Messages in this thread | | | Date | Wed, 28 Jan 2009 13:13:14 -0500 | From | Masami Hiramatsu <> | Subject | Re: [BUG][kprobes][vunmap?]: kprobes may cause memory corruption |
| |
Masami Hiramatsu wrote: > Mathieu Desnoyers wrote: >> * Masami Hiramatsu (mhiramat@redhat.com) wrote: >>> Mathieu Desnoyers wrote: > [...] >>>> All this called in a loop. This would help isolating the "vmap" part of >>>> the issue. If this test is not enough, then we should maybe try >>>> something like this in a kernel module (which does what text_poke does >>>> with vmalloc, more or less) in a loop : >>>> >>>> char somedata[PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); >>>> char copydata[PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); >>> Should both of them have PAGE_SIZE*2? >>> >> Yes. >> >>>> void test_vmap(void) >>>> } >>>> struct page *pages[2]; >>>> char *vaddr; >>>> int i; >>>> >>>> for (i = 0; i < 2 * PAGE_SIZE; i++) >>>> copydata[i] = somedata[i]; >>>> page[0] = virt_to_page(&somedata); >>>> BUG_ON(!page[0]); >>>> page[1] = virt_to_page(&somedata + PAGE_SIZE); >>>> BUG_ON(!page[1]); > > Oops, these should be vmalloc_to_page(), shouldn't it? > >>>> vaddr = vmap(pages, 2, VM_MAP, PAGE_KERNEL); >>>> BUG_ON(!vaddr); >>>> >>>> for (i = 0; i < 2 * PAGE_SIZE; i++) >>>> vaddr[i] = copydata[i] + 1; >>>> >>>> vunmap(vaddr); >>>> >>>> for (i = 0; i < 2 * PAGE_SIZE; i++) >>>> BUG_ON(somedata[i] != copydata[i] + 1); >>>> } >>> Hmm, when I ran above code, it hit the last BUG_ON(). >>> I checked that somedata[i] didn't updated. >>> >> Do you hit the BUG_ON after the first loop ? > > At the first loop, it hit the BUG_ON. > >>>> Given you don't seem to have hit the >>>> for (i = 0; i < len; i++) >>>> BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]); >>>> test at the end of text_poke, >>> However, when I ran kprobe-based test, it doesn't hit the BUG_ON() >>> in text_poke(). >>> >> The variable declarations should have been 2*PAGE_SIZE, hopefully you >> fixed them. > > Sure, > >> There is also a sync_core() in text_poke. It should not matter, but >> maybe that could help ? > > Adding sync_core() could not help me... anyway, I'll try again > with using vmalloc_to_page().
Hmm, using vmalloc_to_page() works fine... the test didn't hit any BUG_ON.
> >>>> I suspect the write through the vmapped >>>> area is correctly done, but that the problem may lay in the mm layer. >>>> Maybe it's running out of pre-allocated vmap areas or something like >>>> this ? >>> I haven't seen vmalloc failure message on 2.6.29-rc2. >>> >> It could be because the available vmalloc space is slightly higher. >> Looking into the lazy vunmap threshold would be useful. >> >> You could also try with loop values higher than 400.
I also tested with 1000 loops, but nothing happened.
Thank you,
> > OK, Thanks, >
-- Masami Hiramatsu
Software Engineer Hitachi Computer Products (America) Inc. Software Solutions Division
e-mail: mhiramat@redhat.com
| |