uprobes: Change uprobe_copy_process() to dup return_instances

uprobe_copy_process() assumes that the new child doesn't need
->utask, it should be allocated by demand.

But this is not true if the forking task has the pending ret-
probes, the child should report them as well and thus it needs
the copy of parent's ->return_instances chain. Otherwise the
child crashes when it returns from the probed function.

Alternatively we could cleanup the child's stack, but this needs
per-arch changes and this is not what we want. At least systemtap
expects a .return in the child too.

Note: this change alone doesn't fix the problem, see the next
change.

Reported-by: Martin Cermak <mcermak@redhat.com>
Reported-by: David Smith <dsmith@redhat.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 7d12a45842a7158aaa41f325413dace1c40cd150..1c6cda68a5558c3bc04224ee373a642fd54318e4 100644 (file)
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1366,12 +1366,55 @@ static struct uprobe_task *get_utask(void)
        return current->utask;
 }
 
+static int dup_utask(struct task_struct *t, struct uprobe_task *o_utask)
+{
+       struct uprobe_task *n_utask;
+       struct return_instance **p, *o, *n;
+
+       n_utask = kzalloc(sizeof(struct uprobe_task), GFP_KERNEL);
+       if (!n_utask)
+               return -ENOMEM;
+       t->utask = n_utask;
+
+       p = &n_utask->return_instances;
+       for (o = o_utask->return_instances; o; o = o->next) {
+               n = kmalloc(sizeof(struct return_instance), GFP_KERNEL);
+               if (!n)
+                       return -ENOMEM;
+
+               *n = *o;
+               atomic_inc(&n->uprobe->ref);
+               n->next = NULL;
+
+               *p = n;
+               p = &n->next;
+               n_utask->depth++;
+       }
+
+       return 0;
+}
+
+static void uprobe_warn(struct task_struct *t, const char *msg)
+{
+       pr_warn("uprobe: %s:%d failed to %s\n",
+                       current->comm, current->pid, msg);
+}
+
 /*
  * Called in context of a new clone/fork from copy_process.
  */
 void uprobe_copy_process(struct task_struct *t)
 {
+       struct uprobe_task *utask = current->utask;
+       struct mm_struct *mm = current->mm;
+
        t->utask = NULL;
+
+       if (mm == t->mm || !utask || !utask->return_instances)
+               return;
+
+       if (dup_utask(t, utask))
+               return uprobe_warn(t, "dup ret instances");
 }
 
 /*