[Bug uprobes/6842] system-wide utrace syscall tracing will cause kernel panic by hackbench.

["mhiramat at redhat dot com" <sourceware-bugzilla at sourceware dot org>]

------- Additional Comments From mhiramat at redhat dot com  2008-08-13 22:29 -------
Dug more deeper:
Here is the source code of __stp_utrace_task_finder_target_death:
----
__stp_utrace_task_finder_target_death(struct utrace_attached_engine *engine,
                                      struct task_struct *tsk)
{
        struct stap_task_finder_target *tgt = engine->data;

        if (atomic_read(&__stp_task_finder_state) != __STP_TF_RUNNING) {
                debug_task_finder_detach();
                return UTRACE_ACTION_DETACH;
        }

        // The first implementation of this added a
        // UTRACE_EVENT(DEATH) handler to
        // __stp_utrace_task_finder_ops.  However, dead threads don't
        // have a mm_struct, so we can't find the exe's path.  So, we
        // don't know which callback(s) to call.
        //
        // So, now when an "interesting" thread is found, we add a
        // separate UTRACE_EVENT(DEATH) handler for every probe.

        if (tgt != NULL && tgt->callback != NULL) {
                int rc;

                // Call the callback
                rc = tgt->callback(tsk, 0,
                                   (atomic_read(&tsk->signal->live) == 0),
                                   tgt);
                if (rc != 0) {
                        _stp_error("death callback for %d failed: %d",
                                   (int)tsk->pid, rc);
                }
        }
        debug_task_finder_detach();
        return UTRACE_ACTION_DETACH;
}
----
and disassembled code;
----
0000000000005421 <__stp_utrace_task_finder_target_death>:
    5421:       8b 05 00 00 00 00       mov    0(%rip),%eax        # 5427
<__stp_utrace_task_finder_target_death+0x6>
    5427:       53                      push   %rbx
    5428:       48 89 f3                mov    %rsi,%rbx
    542b:       48 8b 4f 30             mov    0x30(%rdi),%rcx
    542f:       ff c8                   dec    %eax				
    5431:       74 07                   je     543a
<__stp_utrace_task_finder_target_death+0x19>
    5433:       5b                      pop    %rbx
    5434:       b8 20 00 00 00          mov    $0x20,%eax
    5439:       c3                      retq   
    543a:       48 85 c9                test   %rcx,%rcx			<<--tgt!=NULL?
    543d:       74 f4                   je     5433
<__stp_utrace_task_finder_target_death+0x12>
    543f:       4c 8b 81 c0 00 00 00    mov    0xc0(%rcx),%r8
    5446:       4d 85 c0                test   %r8,%r8				<<--tgt->callback!=NULL?
    5449:       74 e8                   je     5433
<__stp_utrace_task_finder_target_death+0x12>
    544b:       48 8b 86 a8 05 00 00    mov    0x5a8(%rsi),%rax			<<--%rax :=
tsk->signal
    5452:       31 d2                   xor    %edx,%edx
    5454:       48 89 df                mov    %rbx,%rdi
    5457:       8b 40 04                mov    0x4(%rax),%eax			<<--panic(get
tsk->signal->live)
    545a:       85 c0                   test   %eax,%eax
    545c:       0f 94 c2                sete   %dl
    545f:       31 f6                   xor    %esi,%esi
    5461:       41 ff d0                callq  *%r8				<<--tgt->callback(...)
    5464:       85 c0                   test   %eax,%eax
    5466:       74 cb                   je     5433
<__stp_utrace_task_finder_target_death+0x12>
    5468:       8b b3 24 01 00 00       mov    0x124(%rbx),%esi
    546e:       89 c2                   mov    %eax,%edx
    5470:       48 c7 c7 00 00 00 00    mov    $0x0,%rdi
    5477:       31 c0                   xor    %eax,%eax
    5479:       e8 00 00 00 00          callq  547e
<__stp_utrace_task_finder_target_death+0x5d>
    547e:       eb b3                   jmp    5433
<__stp_utrace_task_finder_target_death+0x12>
----
we can see that the panic was caused by tsk->signal == NULL.


-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=6842

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.