24.265077] __x64_sys_socket+0x19/0x30
> [ 24.265146] do_syscall_64+0xde/0x390
> [ 24.265216] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 24.265307] ? trace_irq_disable+0x1d/0xc0
> [ 24.265379] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 24.265469] RIP: 0033:0x7f0006f112ab
> [ 24.265538] Code: 73 01 c3 48 8b 0d 6d 8b 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 29 00 00 00 0f 05 <48> 3d 01 f0
> ff ff 73 01 c3 48 8b 0d 3d 8b 0e 00 f7 d8 64 89 01 48
> [ 24.265822] RSP: 002b:00007ffd8ecb3be8 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
> [ 24.265960] RAX: ffffffffffffffda RBX: 000056212b30d040 RCX: 00007f0006f112ab
> [ 24.266088] RDX: 0000000000000000 RSI: 0000000000080003 RDI: 0000000000000010
> [ 24.266217] RBP: 0000000000000000 R08: 00007ffd8ecb3bc0 R09: 0000000000000000
> [ 24.266346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> [ 24.266474] R13: 000056212b30d040 R14: 00007ffd8ecb3d88 R15: 0000000000000004
> [ 24.266617] </TASK>
> [ 24.266663] Modules linked in: bpf_test_modorder_y(OE+) bpf_test_modorder_x(OE) bpf_testmod(OE)
> [ 24.266824] CR2: ffa00000004b9050
> [ 24.266897] ---[ end trace 0000000000000000 ]---
> [ 24.266989] RIP: 0010:__cgroup_bpf_run_lsm_current+0xc5/0x2f0
> [ 24.267101] Code: a6 6f 1a 02 01 48 c7 c7 31 5b 71 82 be bf 01 00 00 48 c7 c2 d3 70 65 82 e8 d8 53 ce ff 4d 8b 7f 60 4d 85 ff 0f 84 14 02 00 00 <49> 8b 46 f0
> 4c 63 b0 34 05 00 00 c7 44 24 10 00 00 00 00 41 0f b7
> [ 24.267406] RSP: 0018:ffa0000004dfbc98 EFLAGS: 00010282
> [ 24.267499] RAX: 0000000000000001 RBX: ffa0000004dfbd10 RCX: 0000000000000001
> [ 24.267629] RDX: 00000000d7c4159d RSI: ffffffff8359b368 RDI: ff1100011b5c50c8
> [ 24.267758] RBP: ffa0000004dfbd30 R08: 0000000000020000 R09: ffffffffffffffff
> [ 24.267897] R10: ffffffff814f76b3 R11: 0000000000000000 R12: ff1100011b5c4580
> [ 24.268030] R13: 0000000000000000 R14: ffa00000004b9060 R15: ffffffff835b3040
> [ 24.268167] FS: 00007f0007064800(0000) GS:ff1100203bdcc000(0000) knlGS:0000000000000000
> [ 24.268311] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 24.268428] CR2: ffa00000004b9050 CR3: 0000000120f4d002 CR4: 0000000000771ef0
> [ 24.268565] PKRU: 55555554
> [ 24.268613] Kernel panic - not syncing: Fatal exception
> [ 24.268977] Kernel Offset: disabled
> [ 24.269046] ---[ end Kernel panic - not syncing: Fatal exception ]---
>
>
>
> > ---
> > arch/x86/Kconfig | 1 +
> > kernel/bpf/trampoline.c | 220 ++++++++++++++++++++++++++++++++++------
> > kernel/trace/Kconfig | 3 +
> > kernel/trace/ftrace.c | 7 +-
> > 4 files changed, 200 insertions(+), 31 deletions(-)
> >
> > [...]
^ permalink raw reply
* Re: [PATCH v4 2/5] mm: convert zone lock users to wrappers
From: David Hildenbrand (Arm) @ 2026-02-27 20:39 UTC (permalink / raw)
To: Dmitry Ilvokhin, Andrew Morton, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Axel Rasmussen, Yuanchu Xie, Wei Xu, Steven Rostedt,
Masami Hiramatsu, Mathieu Desnoyers, Rafael J. Wysocki,
Pavel Machek, Len Brown, Brendan Jackman, Johannes Weiner, Zi Yan,
Oscar Salvador, Qi Zheng, Shakeel Butt
Cc: linux-kernel, linux-mm, linux-trace-kernel, linux-pm,
"linux-cxl, SeongJae Park
In-Reply-To: <d26a43ebed2f0f1edb9cfe4fbed16dd31c7a069c.1772206930.git.d@ilvokhin.com>
On 2/27/26 17:00, Dmitry Ilvokhin wrote:
> Replace direct zone lock acquire/release operations with the
> newly introduced wrappers.
>
> The changes are purely mechanical substitutions. No functional change
> intended. Locking semantics and ordering remain unchanged.
>
> The compaction path is left unchanged for now and will be
> handled separately in the following patch due to additional
> non-trivial modifications.
>
> Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
> Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
> Reviewed-by: SeongJae Park <sj@kernel.org>
> ---
[...]
> #ifdef CONFIG_COMPACTION
> @@ -530,11 +531,14 @@ static bool compact_lock_irqsave(spinlock_t *lock, unsigned long *flags,
> * Returns true if compaction should abort due to fatal signal pending.
> * Returns false when compaction can continue.
> */
> -static bool compact_unlock_should_abort(spinlock_t *lock,
> - unsigned long flags, bool *locked, struct compact_control *cc)
> +
> +static bool compact_unlock_should_abort(struct zone *zone,
> + unsigned long flags,
> + bool *locked,
> + struct compact_control *cc)
We tend to use two-tabs on second parameter line; like the existing code
did.
Besides that
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
--
Cheers,
David
^ permalink raw reply
* Re: [PATCH v4 3/5] mm: convert compaction to zone lock wrappers
From: David Hildenbrand (Arm) @ 2026-02-27 20:39 UTC (permalink / raw)
To: Dmitry Ilvokhin, Andrew Morton, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Axel Rasmussen, Yuanchu Xie, Wei Xu, Steven Rostedt,
Masami Hiramatsu, Mathieu Desnoyers, Rafael J. Wysocki,
Pavel Machek, Len Brown, Brendan Jackman, Johannes Weiner, Zi Yan,
Oscar Salvador, Qi Zheng, Shakeel Butt
Cc: linux-kernel, linux-mm, linux-trace-kernel, linux-pm,
"linux-cxl
In-Reply-To: <3a09e46f52cf9f709b0725bc2b648cc5212843b2.1772206930.git.d@ilvokhin.com>
On 2/27/26 17:00, Dmitry Ilvokhin wrote:
> Compaction uses compact_lock_irqsave(), which currently operates
> on a raw spinlock_t pointer so it can be used for both zone->lock
> and lruvec->lru_lock. Since zone lock operations are now wrapped,
> compact_lock_irqsave() can no longer directly operate on a
> spinlock_t when the lock belongs to a zone.
>
> Split the helper into compact_zone_lock_irqsave() and
> compact_lruvec_lock_irqsave(), duplicating the small amount of
> shared logic. As there are only two call sites and both statically
> know the lock type, this avoids introducing additional abstraction
> or runtime dispatch in the compaction path.
>
> No functional change intended.
>
> Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
> Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
> ---
> mm/compaction.c | 33 ++++++++++++++++++++++++---------
> 1 file changed, 24 insertions(+), 9 deletions(-)
>
> diff --git a/mm/compaction.c b/mm/compaction.c
> index fa0e332a8a92..c68fcc416fc7 100644
> --- a/mm/compaction.c
> +++ b/mm/compaction.c
> @@ -503,19 +503,36 @@ static bool test_and_set_skip(struct compact_control *cc, struct page *page)
> *
> * Always returns true which makes it easier to track lock state in callers.
> */
> -static bool compact_lock_irqsave(spinlock_t *lock, unsigned long *flags,
> - struct compact_control *cc)
> - __acquires(lock)
> +static bool compact_zone_lock_irqsave(struct zone *zone,
> + unsigned long *flags,
> + struct compact_control *cc)
... two tabs :)
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
--
Cheers,
David
^ permalink raw reply
* Re: [PATCH v4 4/5] mm: rename zone->lock to zone->_lock
From: David Hildenbrand (Arm) @ 2026-02-27 20:40 UTC (permalink / raw)
To: Dmitry Ilvokhin, Andrew Morton, Lorenzo Stoakes, Liam R. Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Axel Rasmussen, Yuanchu Xie, Wei Xu, Steven Rostedt,
Masami Hiramatsu, Mathieu Desnoyers, Rafael J. Wysocki,
Pavel Machek, Len Brown, Brendan Jackman, Johannes Weiner, Zi Yan,
Oscar Salvador, Qi Zheng, Shakeel Butt
Cc: linux-kernel, linux-mm, linux-trace-kernel, linux-pm,
"linux-cxl, SeongJae Park
In-Reply-To: <d61500c5784c64e971f4d328c57639303c475f81.1772206930.git.d@ilvokhin.com>
On 2/27/26 17:00, Dmitry Ilvokhin wrote:
> This intentionally breaks direct users of zone->lock at compile time so
> all call sites are converted to the zone lock wrappers. Without the
> rename, present and future out-of-tree code could continue using
> spin_lock(&zone->lock) and bypass the wrappers and tracing
> infrastructure.
>
> No functional change intended.
>
> Suggested-by: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
> Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
> Acked-by: SeongJae Park <sj@kernel.org>
> ---
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
--
Cheers,
David
^ permalink raw reply
* [RFC PATCH bpf-next v3 0/3] Optimize kprobe.session attachment for exact function names
From: Andrey Grodzovsky @ 2026-02-27 20:40 UTC (permalink / raw)
To: bpf, linux-open-source
Cc: ast, daniel, andrii, jolsa, rostedt, linux-trace-kernel
When libbpf attaches kprobe.session programs with exact function names
(the common case: SEC("kprobe.session/vfs_read")), the current code path
has two independent performance bottlenecks:
1. Userspace (libbpf): attach_kprobe_session() always parses
/proc/kallsyms to resolve function names, even when the name is exact
(no wildcards). This takes ~150ms per function.
2. Kernel (ftrace): ftrace_lookup_symbols() does a full O(N) linear scan
over ~200K kernel symbols via kallsyms_on_each_symbol(), decompressing
every symbol name, even when resolving a single symbol (cnt == 1).
This series optimizes both layers:
- Patch 1: libbpf detects exact function names (no wildcards) in
bpf_program__attach_kprobe_multi_opts() and bypasses kallsyms parsing,
passing the symbol directly to the kernel via syms[] array.
ESRCH is normalized to ENOENT for API consistency.
- Patch 2: ftrace_lookup_symbols() uses kallsyms_lookup_name() for
O(log N) binary search when cnt == 1, with fallback to linear scan for
duplicate symbols. Included here for context; this patch is destined
for the tracing tree via linux-trace-kernel (Steven Rostedt).
- Patch 3: Selftests validating exact-name attachment via
kprobe_multi_session.c and error consistency between wildcard and exact
paths in test_attach_api_fails.
Changes since v2 [2]:
- Use if/else-if instead of goto (Jiri Olsa)
- Use syms = &pattern directly (Jiri Olsa)
- Drop unneeded pattern = NULL (Jiri Olsa)
- Revert cosmetic rename in attach_kprobe_session (Jiri Olsa)
- Remove "module symbols" from ftrace comment (CI bot)
Changes since v1 [1]:
- Move optimization into attach_kprobe_multi_opts (Jiri Olsa)
- Use ftrace_location as boolean check only (Jiri Olsa)
- Remove verbose perf rationale from comment (Steven Rostedt)
- Consolidate tests into existing subtests (Jiri Olsa)
- Delete standalone _syms.c and _errors.c files
[1] https://lore.kernel.org/bpf/20260223215113.924599-1-andrey.grodzovsky@crowdstrike.com/
[2] https://lore.kernel.org/bpf/20260226173342.3565919-1-andrey.grodzovsky@crowdstrike.com/
Andrey Grodzovsky (3):
libbpf: Optimize kprobe.session attachment for exact function names
ftrace: Use kallsyms binary search for single-symbol lookup
selftests/bpf: add tests for kprobe.session optimization
kernel/trace/ftrace.c | 22 +++++++++++++
tools/lib/bpf/libbpf.c | 18 +++++++++-
.../bpf/prog_tests/kprobe_multi_test.c | 33 +++++++++++++++++--
.../bpf/progs/kprobe_multi_session.c | 10 ++++++
4 files changed, 80 insertions(+), 3 deletions(-)
--
2.34.1
^ permalink raw reply
* [RFC PATCH bpf-next v3 1/3] libbpf: Optimize kprobe.session attachment for exact function names
From: Andrey Grodzovsky @ 2026-02-27 20:40 UTC (permalink / raw)
To: bpf, linux-open-source
Cc: ast, daniel, andrii, jolsa, rostedt, linux-trace-kernel
In-Reply-To: <20260227204052.725813-1-andrey.grodzovsky@crowdstrike.com>
Detect exact function names (no wildcards) in
bpf_program__attach_kprobe_multi_opts() and bypass kallsyms parsing,
passing the symbol directly to the kernel via syms[] array. This
benefits all callers, not just kprobe.session.
When the pattern contains no '*' or '?' characters, set syms to point
directly at the pattern string and cnt to 1, skipping the expensive
/proc/kallsyms or available_filter_functions parsing (~150ms per
function).
Error code normalization: the fast path returns ESRCH from kernel's
ftrace_lookup_symbols(), while the slow path returns ENOENT from
userspace kallsyms parsing. Convert ESRCH to ENOENT in the
bpf_link_create error path to maintain API consistency - both paths
now return identical error codes for "symbol not found".
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
---
tools/lib/bpf/libbpf.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 0be7017800fe..80278385bc9c 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -12041,7 +12041,15 @@ bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
if (addrs && syms)
return libbpf_err_ptr(-EINVAL);
- if (pattern) {
+ /*
+ * Exact function name (no wildcards): bypass kallsyms parsing
+ * and pass the symbol directly to the kernel via syms[] array.
+ * The kernel's ftrace_lookup_symbols() resolves it efficiently.
+ */
+ if (pattern && !strpbrk(pattern, "*?")) {
+ syms = &pattern;
+ cnt = 1;
+ } else if (pattern) {
if (has_available_filter_functions_addrs())
err = libbpf_available_kprobes_parse(&res);
else
@@ -12084,6 +12092,14 @@ bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
link_fd = bpf_link_create(prog_fd, 0, attach_type, &lopts);
if (link_fd < 0) {
err = -errno;
+ /*
+ * Normalize error code: when exact name bypasses kallsyms
+ * parsing, kernel returns ESRCH from ftrace_lookup_symbols().
+ * Convert to ENOENT for API consistency with the pattern
+ * matching path which returns ENOENT from userspace.
+ */
+ if (err == -ESRCH)
+ err = -ENOENT;
pr_warn("prog '%s': failed to attach: %s\n",
prog->name, errstr(err));
goto error;
--
2.34.1
^ permalink raw reply related
* [RFC PATCH bpf-next v3 3/3] selftests/bpf: add tests for kprobe.session optimization
From: Andrey Grodzovsky @ 2026-02-27 20:40 UTC (permalink / raw)
To: bpf, linux-open-source
Cc: ast, daniel, andrii, jolsa, rostedt, linux-trace-kernel
In-Reply-To: <20260227204052.725813-1-andrey.grodzovsky@crowdstrike.com>
Extend existing kprobe_multi_test subtests to validate the
kprobe.session exact function name optimization:
In kprobe_multi_session.c, add test_kprobe_syms which attaches a
kprobe.session program to an exact function name (bpf_fentry_test1)
exercising the fast syms[] path that bypasses kallsyms parsing. It
calls session_check() so bpf_fentry_test1 is hit by both the wildcard
and exact probes, and test_session_skel_api validates
kprobe_session_result[0] == 4 (entry + return from each probe).
In test_attach_api_fails, add fail_7 and fail_8 verifying error code
consistency between the wildcard pattern path (slow, parses kallsyms)
and the exact function name path (fast, uses syms[] array). Both
paths must return -ENOENT for non-existent functions.
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
---
.../bpf/prog_tests/kprobe_multi_test.c | 33 +++++++++++++++++--
.../bpf/progs/kprobe_multi_session.c | 10 ++++++
2 files changed, 41 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
index 9caef222e528..ea605245ba14 100644
--- a/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
+++ b/tools/testing/selftests/bpf/prog_tests/kprobe_multi_test.c
@@ -327,6 +327,30 @@ static void test_attach_api_fails(void)
if (!ASSERT_EQ(saved_error, -E2BIG, "fail_6_error"))
goto cleanup;
+ /* fail_7 - non-existent wildcard pattern (slow path) */
+ LIBBPF_OPTS_RESET(opts);
+
+ link = bpf_program__attach_kprobe_multi_opts(skel->progs.test_kprobe_manual,
+ "__nonexistent_func_xyz_*",
+ &opts);
+ saved_error = -errno;
+ if (!ASSERT_ERR_PTR(link, "fail_7"))
+ goto cleanup;
+
+ if (!ASSERT_EQ(saved_error, -ENOENT, "fail_7_error"))
+ goto cleanup;
+
+ /* fail_8 - non-existent exact name (fast path), same error as wildcard */
+ link = bpf_program__attach_kprobe_multi_opts(skel->progs.test_kprobe_manual,
+ "__nonexistent_func_xyz_123",
+ &opts);
+ saved_error = -errno;
+ if (!ASSERT_ERR_PTR(link, "fail_8"))
+ goto cleanup;
+
+ if (!ASSERT_EQ(saved_error, -ENOENT, "fail_8_error"))
+ goto cleanup;
+
cleanup:
bpf_link__destroy(link);
kprobe_multi__destroy(skel);
@@ -355,8 +379,13 @@ static void test_session_skel_api(void)
ASSERT_OK(err, "test_run");
ASSERT_EQ(topts.retval, 0, "test_run");
- /* bpf_fentry_test1-4 trigger return probe, result is 2 */
- for (i = 0; i < 4; i++)
+ /*
+ * bpf_fentry_test1 is hit by both the wildcard probe and the exact
+ * name probe (test_kprobe_syms), so entry + return fires twice: 4.
+ * bpf_fentry_test2-4 are hit only by the wildcard probe: 2.
+ */
+ ASSERT_EQ(skel->bss->kprobe_session_result[0], 4, "kprobe_session_result");
+ for (i = 1; i < 4; i++)
ASSERT_EQ(skel->bss->kprobe_session_result[i], 2, "kprobe_session_result");
/* bpf_fentry_test5-8 trigger only entry probe, result is 1 */
diff --git a/tools/testing/selftests/bpf/progs/kprobe_multi_session.c b/tools/testing/selftests/bpf/progs/kprobe_multi_session.c
index bd8b7fb7061e..d52a65b40bbf 100644
--- a/tools/testing/selftests/bpf/progs/kprobe_multi_session.c
+++ b/tools/testing/selftests/bpf/progs/kprobe_multi_session.c
@@ -76,3 +76,13 @@ int test_kprobe(struct pt_regs *ctx)
{
return session_check(ctx);
}
+
+/*
+ * Exact function name (no wildcards) - exercises the fast syms[] path
+ * in bpf_program__attach_kprobe_multi_opts() which bypasses kallsyms parsing.
+ */
+SEC("kprobe.session/bpf_fentry_test1")
+int test_kprobe_syms(struct pt_regs *ctx)
+{
+ return session_check(ctx);
+}
--
2.34.1
^ permalink raw reply related
* [RFC PATCH bpf-next v3 2/3] ftrace: Use kallsyms binary search for single-symbol lookup
From: Andrey Grodzovsky @ 2026-02-27 20:40 UTC (permalink / raw)
To: bpf, linux-open-source
Cc: ast, daniel, andrii, jolsa, rostedt, linux-trace-kernel
In-Reply-To: <20260227204052.725813-1-andrey.grodzovsky@crowdstrike.com>
When ftrace_lookup_symbols() is called with a single symbol (cnt == 1),
use kallsyms_lookup_name() for O(log N) binary search instead of the
full linear scan via kallsyms_on_each_symbol().
ftrace_lookup_symbols() was designed for batch resolution of many
symbols in a single pass. For large cnt this is efficient: a single
O(N) walk over all symbols with O(log cnt) binary search into the
sorted input array. But for cnt == 1 it still decompresses all ~200K
kernel symbols only to match one.
kallsyms_lookup_name() uses the sorted kallsyms index and needs only
~17 decompressions for a single lookup.
This is the common path for kprobe.session with exact function names,
where libbpf sends one symbol per BPF_LINK_CREATE syscall.
If binary lookup fails (duplicate symbol names where the first match
is not ftrace-instrumented), the function falls through to the existing
linear scan path.
Before (cnt=1, 50 kprobe.session programs):
Attach: 858 ms (kallsyms_expand_symbol 25% of CPU)
After:
Attach: 52 ms (16x faster)
Signed-off-by: Andrey Grodzovsky <andrey.grodzovsky@crowdstrike.com>
---
kernel/trace/ftrace.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 827fb9a0bf0d..13906af8098a 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -9263,6 +9263,15 @@ static int kallsyms_callback(void *data, const char *name, unsigned long addr)
* @addrs array, which needs to be big enough to store at least @cnt
* addresses.
*
+ * For a single symbol (cnt == 1), uses kallsyms_lookup_name() which
+ * performs an O(log N) binary search via the sorted kallsyms index.
+ * This avoids the full O(N) linear scan over all kernel symbols that
+ * the multi-symbol path requires.
+ *
+ * For multiple symbols, uses a single-pass linear scan via
+ * kallsyms_on_each_symbol() with binary search into the sorted input
+ * array.
+ *
* Returns: 0 if all provided symbols are found, -ESRCH otherwise.
*/
int ftrace_lookup_symbols(const char **sorted_syms, size_t cnt, unsigned long *addrs)
@@ -9270,6 +9279,19 @@ int ftrace_lookup_symbols(const char **sorted_syms, size_t cnt, unsigned long *a
struct kallsyms_data args;
int found_all;
+ /* Fast path: single symbol uses O(log N) binary search */
+ if (cnt == 1) {
+ addrs[0] = kallsyms_lookup_name(sorted_syms[0]);
+ if (addrs[0] && ftrace_location(addrs[0]))
+ return 0;
+ /*
+ * Binary lookup can fail for duplicate symbol names
+ * where the first match is not ftrace-instrumented.
+ * Retry with linear scan.
+ */
+ }
+
+ /* Batch path: single-pass O(N) linear scan */
memset(addrs, 0, sizeof(*addrs) * cnt);
args.addrs = addrs;
args.syms = sorted_syms;
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] tracefs: Simplify get_dname() with kmemdup_nul()
From: Steven Rostedt @ 2026-02-27 20:42 UTC (permalink / raw)
To: Al Viro
Cc: AnishMulay, mhiramat, mathieu.desnoyers, linux-trace-kernel,
linux-kernel
In-Reply-To: <20260227201824.GE3836593@ZenIV>
On Fri, 27 Feb 2026 20:18:24 +0000
Al Viro <viro@zeniv.linux.org.uk> wrote:
> On Fri, Feb 27, 2026 at 02:44:53PM -0500, AnishMulay wrote:
> > index d9d8932a7b9c9..86ba8dc25aaef 100644
> > --- a/fs/tracefs/inode.c
> > +++ b/fs/tracefs/inode.c
> > @@ -96,17 +96,7 @@ static struct tracefs_dir_ops {
> >
> > static char *get_dname(struct dentry *dentry)
> > {
> > - const char *dname;
> > - char *name;
> > - int len = dentry->d_name.len;
> > -
> > - dname = dentry->d_name.name;
> > - name = kmalloc(len + 1, GFP_KERNEL);
> > - if (!name)
> > - return NULL;
> > - memcpy(name, dname, len);
> > - name[len] = 0;
> > - return name;
> > + return kmemdup_nul(dentry->d_name.name, dentry->d_name.len, GFP_KERNEL);
> > }
>
> Why not have the callers use {take,release}_dentry_name_snapshot()
> instead of doing any allocations at all?
>
> I mean,
> static struct dentry *tracefs_syscall_mkdir(struct mnt_idmap *idmap,
> struct inode *inode, struct dentry *dentry,
> umode_t mode)
> {
> struct tracefs_inode *ti;
> struct name_snapshot s;
> int ret;
>
> take_dentry_name_snapshot(&s, dentry);
> ...
> ret = tracefs_ops.mkdir(s.name.name);
> release_dentry_name_snapshot(&s);
> ...
> }
>
> and similar on the rmdir side. Then remove get_dname()...
That sounds good to me.
-- Steve
^ permalink raw reply
* Re: [RFC PATCH bpf-next v3 0/3] Optimize kprobe.session attachment for exact function names
From: Alexei Starovoitov @ 2026-02-27 20:43 UTC (permalink / raw)
To: Andrey Grodzovsky
Cc: bpf, DL Linux Open Source Team, Alexei Starovoitov,
Daniel Borkmann, Andrii Nakryiko, Jiri Olsa, Steven Rostedt,
linux-trace-kernel
In-Reply-To: <20260227204052.725813-1-andrey.grodzovsky@crowdstrike.com>
On Fri, Feb 27, 2026 at 12:41 PM Andrey Grodzovsky
<andrey.grodzovsky@crowdstrike.com> wrote:
>
>
> Changes since v2 [2]:
> - Use if/else-if instead of goto (Jiri Olsa)
> - Use syms = &pattern directly (Jiri Olsa)
> - Drop unneeded pattern = NULL (Jiri Olsa)
> - Revert cosmetic rename in attach_kprobe_session (Jiri Olsa)
> - Remove "module symbols" from ftrace comment (CI bot)
RFC series are ignored by CI.
If you want things to land, drop RFC.
^ permalink raw reply
* Re: [External] Re: [RFC PATCH bpf-next v2 1/3] libbpf: Optimize kprobe.session attachment for exact function names
From: Andrey Grodzovsky @ 2026-02-27 20:52 UTC (permalink / raw)
To: Jiri Olsa
Cc: bpf, linux-open-source, ast, daniel, andrii, rostedt,
linux-trace-kernel
In-Reply-To: <aaHPfR_cOwKIm-lU@krava>
> - if (pattern) {
> + /*
> + * Exact function name (no wildcards): bypass kallsyms parsing
> + * and pass the symbol directly to the kernel via syms[] array.
> + * The kernel's ftrace_lookup_symbols() resolves it efficiently.
> + */
> + if (pattern && !strpbrk(pattern, "*?")) {
> + syms = &pattern;
> + cnt = 1;
> + } else if (pattern) {
> if (has_available_filter_functions_addrs())
> err = libbpf_available_kprobes_parse(&res);
>
>
> wdyt?
Totally agree, updated in V3.
Thanks,
Andrey
^ permalink raw reply
* Re: [PATCH] tracing: Fix WARN_ON in tracing_buffers_mmap_close
From: Steven Rostedt @ 2026-02-27 20:56 UTC (permalink / raw)
To: Vincent Donnefort
Cc: Qing Wang, Masami Hiramatsu, Mathieu Desnoyers, linux-kernel,
linux-trace-kernel, syzbot+3b5dd2030fe08afdf65d, linux-mm,
Andrew Morton, Lorenzo Stoakes, Vlastimil Babka
In-Reply-To: <20260227102038.0fef81e9@gandalf.local.home>
On Fri, 27 Feb 2026 10:20:38 -0500
Steven Rostedt <rostedt@goodmis.org> wrote:
> On Fri, 27 Feb 2026 11:22:22 +0000
> Vincent Donnefort <vdonnefort@google.com> wrote:
>
> > > Ah right, Syzkaller is using madvise(MADVISE_DOFORK) which resets VM_DONTCOPY.
> >
> > As we are applying restrictive rules for this mapping, I believe setting VM_IO
> > might be a better fix.
>
> Agreed.
>
Adding MM folks so we do this right.
Dear MM folks,
Here's the issue. When the ftrace ring buffer is memory mapped to user
space, we do not want anything "special" done to it. One of those things we
did not want done was to have it copied on fork. To do that, we added
VM_DONTCOPY, but we didn't know that an madvise() could disable that. It
looks like VM_IO will prevent that from happening.
But looking at the various flags, I see there's a VM_SPECIAL. I'm wondering
if that is what we should use?
The effected code is here:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/trace/ring_buffer.c#n7172
What's your thoughts?
Thanks,
-- Steve
^ permalink raw reply
* Re: [PATCH 03/61] trace: update VFS-layer trace events for u64 i_ino
From: Jeff Layton @ 2026-02-27 21:05 UTC (permalink / raw)
To: Steven Rostedt
Cc: Alexander Viro, Christian Brauner, Jan Kara, Masami Hiramatsu,
Mathieu Desnoyers, Dan Williams, Matthew Wilcox, Eric Biggers,
Theodore Y. Ts'o, Muchun Song, Oscar Salvador,
David Hildenbrand, David Howells, Paulo Alcantara, Andreas Dilger,
Jan Kara, Jaegeuk Kim, Chao Yu, Trond Myklebust, Anna Schumaker,
Chuck Lever, NeilBrown, Olga Kornievskaia, Dai Ngo, Tom Talpey,
Steve French, Ronnie Sahlberg, Shyam Prasad N, Bharath SM,
Alexander Aring, Ryusuke Konishi, Viacheslav Dubeyko,
Eric Van Hensbergen, Latchesar Ionkov, Dominique Martinet,
Christian Schoenebeck, David Sterba, Marc Dionne, Ian Kent,
Luis de Bethencourt, Salah Triki, Tigran A. Aivazian,
Ilya Dryomov, Alex Markuze, Jan Harkes, coda, Nicolas Pitre,
Tyler Hicks, Amir Goldstein, Christoph Hellwig,
John Paul Adrian Glaubitz, Yangtao Li, Mikulas Patocka,
David Woodhouse, Richard Weinberger, Dave Kleikamp,
Konstantin Komarov, Mark Fasheh, Joel Becker, Joseph Qi,
Mike Marshall, Martin Brandenburg, Miklos Szeredi, Anders Larsen,
Zhihao Cheng, Damien Le Moal, Naohiro Aota, Johannes Thumshirn,
John Johansen, Paul Moore, James Morris, Serge E. Hallyn,
Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg, Fan Wu,
Stephen Smalley, Ondrej Mosnacek, Casey Schaufler, Alex Deucher,
Christian König, David Airlie, Simona Vetter, Sumit Semwal,
Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
David S. Miller, Jakub Kicinski, Simon Horman, Oleg Nesterov,
Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, Darrick J. Wong,
Martin Schiller, linux-fsdevel, linux-kernel, linux-trace-kernel,
nvdimm, fsverity, linux-mm, netfs, linux-ext4, linux-f2fs-devel,
linux-nfs, linux-cifs, samba-technical, linux-nilfs, v9fs,
linux-afs, autofs, ceph-devel, codalist, ecryptfs, linux-mtd,
jfs-discussion, ntfs3, ocfs2-devel, devel, linux-unionfs,
apparmor, linux-security-module, linux-integrity, selinux,
amd-gfx, dri-devel, linux-media, linaro-mm-sig, netdev,
linux-perf-users, linux-fscrypt, linux-xfs, linux-hams, linux-x25
In-Reply-To: <20260226124842.5593ed85@gandalf.local.home>
On Thu, 2026-02-26 at 12:48 -0500, Steven Rostedt wrote:
> On Thu, 26 Feb 2026 10:55:05 -0500
> Jeff Layton <jlayton@kernel.org> wrote:
>
> > Update trace event definitions in VFS-layer trace headers to use u64
> > instead of ino_t/unsigned long for inode number fields, and change
> > format strings from %lu/%lx to %llu/%llx to match.
> >
> > This is needed because i_ino is now u64. Changing trace event field
> > types changes the binary trace format, but the self-describing format
> > metadata handles this transparently for modern trace-cmd and perf.
> >
> > Files updated:
> > - cachefiles.h, filelock.h, filemap.h, fs_dax.h, fsverity.h,
> > hugetlbfs.h, netfs.h, readahead.h, timestamp.h, writeback.h
> >
>
> Hmm, on 32 bit systems, this will likely cause "holes" in a lot of these
> events.
>
> > Signed-off-by: Jeff Layton <jlayton@kernel.org>
> > ---
> > include/trace/events/cachefiles.h | 18 ++---
> > include/trace/events/filelock.h | 16 ++---
> > include/trace/events/filemap.h | 20 +++---
> > include/trace/events/fs_dax.h | 20 +++---
> > include/trace/events/fsverity.h | 30 ++++----
> > include/trace/events/hugetlbfs.h | 28 ++++----
> > include/trace/events/netfs.h | 4 +-
> > include/trace/events/readahead.h | 12 ++--
> > include/trace/events/timestamp.h | 12 ++--
> > include/trace/events/writeback.h | 148 +++++++++++++++++++-------------------
> > 10 files changed, 154 insertions(+), 154 deletions(-)
> >
> > diff --git a/include/trace/events/cachefiles.h b/include/trace/events/cachefiles.h
> > index a743b2a35ea7001447b3e05d41539cb88013bc7f..f967027711ee823f224abc1b8ab03f63da06ae6f 100644
> > --- a/include/trace/events/cachefiles.h
> > +++ b/include/trace/events/cachefiles.h
> > @@ -251,8 +251,8 @@ TRACE_EVENT(cachefiles_lookup,
> > TP_STRUCT__entry(
> > __field(unsigned int, obj)
> > __field(short, error)
>
> There was already a 2 byte hole here, but that's not a big deal.
>
> > - __field(unsigned long, dino)
> > - __field(unsigned long, ino)
> > + __field(u64, dino)
> > + __field(u64, ino)
> > ),
> >
> > TP_fast_assign(
> > @@ -263,7 +263,7 @@ TRACE_EVENT(cachefiles_lookup,
> > __entry->error = IS_ERR(de) ? PTR_ERR(de) : 0;
> > ),
> >
> > - TP_printk("o=%08x dB=%lx B=%lx e=%d",
> > + TP_printk("o=%08x dB=%llx B=%llx e=%d",
> > __entry->obj, __entry->dino, __entry->ino, __entry->error)
> > );
> >
> > @@ -579,7 +579,7 @@ TRACE_EVENT(cachefiles_mark_active,
> > /* Note that obj may be NULL */
> > TP_STRUCT__entry(
> > __field(unsigned int, obj)
> > - __field(ino_t, inode)
> > + __field(u64, inode)
>
> Might be better to reorder any of these that have int first.
>
> u64 inode;
> int obj;
>
> Will be packed tighter than:
>
> int obj
> u64 inode;
>
> Probably should have changed that before anyway.
>
Ok, I'll look at that. Given the number of places that need it though I
may do it in a separate patch.
> > ),
> >
> > TP_fast_assign(
> > @@ -587,7 +587,7 @@ TRACE_EVENT(cachefiles_mark_active,
> > __entry->inode = inode->i_ino;
> > ),
> >
> > - TP_printk("o=%08x B=%lx",
> > + TP_printk("o=%08x B=%llx",
> > __entry->obj, __entry->inode)
> > );
> >
> > @@ -600,7 +600,7 @@ TRACE_EVENT(cachefiles_mark_failed,
> > /* Note that obj may be NULL */
> > TP_STRUCT__entry(
> > __field(unsigned int, obj)
> > - __field(ino_t, inode)
> > + __field(u64, inode)
>
> Is ino_t being changed? Why the update here?
>
No, ino_t isn't. That's part of the ABI and has to remain unsigned
long. The point of this series is to make inode->i_ino a u64. Any event
holding an ino_t today is going to need a 64-bit field to fully
describe it.
And to be clear, this should make things better for 32-bit boxes in the
long run. Once this change is done, i_ino should be a reliable source
of info regardless of machine's word size.
For the tracepoints, I think it's best to just extend them to 64-bit
fields outright rather than using the new (temporary) kino_t typedef
that I'm adding.
> > ),
> >
> > TP_fast_assign(
> > @@ -608,7 +608,7 @@ TRACE_EVENT(cachefiles_mark_failed,
> > __entry->inode = inode->i_ino;
> > ),
> >
> > - TP_printk("o=%08x B=%lx",
> > + TP_printk("o=%08x B=%llx",
> > __entry->obj, __entry->inode)
> > );
> >
> > @@ -621,7 +621,7 @@ TRACE_EVENT(cachefiles_mark_inactive,
> > /* Note that obj may be NULL */
> > TP_STRUCT__entry(
> > __field(unsigned int, obj)
> > - __field(ino_t, inode)
> > + __field(u64, inode)
>
> Ditto.
>
> > ),
> >
> > TP_fast_assign(
> > @@ -629,7 +629,7 @@ TRACE_EVENT(cachefiles_mark_inactive,
> > __entry->inode = inode->i_ino;
> > ),
> >
> > - TP_printk("o=%08x B=%lx",
> > + TP_printk("o=%08x B=%llx",
> > __entry->obj, __entry->inode)
> > );
> >
> > diff --git a/include/trace/events/filelock.h b/include/trace/events/filelock.h
> > index 370016c38a5bbc07d5ba6c102030b49c9eb6424d..41bc752616b25d6cd7955203e2c604029d0b440c 100644
> > --- a/include/trace/events/filelock.h
> > +++ b/include/trace/events/filelock.h
> > @@ -42,7 +42,7 @@ TRACE_EVENT(locks_get_lock_context,
> > TP_ARGS(inode, type, ctx),
> >
> > TP_STRUCT__entry(
> > - __field(unsigned long, i_ino)
> > + __field(u64, i_ino)
> > __field(dev_t, s_dev)
> > __field(unsigned char, type)
> > __field(struct file_lock_context *, ctx)
> > @@ -55,7 +55,7 @@ TRACE_EVENT(locks_get_lock_context,
> > __entry->ctx = ctx;
> > ),
> >
> > - TP_printk("dev=0x%x:0x%x ino=0x%lx type=%s ctx=%p",
> > + TP_printk("dev=0x%x:0x%x ino=0x%llx type=%s ctx=%p",
> > MAJOR(__entry->s_dev), MINOR(__entry->s_dev),
> > __entry->i_ino, show_fl_type(__entry->type), __entry->ctx)
> > );
> > @@ -67,7 +67,7 @@ DECLARE_EVENT_CLASS(filelock_lock,
> >
> > TP_STRUCT__entry(
> > __field(struct file_lock *, fl)
> > - __field(unsigned long, i_ino)
> > + __field(u64, i_ino)
>
> Having u64 before a pointer would be tighter on 32 bit systems, and leaves
> out any holes in the trace.
>
> > __field(dev_t, s_dev)
> > __field(struct file_lock_core *, blocker)
> > __field(fl_owner_t, owner)
> > @@ -93,7 +93,7 @@ DECLARE_EVENT_CLASS(filelock_lock,
> > __entry->ret = ret;
> > ),
> >
> > - TP_printk("fl=%p dev=0x%x:0x%x ino=0x%lx fl_blocker=%p fl_owner=%p fl_pid=%u fl_flags=%s fl_type=%s fl_start=%lld fl_end=%lld ret=%d",
> > + TP_printk("fl=%p dev=0x%x:0x%x ino=0x%llx fl_blocker=%p fl_owner=%p fl_pid=%u fl_flags=%s fl_type=%s fl_start=%lld fl_end=%lld ret=%d",
> > __entry->fl, MAJOR(__entry->s_dev), MINOR(__entry->s_dev),
> > __entry->i_ino, __entry->blocker, __entry->owner,
> > __entry->pid, show_fl_flags(__entry->flags),
> > @@ -124,7 +124,7 @@ DECLARE_EVENT_CLASS(filelock_lease,
> >
> > TP_STRUCT__entry(
> > __field(struct file_lease *, fl)
> > - __field(unsigned long, i_ino)
> > + __field(u64, i_ino)
>
> Same here.
>
> > __field(dev_t, s_dev)
> > __field(struct file_lock_core *, blocker)
> > __field(fl_owner_t, owner)
> > @@ -146,7 +146,7 @@ DECLARE_EVENT_CLASS(filelock_lease,
> > __entry->downgrade_time = fl ? fl->fl_downgrade_time : 0;
> > ),
> >
> > - TP_printk("fl=%p dev=0x%x:0x%x ino=0x%lx fl_blocker=%p fl_owner=%p fl_flags=%s fl_type=%s fl_break_time=%lu fl_downgrade_time=%lu",
> > + TP_printk("fl=%p dev=0x%x:0x%x ino=0x%llx fl_blocker=%p fl_owner=%p fl_flags=%s fl_type=%s fl_break_time=%lu fl_downgrade_time=%lu",
> > __entry->fl, MAJOR(__entry->s_dev), MINOR(__entry->s_dev),
> > __entry->i_ino, __entry->blocker, __entry->owner,
> > show_fl_flags(__entry->flags),
> > @@ -175,7 +175,7 @@ TRACE_EVENT(generic_add_lease,
> > TP_ARGS(inode, fl),
> >
> > TP_STRUCT__entry(
> > - __field(unsigned long, i_ino)
> > + __field(u64, i_ino)
> > __field(int, wcount)
> > __field(int, rcount)
> > __field(int, icount)
> > @@ -196,7 +196,7 @@ TRACE_EVENT(generic_add_lease,
> > __entry->type = fl->c.flc_type;
> > ),
> >
> > - TP_printk("dev=0x%x:0x%x ino=0x%lx wcount=%d rcount=%d icount=%d fl_owner=%p fl_flags=%s fl_type=%s",
> > + TP_printk("dev=0x%x:0x%x ino=0x%llx wcount=%d rcount=%d icount=%d fl_owner=%p fl_flags=%s fl_type=%s",
> > MAJOR(__entry->s_dev), MINOR(__entry->s_dev),
> > __entry->i_ino, __entry->wcount, __entry->rcount,
> > __entry->icount, __entry->owner,
> > diff --git a/include/trace/events/filemap.h b/include/trace/events/filemap.h
> > index f48fe637bfd25885dc6daaf09336ab60626b4944..153491e57cce6df73e30ddee60a52ed7d8923c24 100644
> > --- a/include/trace/events/filemap.h
> > +++ b/include/trace/events/filemap.h
> > @@ -21,7 +21,7 @@ DECLARE_EVENT_CLASS(mm_filemap_op_page_cache,
> >
> > TP_STRUCT__entry(
> > __field(unsigned long, pfn)
> > - __field(unsigned long, i_ino)
> > + __field(u64, i_ino)
>
> Again, this would cause a 32 bit hole.
>
> > __field(unsigned long, index)
> > __field(dev_t, s_dev)
> > __field(unsigned char, order)
> > @@ -38,7 +38,7 @@ DECLARE_EVENT_CLASS(mm_filemap_op_page_cache,
> > __entry->order = folio_order(folio);
> > ),
> >
> > - TP_printk("dev %d:%d ino %lx pfn=0x%lx ofs=%lu order=%u",
> > + TP_printk("dev %d:%d ino %llx pfn=0x%lx ofs=%lu order=%u",
> > MAJOR(__entry->s_dev), MINOR(__entry->s_dev),
> > __entry->i_ino,
> > __entry->pfn,
> > @@ -67,7 +67,7 @@ DECLARE_EVENT_CLASS(mm_filemap_op_page_cache_range,
> > TP_ARGS(mapping, index, last_index),
> >
> > TP_STRUCT__entry(
> > - __field(unsigned long, i_ino)
> > + __field(u64, i_ino)
> > __field(dev_t, s_dev)
> > __field(unsigned long, index)
> > __field(unsigned long, last_index)
> > @@ -85,7 +85,7 @@ DECLARE_EVENT_CLASS(mm_filemap_op_page_cache_range,
> > ),
> >
> > TP_printk(
> > - "dev=%d:%d ino=%lx ofs=%lld-%lld",
> > + "dev=%d:%d ino=%llx ofs=%lld-%lld",
> > MAJOR(__entry->s_dev),
> > MINOR(__entry->s_dev), __entry->i_ino,
> > ((loff_t)__entry->index) << PAGE_SHIFT,
> > @@ -117,7 +117,7 @@ TRACE_EVENT(mm_filemap_fault,
> > TP_ARGS(mapping, index),
> >
> > TP_STRUCT__entry(
> > - __field(unsigned long, i_ino)
> > + __field(u64, i_ino)
> > __field(dev_t, s_dev)
> > __field(unsigned long, index)
> > ),
> > @@ -133,7 +133,7 @@ TRACE_EVENT(mm_filemap_fault,
> > ),
> >
> > TP_printk(
> > - "dev=%d:%d ino=%lx ofs=%lld",
> > + "dev=%d:%d ino=%llx ofs=%lld",
> > MAJOR(__entry->s_dev),
> > MINOR(__entry->s_dev), __entry->i_ino,
> > ((loff_t)__entry->index) << PAGE_SHIFT
> > @@ -146,7 +146,7 @@ TRACE_EVENT(filemap_set_wb_err,
> > TP_ARGS(mapping, eseq),
> >
> > TP_STRUCT__entry(
> > - __field(unsigned long, i_ino)
> > + __field(u64, i_ino)
> > __field(dev_t, s_dev)
> > __field(errseq_t, errseq)
> > ),
> > @@ -160,7 +160,7 @@ TRACE_EVENT(filemap_set_wb_err,
> > __entry->s_dev = mapping->host->i_rdev;
> > ),
> >
> > - TP_printk("dev=%d:%d ino=0x%lx errseq=0x%x",
> > + TP_printk("dev=%d:%d ino=0x%llx errseq=0x%x",
> > MAJOR(__entry->s_dev), MINOR(__entry->s_dev),
> > __entry->i_ino, __entry->errseq)
> > );
> > @@ -172,7 +172,7 @@ TRACE_EVENT(file_check_and_advance_wb_err,
> >
> > TP_STRUCT__entry(
> > __field(struct file *, file)
> > - __field(unsigned long, i_ino)
> > + __field(u64, i_ino)
>
> Having a pointer after the u64 is better.
>
> > __field(dev_t, s_dev)
> > __field(errseq_t, old)
> > __field(errseq_t, new)
> > @@ -191,7 +191,7 @@ TRACE_EVENT(file_check_and_advance_wb_err,
> > __entry->new = file->f_wb_err;
> > ),
> >
> > - TP_printk("file=%p dev=%d:%d ino=0x%lx old=0x%x new=0x%x",
> > + TP_printk("file=%p dev=%d:%d ino=0x%llx old=0x%x new=0x%x",
> > __entry->file, MAJOR(__entry->s_dev),
> > MINOR(__entry->s_dev), __entry->i_ino, __entry->old,
> > __entry->new)
> > diff --git a/include/trace/events/fs_dax.h b/include/trace/events/fs_dax.h
> > index 50ebc1290ab062a9c30ab00049fb96691f9a0f23..11121baa8ece7928c653b4f874fb10ffbdd02fd0 100644
> > --- a/include/trace/events/fs_dax.h
> > +++ b/include/trace/events/fs_dax.h
> > @@ -12,7 +12,7 @@ DECLARE_EVENT_CLASS(dax_pmd_fault_class,
> > pgoff_t max_pgoff, int result),
> > TP_ARGS(inode, vmf, max_pgoff, result),
> > TP_STRUCT__entry(
> > - __field(unsigned long, ino)
> > + __field(u64, ino)
> > __field(unsigned long, vm_start)
> > __field(unsigned long, vm_end)
> > __field(vm_flags_t, vm_flags)
> > @@ -35,7 +35,7 @@ DECLARE_EVENT_CLASS(dax_pmd_fault_class,
> > __entry->max_pgoff = max_pgoff;
> > __entry->result = result;
> > ),
> > - TP_printk("dev %d:%d ino %#lx %s %s address %#lx vm_start "
> > + TP_printk("dev %d:%d ino %#llx %s %s address %#lx vm_start "
> > "%#lx vm_end %#lx pgoff %#lx max_pgoff %#lx %s",
> > MAJOR(__entry->dev),
> > MINOR(__entry->dev),
> > @@ -66,7 +66,7 @@ DECLARE_EVENT_CLASS(dax_pmd_load_hole_class,
> > void *radix_entry),
> > TP_ARGS(inode, vmf, zero_folio, radix_entry),
> > TP_STRUCT__entry(
> > - __field(unsigned long, ino)
> > + __field(u64, ino)
> > __field(vm_flags_t, vm_flags)
> > __field(unsigned long, address)
> > __field(struct folio *, zero_folio)
> > @@ -81,7 +81,7 @@ DECLARE_EVENT_CLASS(dax_pmd_load_hole_class,
> > __entry->zero_folio = zero_folio;
> > __entry->radix_entry = radix_entry;
> > ),
> > - TP_printk("dev %d:%d ino %#lx %s address %#lx zero_folio %p "
> > + TP_printk("dev %d:%d ino %#llx %s address %#lx zero_folio %p "
> > "radix_entry %#lx",
> > MAJOR(__entry->dev),
> > MINOR(__entry->dev),
> > @@ -106,7 +106,7 @@ DECLARE_EVENT_CLASS(dax_pte_fault_class,
> > TP_PROTO(struct inode *inode, struct vm_fault *vmf, int result),
> > TP_ARGS(inode, vmf, result),
> > TP_STRUCT__entry(
> > - __field(unsigned long, ino)
> > + __field(u64, ino)
> > __field(vm_flags_t, vm_flags)
> > __field(unsigned long, address)
> > __field(pgoff_t, pgoff)
> > @@ -123,7 +123,7 @@ DECLARE_EVENT_CLASS(dax_pte_fault_class,
> > __entry->pgoff = vmf->pgoff;
> > __entry->result = result;
> > ),
> > - TP_printk("dev %d:%d ino %#lx %s %s address %#lx pgoff %#lx %s",
> > + TP_printk("dev %d:%d ino %#llx %s %s address %#lx pgoff %#lx %s",
> > MAJOR(__entry->dev),
> > MINOR(__entry->dev),
> > __entry->ino,
> > @@ -150,7 +150,7 @@ DECLARE_EVENT_CLASS(dax_writeback_range_class,
> > TP_PROTO(struct inode *inode, pgoff_t start_index, pgoff_t end_index),
> > TP_ARGS(inode, start_index, end_index),
> > TP_STRUCT__entry(
> > - __field(unsigned long, ino)
> > + __field(u64, ino)
> > __field(pgoff_t, start_index)
> > __field(pgoff_t, end_index)
> > __field(dev_t, dev)
> > @@ -161,7 +161,7 @@ DECLARE_EVENT_CLASS(dax_writeback_range_class,
> > __entry->start_index = start_index;
> > __entry->end_index = end_index;
> > ),
> > - TP_printk("dev %d:%d ino %#lx pgoff %#lx-%#lx",
> > + TP_printk("dev %d:%d ino %#llx pgoff %#lx-%#lx",
> > MAJOR(__entry->dev),
> > MINOR(__entry->dev),
> > __entry->ino,
> > @@ -182,7 +182,7 @@ TRACE_EVENT(dax_writeback_one,
> > TP_PROTO(struct inode *inode, pgoff_t pgoff, pgoff_t pglen),
> > TP_ARGS(inode, pgoff, pglen),
> > TP_STRUCT__entry(
> > - __field(unsigned long, ino)
> > + __field(u64, ino)
> > __field(pgoff_t, pgoff)
> > __field(pgoff_t, pglen)
> > __field(dev_t, dev)
> > @@ -193,7 +193,7 @@ TRACE_EVENT(dax_writeback_one,
> > __entry->pgoff = pgoff;
> > __entry->pglen = pglen;
> > ),
> > - TP_printk("dev %d:%d ino %#lx pgoff %#lx pglen %#lx",
> > + TP_printk("dev %d:%d ino %#llx pgoff %#lx pglen %#lx",
> > MAJOR(__entry->dev),
> > MINOR(__entry->dev),
> > __entry->ino,
> > diff --git a/include/trace/events/fsverity.h b/include/trace/events/fsverity.h
> > index a8c52f21cbd5eb010c7e7b2fdb8f9de49c8ea326..4477c17e05748360965c4e1840590efe96d6335e 100644
> > --- a/include/trace/events/fsverity.h
> > +++ b/include/trace/events/fsverity.h
> > @@ -16,7 +16,7 @@ TRACE_EVENT(fsverity_enable,
> > const struct merkle_tree_params *params),
> > TP_ARGS(inode, params),
> > TP_STRUCT__entry(
> > - __field(ino_t, ino)
> > + __field(u64, ino)
>
> Do you need to convert all these ino_t's?
>
> > __field(u64, data_size)
> > __field(u64, tree_size)
> > __field(unsigned int, merkle_block)
> > @@ -29,8 +29,8 @@ TRACE_EVENT(fsverity_enable,
> > __entry->merkle_block = params->block_size;
> > __entry->num_levels = params->num_levels;
> > ),
> > - TP_printk("ino %lu data_size %llu tree_size %llu merkle_block %u levels %u",
> > - (unsigned long) __entry->ino,
> > + TP_printk("ino %llu data_size %llu tree_size %llu merkle_block %u levels %u",
> > + __entry->ino,
> > __entry->data_size,
> > __entry->tree_size,
> > __entry->merkle_block,
> > @@ -42,7 +42,7 @@ TRACE_EVENT(fsverity_tree_done,
> > const struct merkle_tree_params *params),
> > TP_ARGS(inode, vi, params),
> > TP_STRUCT__entry(
> > - __field(ino_t, ino)
> > + __field(u64, ino)
> > __field(u64, data_size)
> > __field(u64, tree_size)
> > __field(unsigned int, merkle_block)
> > @@ -59,8 +59,8 @@ TRACE_EVENT(fsverity_tree_done,
> > memcpy(__get_dynamic_array(root_hash), vi->root_hash, __get_dynamic_array_len(root_hash));
> > memcpy(__get_dynamic_array(file_digest), vi->file_digest, __get_dynamic_array_len(file_digest));
> > ),
> > - TP_printk("ino %lu data_size %llu tree_size %lld merkle_block %u levels %u root_hash %s digest %s",
> > - (unsigned long) __entry->ino,
> > + TP_printk("ino %llu data_size %llu tree_size %lld merkle_block %u levels %u root_hash %s digest %s",
> > + __entry->ino,
> > __entry->data_size,
> > __entry->tree_size,
> > __entry->merkle_block,
> > @@ -75,7 +75,7 @@ TRACE_EVENT(fsverity_verify_data_block,
> > u64 data_pos),
> > TP_ARGS(inode, params, data_pos),
> > TP_STRUCT__entry(
> > - __field(ino_t, ino)
> > + __field(u64, ino)
> > __field(u64, data_pos)
> > __field(unsigned int, merkle_block)
> > ),
> > @@ -84,8 +84,8 @@ TRACE_EVENT(fsverity_verify_data_block,
> > __entry->data_pos = data_pos;
> > __entry->merkle_block = params->block_size;
> > ),
> > - TP_printk("ino %lu data_pos %llu merkle_block %u",
> > - (unsigned long) __entry->ino,
> > + TP_printk("ino %llu data_pos %llu merkle_block %u",
> > + __entry->ino,
> > __entry->data_pos,
> > __entry->merkle_block)
> > );
> > @@ -96,7 +96,7 @@ TRACE_EVENT(fsverity_merkle_hit,
> > unsigned int hidx),
> > TP_ARGS(inode, data_pos, hblock_idx, level, hidx),
> > TP_STRUCT__entry(
> > - __field(ino_t, ino)
> > + __field(u64, ino)
> > __field(u64, data_pos)
>
> Heh, this actually removed a hole, but again, why convert ino_t?
>
> Anyway, I stopped here. But you get the idea.
>
>
> > __field(unsigned long, hblock_idx)
> > __field(unsigned int, level)
Thanks for the review! I'll definitely look at reordering the
tracepoint fields for better packing since that has material
consequences.
--
Jeff Layton <jlayton@kernel.org>
^ permalink raw reply
* [PATCH v2] tracefs: Use dentry name snapshots instead of heap allocation
From: AnishMulay @ 2026-02-27 21:15 UTC (permalink / raw)
To: rostedt, viro
Cc: mhiramat, mathieu.desnoyers, linux-trace-kernel, linux-kernel,
AnishMulay
In-Reply-To: <20260227154210.5bd19a45@gandalf.local.home>
In fs/tracefs/inode.c, tracefs_syscall_mkdir() and tracefs_syscall_rmdir()
previously used a local helper, get_dname(), which allocated a temporary
buffer on the heap via kmalloc() to hold the dentry name. This introduced
unnecessary overhead, an ENOMEM failure path, and required manual memory
cleanup via kfree().
As suggested by Al Viro, replace this heap allocation with the VFS dentry
name snapshot API. By stack-allocating a `struct name_snapshot` and using
take_dentry_name_snapshot() and release_dentry_name_snapshot(), we safely
capture the dentry name locklessly, eliminate the heap allocation entirely,
and remove the now-obsolete error handling paths. The get_dname() helper
is completely removed.
Testing:
Booted a custom kernel natively in virtme-ng (ARM64). Triggered tracefs
inode and dentry allocation by creating and removing a custom directory
under a temporary tracefs mount. Verified that the instance is created
successfully and that no memory errors or warnings are emitted in dmesg.
Signed-off-by: AnishMulay <anishm7030@gmail.com>
---
fs/tracefs/inode.c | 29 ++++++++---------------------
1 file changed, 8 insertions(+), 21 deletions(-)
diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index 86ba8dc25aaef..ad322e8f9e2ad 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c
@@ -94,23 +94,14 @@ static struct tracefs_dir_ops {
int (*rmdir)(const char *name);
} tracefs_ops __ro_after_init;
-static char *get_dname(struct dentry *dentry)
-{
- return kmemdup_nul(dentry->d_name.name, dentry->d_name.len, GFP_KERNEL);
-}
-
static struct dentry *tracefs_syscall_mkdir(struct mnt_idmap *idmap,
struct inode *inode, struct dentry *dentry,
umode_t mode)
{
struct tracefs_inode *ti;
- char *name;
+ struct name_snapshot name;
int ret;
- name = get_dname(dentry);
- if (!name)
- return ERR_PTR(-ENOMEM);
-
/*
* This is a new directory that does not take the default of
* the rootfs. It becomes the default permissions for all the
@@ -125,24 +116,20 @@ static struct dentry *tracefs_syscall_mkdir(struct mnt_idmap *idmap,
* the files within the tracefs system. It is up to the individual
* mkdir routine to handle races.
*/
+ take_dentry_name_snapshot(&name, dentry);
inode_unlock(inode);
- ret = tracefs_ops.mkdir(name);
+ ret = tracefs_ops.mkdir(name.name.name);
inode_lock(inode);
-
- kfree(name);
+ release_dentry_name_snapshot(&name);
return ERR_PTR(ret);
}
static int tracefs_syscall_rmdir(struct inode *inode, struct dentry *dentry)
{
- char *name;
+ struct name_snapshot name;
int ret;
- name = get_dname(dentry);
- if (!name)
- return -ENOMEM;
-
/*
* The rmdir call can call the generic functions that create
* the files within the tracefs system. It is up to the individual
@@ -150,15 +137,15 @@ static int tracefs_syscall_rmdir(struct inode *inode, struct dentry *dentry)
* This time we need to unlock not only the parent (inode) but
* also the directory that is being deleted.
*/
+ take_dentry_name_snapshot(&name, dentry);
inode_unlock(inode);
inode_unlock(d_inode(dentry));
- ret = tracefs_ops.rmdir(name);
+ ret = tracefs_ops.rmdir(name.name.name);
inode_lock_nested(inode, I_MUTEX_PARENT);
inode_lock(d_inode(dentry));
-
- kfree(name);
+ release_dentry_name_snapshot(&name);
return ret;
}
--
2.51.0
^ permalink raw reply related
* Re: [External] Re: [RFC PATCH bpf-next v3 0/3] Optimize kprobe.session attachment for exact function names
From: Andrey Grodzovsky @ 2026-02-27 21:15 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: bpf, DL Linux Open Source Team, Alexei Starovoitov,
Daniel Borkmann, Andrii Nakryiko, Jiri Olsa, Steven Rostedt,
linux-trace-kernel
In-Reply-To: <CAADnVQLrhkCkpE6UZbkPaNTFMYRoa_ZtyknhVM7FMmsH7Lvj5A@mail.gmail.com>
Hey Alexei, just to be clear, do you mean drop the entire RFC letter or,
Drop the RFC prefix from the letter so the CI pipeline can be properly
triggered ?
Thanks,
Andrey
On Fri, Feb 27, 2026 at 3:43 PM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Fri, Feb 27, 2026 at 12:41 PM Andrey Grodzovsky
> <andrey.grodzovsky@crowdstrike.com> wrote:
> >
> >
> > Changes since v2 [2]:
> > - Use if/else-if instead of goto (Jiri Olsa)
> > - Use syms = &pattern directly (Jiri Olsa)
> > - Drop unneeded pattern = NULL (Jiri Olsa)
> > - Revert cosmetic rename in attach_kprobe_session (Jiri Olsa)
> > - Remove "module symbols" from ftrace comment (CI bot)
>
> RFC series are ignored by CI.
> If you want things to land, drop RFC.
^ permalink raw reply
* Re: [RFC PATCH bpf-next v3 1/3] libbpf: Optimize kprobe.session attachment for exact function names
From: bot+bpf-ci @ 2026-02-27 21:17 UTC (permalink / raw)
To: andrey.grodzovsky, bpf, linux-open-source
Cc: ast, daniel, andrii, jolsa, rostedt, linux-trace-kernel, ast,
andrii, daniel, martin.lau, eddyz87, yonghong.song, clm,
ihor.solodrai
In-Reply-To: <20260227204052.725813-2-andrey.grodzovsky@crowdstrike.com>
[-- Attachment #1: Type: text/plain, Size: 2490 bytes --]
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -12041,7 +12041,15 @@ struct kprobe_multi_resolve res = {
> if (addrs && syms)
> return libbpf_err_ptr(-EINVAL);
>
> - if (pattern) {
> + /*
> + * Exact function name (no wildcards): bypass kallsyms parsing
> + * and pass the symbol directly to the kernel via syms[] array.
> + * The kernel's ftrace_lookup_symbols() resolves it efficiently.
> + */
> + if (pattern && !strpbrk(pattern, "*?")) {
> + syms = &pattern;
> + cnt = 1;
> + } else if (pattern) {
When the fast path is taken here, unique_match is never checked.
The unique_match validation is inside the "else if (pattern)"
branch:
if (unique_match && res.cnt != 1) {
pr_warn("prog '%s': failed to find a unique match ...");
err = -EINVAL;
goto error;
}
Before this change, a caller passing an exact function name with
unique_match = true would go through kallsyms parsing, which could
find multiple addresses for same-named static functions across
different translation units, and the unique_match check would
correctly return an error.
With the fast path, the name goes directly to the kernel's
ftrace_lookup_symbols(), which resolves only the first match via
kallsyms_callback() skipping duplicates:
if (args->addrs[idx])
return 0;
Should the fast path condition also check unique_match, for
example:
if (pattern && !strpbrk(pattern, "*?") && !unique_match) {
This would preserve the optimization for the common case while
falling back to the slow path when unique_match is explicitly
requested.
> [ ... ]
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/22503275616
AI-authorship-score: medium
AI-authorship-explanation: Comments are unusually verbose for a simple optimization, and the commit message is well-structured with distinct sections, but the iterative v1-v3 refinement following reviewer feedback is typical of human development.
issues-found: 1
issue-severity-score: low
issue-severity-explanation: The fast path bypasses the unique_match check, which could silently attach to the wrong function among same-named statics, but requires the uncommon combination of unique_match=true with an exact name matching multiple kernel functions.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox