Re: [PATCH v3 1/1] kprobes: Make optprobe optimizer multi-generational and asynchronous

On Wed, 30 Sep 2026 13:00:18 +0000
sashiko-bot@kernel.org wrote:

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider:
- [High] kprobes: double free/list corruption via double
hlist_del_rcu() on freeing_list --

commit 713397faac31184a877c512a3215f1d8fc48a2f8
Author: Masami Hiramatsu (Google) [off-list ref]
Subject: kprobes: Make optprobe optimizer multi-generational and
asynchronous

This commit replaces synchronize_rcu_tasks() with call_rcu_tasks() by
introducing a multi-generational ring buffer. The kprobe optimizer now
unoptimizes probes and defers their cleanup asynchronously.

quoted

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 4edd8ca5c6578..33523e9beb884 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c  

[ ... ]

quoted

@@ -624,67 +696,145 @@ static void do_free_cleaned_kprobes(void)
 
 static void kick_kprobe_optimizer(void);
 
-/* Kprobe jump optimizer */
-static void kprobe_optimizer(void)
+static void optprobe_generation_rcu_cb(struct rcu_head *rcu)
 {
-	guard(mutex)(&kprobe_mutex);
+	struct optprobe_generation *gen;
+
+	gen = container_of(rcu, struct optprobe_generation, rcu);
+	WRITE_ONCE(gen->ready, true);
+	wake_up(&kprobe_optimizer_wait);
+}
+
+static void optprobe_finalize_generation(struct

optprobe_generation *gen) +{
+	struct optimized_kprobe *op, *tmp;
+
+	lockdep_assert_held(&kprobe_mutex);
 
 	scoped_guard(cpus_read_lock) {
 		guard(mutex)(&text_mutex);
 
-		/*
-		 * Step 1: Unoptimize kprobes and collect cleaned
(unused and disarmed)
-		 * kprobes before waiting for quiesence period.
-		 */
-		do_unoptimize_kprobes();
+		/* Optimization never be done when disarmed */
+		if (!kprobes_all_disarmed &&
kprobes_allow_optimization &&
+		    !list_empty(&gen->optimizing_list))
+
arch_optimize_kprobes(&gen->optimizing_list);
+	}
+
+	/* Free cleaned kprobes after quiescence period */
+	do_free_cleaned_kprobes(&gen->freeing_list);
+
+	/* Finalize unoptimized kprobes whose quiescence period
completed */
+	list_for_each_entry_safe(op, tmp, &gen->cooling_list,
list) {
+		if (kprobe_unused(&op->kp)) {
+			/*
+			 * Unregistered while quiescence period
was in flight.
+			 * Remove from hash list and move to
cur_gen's freeing list.
+			 */
+			hlist_del_rcu(&op->kp.hlist);
+			list_move(&op->list,
&optprobe_gens[optprobe_cur_gen].freeing_list);  

[Severity: High]
Does this code risk list corruption via a double free?

If a kprobe in the cooling_list becomes unused and is unhashed here,
it is moved to the current generation's freeing_list.

When this current generation is later dispatched,
do_unoptimize_kprobes() will iterate over its freeing_list (passed as
free_list):

kernel/kprobes.c:do_unoptimize_kprobes() {
    ...
    list_for_each_entry_safe(op, tmp, free_list, list) {
        ...
        if (kprobe_unused(&op->kp)) {
            hlist_del_rcu(&op->kp.hlist);
        }
        ...
}

Will this unconditionally call hlist_del_rcu() a second time on the
same probe, causing a regression by dereferencing LIST_POISON2?

Oops, good catch! Since there is no reason to remove it from hash
in optprobe_finalize_generation() (it can be reused), I will drop
the hlist_del_rcu() from there.

Thanks!


-- 
Masami Hiramatsu (Google) [off-list ref]