Re: [PATCH] tracing: fprobe: fix suspicious rcu usage in fprobe_entry
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Date: 2025-09-04 04:29:34
Also in:
lkml
On Thu, 04 Sep 2025 11:37:35 +0800 Menglong Dong [off-list ref] wrote:
On 2025/9/3 12:22 Herbert Xu [off-list ref] write:quoted
On Tue, Sep 02, 2025 at 05:50:32PM +0800, menglong.dong@linux.dev wrote:quoted
On 2025/9/2 17:17 Herbert Xu [off-list ref] write:quoted
Menglong Dong [off-list ref] wrote:quoted
diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c index fb127fa95f21..fece0f849c1c 100644 --- a/kernel/trace/fprobe.c +++ b/kernel/trace/fprobe.c@@ -269,7 +269,9 @@ static int fprobe_entry(struct ftrace_graph_ent *trace, struct fgraph_ops *gops, if (WARN_ON_ONCE(!fregs)) return 0; + rcu_read_lock(); head = rhltable_lookup(&fprobe_ip_table, &func, fprobe_rht_params); + rcu_read_unlock(); reserved_words = 0; rhl_for_each_entry_rcu(node, pos, head, hlist) { if (node->addr != func)Actually this isn't quite right. I know that it is a false-positive so that it's actually safe, but if you're going to mark it with rcu_read_lock, it should cover both the lookup as well as the dereference which happens in the loop rhl_for_each_entry_rcu.Yeah, I understand. The rcu_read_lock() here is totally used to suppress the suspicious rcu usage warning, not for the protection. So I used it just for the rhltable_lookup() to reduce the impact. Maybe I should add some comment for it.My point is that after a lookup you will be doing some sort of a dereference on the RCU pointer. That would cause exactly the same splat that rhltable_lookup itself generated. For example, rhl_for_each_entry_rcu should have created the same warning, but it doesn't because for some reason it is using rcu_dereference_raw. I'll need to dig up the history of this to see if there is a good reason for it to not warn.Yeah, I understand what you mean. I noticed this, and that's why I added the rcu_read_lock() for rhashtable_lookup() only. Maybe it is to obtain better performance? Just guess ;) And hlist_for_each_entry_rcu() also uses rcu_dereference_raw().
Hi Menglong, if you update the patch to use guard(rcu)() because head is used repeatedly in fprobe_entry(), I can replace it. Thank you,
Thanks! Menglong Dongquoted
Cheers, -- Email: Herbert Xu [off-list ref] Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
-- Masami Hiramatsu (Google) [off-list ref]