Re: [PATCH] rcu: Fix kernel stack overflow caused by kprobe on rcu_irq_enter_check_tick()

[Frederic Weisbecker <frederic@kernel.org>]

On Mon, Nov 21, 2022 at 11:57:03AM -0800, Paul E. McKenney wrote:
> On Sat, Nov 19, 2022 at 12:00:49PM +0800, Zheng Yejian wrote:
> > Register kprobe on __rcu_irq_enter_check_tick() can cause kernel stack
> > overflow [1]. This issue is first found in v5.10 and can be reproduced
> > by enabling CONFIG_NO_HZ_FULL and doing like:
> >   # cd /sys/kernel/debug/tracing/
> >   # echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events
> >   # echo 1 > events/kprobes/enable
> > 
> > So __rcu_irq_enter_check_tick() should not be kprobed, mark it as noinstr.
> 
> Good catch!
> 
> I am inclined to queue this, but noticed that one of its callers need
> it to be noinstr but that the others do not.
> 
> Need noinstr:
> 
> o	enter_from_kernel_mode() -> __enter_from_kernel_mode() ->
> 	rcu_irq_enter_check_tick() -> __rcu_irq_enter_check_tick()
> 
> Doesn't need noinstr:
> 
> o	ct_nmi_enter() -> rcu_irq_enter_check_tick() ->
> 	__rcu_irq_enter_check_tick(), courtesy of the call to
> 	instrumentation_begin() in ct_nmi_enter() that precedes the call
> 	to rcu_irq_enter_check_tick().
> 
> o	irqentry_enter() -> rcu_irq_enter_check_tick() ->
> 	__rcu_irq_enter_check_tick(), courtesy of the call to
> 	instrumentation_begin() in irqentry_enter() that precedes the
> 	call to rcu_irq_enter_check_tick().
> 
> Is tagging __rcu_irq_enter_check_tick() with noinstr as
> proposed in this patch the right thing to do, or should there
> be calls to instrumentation_begin() and instrumentation_end() in
> enter_from_kernel_mode()?  Or something else entirely?

Tagging as noinstr doesn't look right as there are functions in
__rcu_irq_enter_check_tick() that can be traced anyway. Also that
function has the constraint that it can't be called while RCU is idle
so it's up to the caller to call instrumentation_begin()/end().

Thanks.