lkml.org 
[lkml]   [2018]   [Mar]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 6/8] trace_uprobe/sdt: Fix multiple update of same reference counter
    On 03/13, Ravi Bangoria wrote:
    >
    > For tiny binaries/libraries, different mmap regions points to the
    > same file portion. In such cases, we may increment reference counter
    > multiple times.

    Yes,

    > But while de-registration, reference counter will get
    > decremented only by once

    could you explain why this happens? sdt_increment_ref_ctr() and
    sdt_decrement_ref_ctr() look symmetrical, _decrement_ should see
    the same mappings?

    Ether way, this patch doesn't look right at first glance... Just
    for example,

    > +static bool sdt_check_mm_list(struct trace_uprobe *tu, struct mm_struct *mm)
    > +{
    > + struct sdt_mm_list *tmp = tu->sml;
    > +
    > + if (!tu->sml || !mm)
    > + return false;
    > +
    > + while (tmp) {
    > + if (tmp->mm == mm)
    > + return true;
    > + tmp = tmp->next;
    > + }
    > +
    > + return false;

    ...

    > +}
    > +
    > +static void sdt_add_mm_list(struct trace_uprobe *tu, struct mm_struct *mm)
    > +{
    > + struct sdt_mm_list *tmp;
    > +
    > + tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
    > + if (!tmp)
    > + return;
    > +
    > + tmp->mm = mm;
    > + tmp->next = tu->sml;
    > + tu->sml = tmp;
    > +}
    > +

    ...

    > @@ -1020,8 +1104,16 @@ void trace_uprobe_mmap_callback(struct vm_area_struct *vma)
    > !trace_probe_is_enabled(&tu->tp))
    > continue;
    >
    > + down_write(&tu->sml_rw_sem);
    > + if (sdt_check_mm_list(tu, vma->vm_mm))
    > + goto cont;
    > +
    > vaddr = vma_offset_to_vaddr(vma, tu->ref_ctr_offset);
    > - sdt_update_ref_ctr(vma->vm_mm, vaddr, 1);
    > + if (!sdt_update_ref_ctr(vma->vm_mm, vaddr, 1))
    > + sdt_add_mm_list(tu, vma->vm_mm);
    > +
    > +cont:
    > + up_write(&tu->sml_rw_sem);

    To simplify, suppose that tu->sml is empty.

    Some process calls this function, increments the counter and adds its ->mm into
    the list.

    Then it exits, ->mm is freed.

    The next fork/exec allocates the same memory for the new ->mm, the new process
    calls trace_uprobe_mmap_callback() and sdt_check_mm_list() returns T?

    Oleg.

    \
     
     \ /
      Last update: 2018-03-15 15:51    [W:4.098 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site