github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

uprobes/x86: Remove struct uprobe_trampoline object

Browse Source 
Removing struct uprobe_trampoline object and it's tracking code,
because it's not needed. We can do same thing directly on top of
struct vm_area_struct objects.

This makes the code simpler and allows easy propagation of the
trampoline vma object into child process in following change.

Note the original code called destroy_uprobe_trampoline if the
optimiation failed, but it only freed the struct uprobe_trampoline
object, not the vma. The new vma leak is fixed in following change.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://patch.msgid.link/20260703114917.238144-3-jolsa@kernel.org
This commit is contained in:
Jiri Olsa 2026-07-03 13:49:06 +02:00 committed by Peter Zijlstra
parent ded9b5bd03
commit 38af0dd6a2
4 changed files with 22 additions and 100 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

106
arch/x86/kernel/uprobes.c
View File

@ -631,11 +631,6 @@ static struct vm_special_mapping tramp_mapping = {
.pages = tramp_mapping_pages,
};
struct uprobe_trampoline {
struct hlist_node node;
unsigned long vaddr;
};
static bool is_reachable_by_call(unsigned long vtramp, unsigned long vaddr)
{
long delta = (long)(vaddr + 5 - vtramp);
@ -682,83 +677,28 @@ static unsigned long find_nearest_trampoline(unsigned long vaddr)
return high_tramp;
}
static struct uprobe_trampoline *create_uprobe_trampoline(unsigned long vaddr)
static struct vm_area_struct *get_uprobe_trampoline(struct mm_struct *mm, unsigned long vaddr)
{
struct pt_regs *regs = task_pt_regs(current);
struct mm_struct *mm = current->mm;
struct uprobe_trampoline *tramp;
VMA_ITERATOR(vmi, mm, 0);
struct vm_area_struct *vma;
if (!user_64bit_mode(regs))
return NULL;
if (vaddr > TASK_SIZE || vaddr < PAGE_SIZE)
return ERR_PTR(-EINVAL);
for_each_vma(vmi, vma) {
if (!vma_is_special_mapping(vma, &tramp_mapping))
continue;
if (is_reachable_by_call(vma->vm_start, vaddr))
return vma;
}
vaddr = find_nearest_trampoline(vaddr);
if (IS_ERR_VALUE(vaddr))
return NULL;
return ERR_PTR(vaddr);
tramp = kzalloc_obj(*tramp);
if (unlikely(!tramp))
return NULL;
tramp->vaddr = vaddr;
vma = _install_special_mapping(mm, tramp->vaddr, PAGE_SIZE,
return _install_special_mapping(mm, vaddr, PAGE_SIZE,
VM_READ|VM_EXEC|VM_MAYEXEC|VM_MAYREAD|VM_DONTCOPY|VM_IO,
&tramp_mapping);
if (IS_ERR(vma)) {
kfree(tramp);
return NULL;
}
return tramp;
}
static struct uprobe_trampoline *get_uprobe_trampoline(unsigned long vaddr, bool *new)
{
struct uprobes_state *state = &current->mm->uprobes_state;
struct uprobe_trampoline *tramp = NULL;
if (vaddr > TASK_SIZE || vaddr < PAGE_SIZE)
return NULL;
hlist_for_each_entry(tramp, &state->head_tramps, node) {
if (is_reachable_by_call(tramp->vaddr, vaddr)) {
*new = false;
return tramp;
}
}
tramp = create_uprobe_trampoline(vaddr);
if (!tramp)
return NULL;
*new = true;
hlist_add_head(&tramp->node, &state->head_tramps);
return tramp;
}
static void destroy_uprobe_trampoline(struct uprobe_trampoline *tramp)
{
/*
* We do not unmap and release uprobe trampoline page itself,
* because there's no easy way to make sure none of the threads
* is still inside the trampoline.
*/
hlist_del(&tramp->node);
kfree(tramp);
}
void arch_uprobe_init_state(struct mm_struct *mm)
{
INIT_HLIST_HEAD(&mm->uprobes_state.head_tramps);
}
void arch_uprobe_clear_state(struct mm_struct *mm)
{
struct uprobes_state *state = &mm->uprobes_state;
struct uprobe_trampoline *tramp;
struct hlist_node *n;
hlist_for_each_entry_safe(tramp, n, &state->head_tramps, node)
destroy_uprobe_trampoline(tramp);
}
static bool __in_uprobe_trampoline(struct mm_struct *mm, unsigned long ip)
@ -1111,21 +1051,19 @@ int set_orig_insn(struct arch_uprobe *auprobe, struct vm_area_struct *vma,
static int __arch_uprobe_optimize(struct arch_uprobe *auprobe, struct mm_struct *mm,
unsigned long vaddr)
{
struct uprobe_trampoline *tramp;
struct vm_area_struct *vma;
bool new = false;
int err = 0;
struct pt_regs *regs = task_pt_regs(current);
struct vm_area_struct *vma, *tramp;
int ret;
if (!user_64bit_mode(regs))
return -EINVAL;
vma = find_vma(mm, vaddr);
if (!vma)
return -EINVAL;
tramp = get_uprobe_trampoline(vaddr, &new);
if (!tramp)
return -EINVAL;
err = swbp_optimize(auprobe, vma, vaddr, tramp->vaddr);
if (WARN_ON_ONCE(err) && new)
destroy_uprobe_trampoline(tramp);
return err;
tramp = get_uprobe_trampoline(mm, vaddr);
if (IS_ERR(tramp))
return PTR_ERR(tramp);
return WARN_ON_ONCE(swbp_optimize(auprobe, vma, vaddr, tramp->vm_start));
}
void arch_uprobe_optimize(struct arch_uprobe *auprobe, unsigned long vaddr)

5
include/linux/uprobes.h
View File

@ -186,9 +186,6 @@ struct xol_area;
struct uprobes_state {
struct xol_area *xol_area;
#ifdef CONFIG_X86_64
struct hlist_head head_tramps;
#endif
};
typedef int (*uprobe_write_verify_t)(struct page *page, unsigned long vaddr,
@ -238,8 +235,6 @@ extern void uprobe_handle_trampoline(struct pt_regs *regs);
extern void *arch_uretprobe_trampoline(unsigned long *psize);
extern unsigned long uprobe_get_trampoline_vaddr(void);
extern void uprobe_copy_from_page(struct page *page, unsigned long vaddr, void *dst, int len);
extern void arch_uprobe_clear_state(struct mm_struct *mm);
extern void arch_uprobe_init_state(struct mm_struct *mm);
extern void handle_syscall_uprobe(struct pt_regs *regs, unsigned long bp_vaddr);
extern void arch_uprobe_optimize(struct arch_uprobe *auprobe, unsigned long vaddr);
extern unsigned long arch_uprobe_get_xol_area(void);

10
kernel/events/uprobes.c
View File

@ -1806,14 +1806,6 @@ static struct xol_area *get_xol_area(void)
return area;
}
void __weak arch_uprobe_clear_state(struct mm_struct *mm)
{
}
void __weak arch_uprobe_init_state(struct mm_struct *mm)
{
}
/*
* uprobe_clear_state - Free the area allocated for slots.
*/
@ -1825,8 +1817,6 @@ void uprobe_clear_state(struct mm_struct *mm)
delayed_uprobe_remove(NULL, mm);
mutex_unlock(&delayed_uprobe_lock);
arch_uprobe_clear_state(mm);
if (!area)
return;

1
kernel/fork.c
View File

@ -1064,7 +1064,6 @@ static void mm_init_uprobes_state(struct mm_struct *mm)
{
#ifdef CONFIG_UPROBES
mm->uprobes_state.xol_area = NULL;
arch_uprobe_init_state(mm);
#endif
}