On Wed, 18 Apr 2018 16:40:19 +0200 Miklos Szeredi <mik...@szeredi.hu> wrote:
> > The trace_uprobe (the probe event) is created, it doesn't do anything > > until it is enabled. This function is called when it is enabled. The > > trace_uprobe (probe event) can not be deleted while it is enabled > > (EBUSY). > > > > Are you asking what happens if the file is deleted while it has probe? > > That I don't know about (haven't tried it out). But I would hope that > > it keeps a reference to the inode, isn't that what the igrab is for? > > And is now being replaced by a reference on the path, or is that the > > problem? > > No, that's not the problem. > > What I don't see is how the uprobe object relates to the trace_uprobe object. > > Because after the patch the uprobe object still only has a ref to the > inode, and that can lead to the same issue as with trace_uprobe. > OTOH if uprobe can't survive its creating trace_uprobe, then it > doesn't need to take a ref to the inode at all, since trace_uprobe > already holds it. Taking an extra ref isn't incorrect, it's just > unnecessary and confusing. > > So this needs to be cleared up in some way. The uprobe created by the trace_uprobe creation must be deleted before the trace_uprobe can be deleted. Basically we have this: # cd /sys/kernel/tracing # echo "uprobe creation text" > uprobe_events The trace_uprobe is created (but not the uprobe itself). This is what calls create_trace_uprobe(). # echo 1 > events/uprobes/enable This enables all the trace uprobe events, which creates the uprobes. This is the action that calls probe_event_enable(), which creates uprobes. At this point, any write to uprobe_events that would destroy the trace uprobes would return with -EBUSY, and the trace uprobes will not be deleted. # echo 0 > events/uprobes/enable This will call the probe_event_disable() which will call uprobe_unregister() which will destroy the uprobe. Now we can delete the trace uprobe. Does that answer your question? A uprobe created for trace uprobes can not survive the trace uprobe itself. -- Steve
