Hi,
I found a kernel crash bug in tracing with :mod: command and dynamic
events. If we leaves a dynamic event and run :mod: command to set_event,
the kernel gets an oops.
Actually, this bug found by testing wprobe trigger test case, because
ftracetest has another bug which does not clean up the top-level event
filters/triggers before starting instance tests. Thus if the last test
case in the top-level instance fails and if it leaves a dynamic event,
that will be kept and not cleaned up. Then, test.d/event/event-mod.tc
hits this bug.
Here is the reproduce script.
-----
#!/bin/sh
TRACE_DIR="/sys/kernel/tracing"
if [ ! -d "$TRACE_DIR" ]; then
TRACE_DIR="/sys/kernel/debug/tracing"
fi
if [ ! -d "$TRACE_DIR" ]; then
echo "Error: Tracefs not found. Please mount tracefs."
exit 1
fi
cd "$TRACE_DIR"
echo "=== 1. Clear existing triggers and dynamic events ==="
echo > events/sched/sched_process_fork/trigger || true
echo > dynamic_events || true
echo "=== 2. Create a kprobe event ==="
# Adding a kprobe on vfs_write
echo 'p:kprobes/my_kprobe vfs_write' >> dynamic_events
cat dynamic_events
echo "=== 3. Attach enable_event trigger targeting my_kprobe to
sched_process_fork ==="
if [ -f "events/sched/sched_process_fork/trigger" ]; then
echo 'enable_event:kprobes:my_kprobe' >
events/sched/sched_process_fork/trigger
cat events/sched/sched_process_fork/trigger
else
echo "Error: sched_process_fork event trigger is not supported."
exit 1
fi
echo "=== 4. Try to delete the kprobe event while the trigger is active ==="
echo "Attempting: echo -:kprobes/my_kprobe >> dynamic_events"
if ! echo '-:kprobes/my_kprobe' >> dynamic_events 2>/dev/null; then
echo "Result: Successfully reproduced kprobe event deletion failure (Device
or resource busy)!"
echo "The 'my_kprobe' event remains in dynamic_events:"
cat dynamic_events
else
echo "Warning: Deletion succeeded? Check if the trigger was active."
fi
echo ""
echo "=== WARNING: The next step will crash the kernel if the union collision
bug is not fixed! ==="
echo "Press Ctrl+C to stop now, or press Enter to trigger the kernel panic (via
set_event ':mod:...' write)."
read tmp
echo "Triggering kernel panic..."
echo ':mod:trace-events-sample' > set_event
-----
Thanks,
---
Masami Hiramatsu (Google) (2):
tracing: Fix union collision of module and refcnt for dynamic events
selftests/ftrace: Reset triggers at top level before instance loop
kernel/trace/trace_events.c | 4 +++-
tools/testing/selftests/ftrace/ftracetest | 1 +
2 files changed, 4 insertions(+), 1 deletion(-)
--
Masami Hiramatsu (Google) <[email protected]>
