Re: [PATCHv11 2.6.36-rc2-tip 3/15] 3: uprobes: Slot allocation for Execution out of line(XOL)

[Peter Zijlstra <peterz@infradead.org>]

On Fri, 2010-09-03 at 22:56 +0530, Srikar Dronamraju wrote:
> 
> 
> static unsigned long xol_get_insn_slot(struct user_bkpt *user_bkpt,
>                                 struct uprobes_xol_area *xol_area)
> {
>         unsigned long flags, xol_vaddr = 0;
>         int len;
> 
>         if (unlikely(!xol_area))
>                 return 0;
> 
>         smp_rmb();
>         if (user_bkpt->xol_vaddr)
>                 return user_bkpt->xol_vaddr;
> 
>         spin_lock_irqsave(&xol_area->lock, flags);
>         xol_vaddr = xol_take_insn_slot(xol_area);
>         spin_unlock_irqrestore(&xol_area->lock, flags);
> 
>         /*
>          * Initialize the slot if user_bkpt->vaddr points to valid
>          * instruction slot.
>          */
>         if (!xol_vaddr)
>                 return 0;
> 
>         len = access_process_vm(current, xol_vaddr, user_bkpt->insn,
>                                         UPROBES_XOL_SLOT_BYTES, 1);
>         if (unlikely(len < UPROBES_XOL_SLOT_BYTES))
>                 printk(KERN_ERR "Failed to copy instruction at %#lx "
>                                 "len = %d\n", user_bkpt->vaddr, len);
> 
>         /*
>          * Update user_bkpt->xol_vaddr after giving a chance for the slot to
>          * be initialized.
>          */
>         smp_mb();
>         user_bkpt->xol_vaddr = xol_vaddr;
>         return user_bkpt->xol_vaddr;
> } 

Racy like you won't believe..

Suppose multiple threads hitting the trap at the same time, every thread
will end up failing the check and allocating a new slot for it, at the
end the slowest thread will end up setting the value.