[PATCH] kretprobe spinlock deadlock patch

kprobe_flush_task() possibly calls kfree function during holding
kretprobe_lock spinlock, if kfree function is probed by kretprobe that will
incur spinlock deadlock.  This patch moves kfree function out scope of
kretprobe_lock.

Signed-off-by: bibo, mao <bibo.mao@intel.com>
Signed-off-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

5 files changed, 35 insertions, 10 deletions

diff --git a/arch/i386/kernel/kprobes.c b/arch/i386/kernel/kprobes.c
index 7a97544f15a0..d98e44b16fe2 100644
--- a/arch/i386/kernel/kprobes.c
+++ b/arch/i386/kernel/kprobes.c
@@ -396,11 +396,12 @@ no_kprobe:
 fastcall void *__kprobes trampoline_handler(struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
-        struct hlist_head *head;
+        struct hlist_head *head, empty_rp;
         struct hlist_node *node, *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
 
+        INIT_HLIST_HEAD(&empty_rp);
         spin_lock_irqsave(&kretprobe_lock, flags);
         head = kretprobe_inst_table_head(current);
 
@@ -429,7 +430,7 @@ fastcall void *__kprobes trampoline_handler(struct pt_regs *regs)
                 }
 
                 orig_ret_address = (unsigned long)ri->ret_addr;
-                recycle_rp_inst(ri);
+                recycle_rp_inst(ri, &empty_rp);
 
                 if (orig_ret_address != trampoline_address)
                         /*
@@ -444,6 +445,10 @@ fastcall void *__kprobes trampoline_handler(struct pt_regs *regs)
 
         spin_unlock_irqrestore(&kretprobe_lock, flags);
 
+        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+                hlist_del(&ri->hlist);
+                kfree(ri);
+        }
         return (void*)orig_ret_address;
 }
 
diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c
index 9c9c8fcdfbdc..51217d63285e 100644
--- a/arch/ia64/kernel/kprobes.c
+++ b/arch/ia64/kernel/kprobes.c
@@ -338,12 +338,13 @@ static void kretprobe_trampoline(void)
 int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
-        struct hlist_head *head;
+        struct hlist_head *head, empty_rp;
         struct hlist_node *node, *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address =
                 ((struct fnptr *)kretprobe_trampoline)->ip;
 
+        INIT_HLIST_HEAD(&empty_rp);
         spin_lock_irqsave(&kretprobe_lock, flags);
         head = kretprobe_inst_table_head(current);
 
@@ -369,7 +370,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
                         ri->rp->handler(ri, regs);
 
                 orig_ret_address = (unsigned long)ri->ret_addr;
-                recycle_rp_inst(ri);
+                recycle_rp_inst(ri, &empty_rp);
 
                 if (orig_ret_address != trampoline_address)
                         /*
@@ -387,6 +388,10 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
         spin_unlock_irqrestore(&kretprobe_lock, flags);
         preempt_enable_no_resched();
 
+        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+                hlist_del(&ri->hlist);
+                kfree(ri);
+        }
         /*
          * By returning a non-zero value, we are telling
          * kprobe_handler() that we don't want the post_handler
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 46d2fd0e5789..7b8d12b9026c 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -260,11 +260,12 @@ void kretprobe_trampoline_holder(void)
 int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
-        struct hlist_head *head;
+        struct hlist_head *head, empty_rp;
         struct hlist_node *node, *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
 
+        INIT_HLIST_HEAD(&empty_rp);
         spin_lock_irqsave(&kretprobe_lock, flags);
         head = kretprobe_inst_table_head(current);
 
@@ -290,7 +291,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
                         ri->rp->handler(ri, regs);
 
                 orig_ret_address = (unsigned long)ri->ret_addr;
-                recycle_rp_inst(ri);
+                recycle_rp_inst(ri, &empty_rp);
 
                 if (orig_ret_address != trampoline_address)
                         /*
@@ -308,6 +309,10 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
         spin_unlock_irqrestore(&kretprobe_lock, flags);
         preempt_enable_no_resched();
 
+        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+                hlist_del(&ri->hlist);
+                kfree(ri);
+        }
         /*
          * By returning a non-zero value, we are telling
          * kprobe_handler() that we don't want the post_handler
diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c
index ca28fb0b3790..4d9ff5ce4cbd 100644
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -369,11 +369,12 @@ void __kprobes kretprobe_trampoline_holder(void)
 int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
-        struct hlist_head *head;
+        struct hlist_head *head, empty_rp;
         struct hlist_node *node, *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
 
+        INIT_HLIST_HEAD(&empty_rp);
         spin_lock_irqsave(&kretprobe_lock, flags);
         head = kretprobe_inst_table_head(current);
 
@@ -399,7 +400,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
                         ri->rp->handler(ri, regs);
 
                 orig_ret_address = (unsigned long)ri->ret_addr;
-                recycle_rp_inst(ri);
+                recycle_rp_inst(ri, &empty_rp);
 
                 if (orig_ret_address != trampoline_address) {
                         /*
@@ -417,6 +418,10 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
         spin_unlock_irqrestore(&kretprobe_lock, flags);
         preempt_enable_no_resched();
 
+        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+                hlist_del(&ri->hlist);
+                kfree(ri);
+        }
         /*
          * By returning a non-zero value, we are telling
          * kprobe_handler() that we don't want the post_handler
diff --git a/arch/x86_64/kernel/kprobes.c b/arch/x86_64/kernel/kprobes.c
index d04f0ab2ff40..ac241567e682 100644
--- a/arch/x86_64/kernel/kprobes.c
+++ b/arch/x86_64/kernel/kprobes.c
@@ -405,11 +405,12 @@ no_kprobe:
 int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct kretprobe_instance *ri = NULL;
-        struct hlist_head *head;
+        struct hlist_head *head, empty_rp;
         struct hlist_node *node, *tmp;
         unsigned long flags, orig_ret_address = 0;
         unsigned long trampoline_address =(unsigned long)&kretprobe_trampoline;
 
+        INIT_HLIST_HEAD(&empty_rp);
         spin_lock_irqsave(&kretprobe_lock, flags);
         head = kretprobe_inst_table_head(current);
 
@@ -435,7 +436,7 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
                         ri->rp->handler(ri, regs);
 
                 orig_ret_address = (unsigned long)ri->ret_addr;
-                recycle_rp_inst(ri);
+                recycle_rp_inst(ri, &empty_rp);
 
                 if (orig_ret_address != trampoline_address)
                         /*
@@ -453,6 +454,10 @@ int __kprobes trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs)
         spin_unlock_irqrestore(&kretprobe_lock, flags);
         preempt_enable_no_resched();
 
+        hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {
+                hlist_del(&ri->hlist);
+                kfree(ri);
+        }
         /*
          * By returning a non-zero value, we are telling
          * kprobe_handler() that we don't want the post_handler