[PATCH 5.4.y 0/2] tracing/kprobes: Backport request about

[PATCH 5.4.y 0/2] tracing/kprobes: Backport request about

[Sherry Yang]

The added test case from commit 
09bcf9254838 ("selftests/ftrace: Add new test case which checks non unique symbol") 
failed, it is fixed by 
b022f0c7e404 ("tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols"). 
Backport it and its fix commit to 5.4.y together. Resolved minor context change conflicts.

Resend the patch series after backpporting to 5.10.y first.

Andrii Nakryiko (1):
  tracing/kprobes: Fix symbol counting logic by looking at modules as
    well

Francis Laniel (1):
  tracing/kprobes: Return EADDRNOTAVAIL when func matches several
    symbols

 kernel/trace/trace_kprobe.c | 76 +++++++++++++++++++++++++++++++++++++
 kernel/trace/trace_probe.h  |  1 +
 2 files changed, 77 insertions(+)

-- 
2.46.0

[PATCH 5.4.y 1/2] tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols

[Sherry Yang]

From: Francis Laniel <flaniel@linux.microsoft.com>

commit b022f0c7e404887a7c5229788fc99eff9f9a80d5 upstream.

When a kprobe is attached to a function that's name is not unique (is
static and shares the name with other functions in the kernel), the
kprobe is attached to the first function it finds. This is a bug as the
function that it is attaching to is not necessarily the one that the
user wants to attach to.

Instead of blindly picking a function to attach to what is ambiguous,
error with EADDRNOTAVAIL to let the user know that this function is not
unique, and that the user must use another unique function with an
address offset to get to the function they want to attach to.

Link: https://lore.kernel.org/all/20231020104250.9537-2-flaniel@linux.microsoft.com/

Cc: stable@vger.kernel.org
Fixes: 413d37d1eb69 ("tracing: Add kprobe-based event tracer")
Suggested-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Francis Laniel <flaniel@linux.microsoft.com>
Link: https://lore.kernel.org/lkml/20230819101105.b0c104ae4494a7d1f2eea742@kernel.org/
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[Sherry: kselftest kprobe_non_uniq_symbol.tc failed on 5.4.y, because of missing
this commit, backport it to 5.4.y. Minor conflicts due to context change, ignore
context change]
Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
---
 kernel/trace/trace_kprobe.c | 74 +++++++++++++++++++++++++++++++++++++
 kernel/trace/trace_probe.h  |  1 +
 2 files changed, 75 insertions(+)

diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 0b95277396fc..80a59dbdd631 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -714,6 +714,36 @@ static inline void sanitize_event_name(char *name)
 			*name = '_';
 }
 
+struct count_symbols_struct {
+	const char *func_name;
+	unsigned int count;
+};
+
+static int count_symbols(void *data, const char *name, struct module *unused0,
+			 unsigned long unused1)
+{
+	struct count_symbols_struct *args = data;
+
+	if (strcmp(args->func_name, name))
+		return 0;
+
+	args->count++;
+
+	return 0;
+}
+
+static unsigned int number_of_same_symbols(char *func_name)
+{
+	struct count_symbols_struct args = {
+		.func_name = func_name,
+		.count = 0,
+	};
+
+	kallsyms_on_each_symbol(count_symbols, &args);
+
+	return args.count;
+}
+
 static int trace_kprobe_create(int argc, const char *argv[])
 {
 	/*
@@ -825,6 +855,31 @@ static int trace_kprobe_create(int argc, const char *argv[])
 		}
 	}
 
+	if (symbol && !strchr(symbol, ':')) {
+		unsigned int count;
+
+		count = number_of_same_symbols(symbol);
+		if (count > 1) {
+			/*
+			 * Users should use ADDR to remove the ambiguity of
+			 * using KSYM only.
+			 */
+			trace_probe_log_err(0, NON_UNIQ_SYMBOL);
+			ret = -EADDRNOTAVAIL;
+
+			goto error;
+		} else if (count == 0) {
+			/*
+			 * We can return ENOENT earlier than when register the
+			 * kprobe.
+			 */
+			trace_probe_log_err(0, BAD_PROBE_ADDR);
+			ret = -ENOENT;
+
+			goto error;
+		}
+	}
+
 	trace_probe_log_set_index(0);
 	if (event) {
 		ret = traceprobe_parse_event_name(&event, &group, buf,
@@ -1596,6 +1651,7 @@ static int unregister_kprobe_event(struct trace_kprobe *tk)
 }
 
 #ifdef CONFIG_PERF_EVENTS
+
 /* create a trace_kprobe, but don't add it to global lists */
 struct trace_event_call *
 create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
@@ -1605,6 +1661,24 @@ create_local_trace_kprobe(char *func, void *addr, unsigned long offs,
 	int ret;
 	char *event;
 
+	if (func) {
+		unsigned int count;
+
+		count = number_of_same_symbols(func);
+		if (count > 1)
+			/*
+			 * Users should use addr to remove the ambiguity of
+			 * using func only.
+			 */
+			return ERR_PTR(-EADDRNOTAVAIL);
+		else if (count == 0)
+			/*
+			 * We can return ENOENT earlier than when register the
+			 * kprobe.
+			 */
+			return ERR_PTR(-ENOENT);
+	}
+
 	/*
 	 * local trace_kprobes are not added to dyn_event, so they are never
 	 * searched in find_trace_kprobe(). Therefore, there is no concern of
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index dc19d5d185d4..edbb1624061e 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -403,6 +403,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
 	C(BAD_MAXACT,		"Invalid maxactive number"),		\
 	C(MAXACT_TOO_BIG,	"Maxactive is too big"),		\
 	C(BAD_PROBE_ADDR,	"Invalid probed address or symbol"),	\
+	C(NON_UNIQ_SYMBOL,	"The symbol is not unique"),		\
 	C(BAD_RETPROBE,		"Retprobe address must be an function entry"), \
 	C(NO_GROUP_NAME,	"Group name is not specified"),		\
 	C(GROUP_TOO_LONG,	"Group name is too long"),		\
-- 
2.46.0

[PATCH 5.4.y 2/2] tracing/kprobes: Fix symbol counting logic by looking at modules as well

[Sherry Yang]

From: Andrii Nakryiko <andrii@kernel.org>

commit 926fe783c8a64b33997fec405cf1af3e61aed441 upstream.

Recent changes to count number of matching symbols when creating
a kprobe event failed to take into account kernel modules. As such, it
breaks kprobes on kernel module symbols, by assuming there is no match.

Fix this my calling module_kallsyms_on_each_symbol() in addition to
kallsyms_on_each_match_symbol() to perform a proper counting.

Link: https://lore.kernel.org/all/20231027233126.2073148-1-andrii@kernel.org/

Cc: Francis Laniel <flaniel@linux.microsoft.com>
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Fixes: b022f0c7e404 ("tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Song Liu <song@kernel.org>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Markus Boehme <markubo@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[Sherry: It's a fix for previous backport, thus backport together to
5.4.y]
Signed-off-by: Sherry Yang <sherry.yang@oracle.com>
---
 kernel/trace/trace_kprobe.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 80a59dbdd631..2164abe06d84 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -741,6 +741,8 @@ static unsigned int number_of_same_symbols(char *func_name)
 
 	kallsyms_on_each_symbol(count_symbols, &args);
 
+	module_kallsyms_on_each_symbol(count_symbols, &args);
+
 	return args.count;
 }
 
-- 
2.46.0

[PATCH 5.4.y 0/2] tracing/kprobes: Backport request about

[Sherry Yang]

The new test case which checks non unique symbol kprobe_non_uniq_symbol.tc 
failed because of missing kernel functionality support from commit 
b022f0c7e404 ("tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols"). 
Backport it and its fix commit to 5.4.y together. Resolved minor context change conflicts.

Andrii Nakryiko (1):
  tracing/kprobes: Fix symbol counting logic by looking at modules as
    well

Francis Laniel (1):
  tracing/kprobes: Return EADDRNOTAVAIL when func matches several
    symbols

 kernel/trace/trace_kprobe.c | 76 +++++++++++++++++++++++++++++++++++++
 kernel/trace/trace_probe.h  |  1 +
 2 files changed, 77 insertions(+)

-- 
2.46.0

Re: [PATCH 5.4.y 0/2] tracing/kprobes: Backport request about

[Greg KH]

On Fri, Sep 27, 2024 at 02:43:57PM -0700, Sherry Yang wrote:
> The new test case which checks non unique symbol kprobe_non_uniq_symbol.tc 
> failed because of missing kernel functionality support from commit 
> b022f0c7e404 ("tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols"). 
> Backport it and its fix commit to 5.4.y together. Resolved minor context change conflicts.
> 
> Andrii Nakryiko (1):
>   tracing/kprobes: Fix symbol counting logic by looking at modules as
>     well
> 
> Francis Laniel (1):
>   tracing/kprobes: Return EADDRNOTAVAIL when func matches several
>     symbols

As per the documentation, we can't take patches for older kernels and
not newer ones, otherwise you will have regressions when you finally
move off this old kernel to a modern one :)

Please resend ALL of the needed backports, not just one specific kernel.
I'm dropping these from my review queue now.

thanks,

greg k-h

Re: [PATCH 5.4.y 0/2] tracing/kprobes: Backport request about

[Sherry Yang]

Hi Greg,

> On Oct 1, 2024, at 1:11 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> 
> On Fri, Sep 27, 2024 at 02:43:57PM -0700, Sherry Yang wrote:
>> The new test case which checks non unique symbol kprobe_non_uniq_symbol.tc 
>> failed because of missing kernel functionality support from commit 
>> b022f0c7e404 ("tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols"). 
>> Backport it and its fix commit to 5.4.y together. Resolved minor context change conflicts.
>> 
>> Andrii Nakryiko (1):
>>  tracing/kprobes: Fix symbol counting logic by looking at modules as
>>    well
>> 
>> Francis Laniel (1):
>>  tracing/kprobes: Return EADDRNOTAVAIL when func matches several
>>    symbols
> 
> As per the documentation, we can't take patches for older kernels and
> not newer ones, otherwise you will have regressions when you finally
> move off this old kernel to a modern one :)
> 
> Please resend ALL of the needed backports, not just one specific kernel.
> I'm dropping these from my review queue now.

I have sent the backports to 5.10.y, and Sasha queued them up. Can we get this series in your 5.4.y review queue again?

Sherry

Re: [PATCH 5.4.y 0/2] tracing/kprobes: Backport request about

[Greg KH]

On Fri, Oct 11, 2024 at 04:55:15PM +0000, Sherry Yang wrote:
> Hi Greg,
> 
> > On Oct 1, 2024, at 1:11 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> > 
> > On Fri, Sep 27, 2024 at 02:43:57PM -0700, Sherry Yang wrote:
> >> The new test case which checks non unique symbol kprobe_non_uniq_symbol.tc 
> >> failed because of missing kernel functionality support from commit 
> >> b022f0c7e404 ("tracing/kprobes: Return EADDRNOTAVAIL when func matches several symbols"). 
> >> Backport it and its fix commit to 5.4.y together. Resolved minor context change conflicts.
> >> 
> >> Andrii Nakryiko (1):
> >>  tracing/kprobes: Fix symbol counting logic by looking at modules as
> >>    well
> >> 
> >> Francis Laniel (1):
> >>  tracing/kprobes: Return EADDRNOTAVAIL when func matches several
> >>    symbols
> > 
> > As per the documentation, we can't take patches for older kernels and
> > not newer ones, otherwise you will have regressions when you finally
> > move off this old kernel to a modern one :)
> > 
> > Please resend ALL of the needed backports, not just one specific kernel.
> > I'm dropping these from my review queue now.
> 
> I have sent the backports to 5.10.y, and Sasha queued them up. Can we get this series in your 5.4.y review queue again?

Please resend them as they are long gone from my queue.

thanks,

greg k-h