kprobes: Document how optimized kprobes are removed from module unload

Thomas discovered a bug where the kprobe trace tests had a race
condition where the kprobe_optimizer called from a delayed work queue
that does the optimizing and "unoptimizing" of a kprobe, can try to
modify the text after it has been freed by the init code.

The kprobe trace selftest is a special case, and Thomas and myself
investigated to see if there's a chance that this could also be a bug
with module unloading, as the code is not obvious to how it handles
this. After adding lots of printks, I figured it out. Thomas suggested
that this should be commented so that others will not have to go
through this exercise again.

Link: http://lkml.kernel.org/r/20170516145835.3827d3aa@gandalf.local.home
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 199243bba5543a252fe8ea91a3dcadd0fd8f486c..2d2d3a568e4e8b3aeedb16711c90e660f698d6cf 100644 (file)
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2183,6 +2183,12 @@ static int kprobes_module_callback(struct notifier_block *nb,
                                 * The vaddr this probe is installed will soon
                                 * be vfreed buy not synced to disk. Hence,
                                 * disarming the breakpoint isn't needed.
+                                *
+                                * Note, this will also move any optimized probes
+                                * that are pending to be removed from their
+                                * corresponding lists to the freeing_list and
+                                * will not be touched by the delayed
+                                * kprobe_optimizer work handler.
                                 */
                                kill_kprobe(p);
                        }