Bug 1073605 - u[ret]probes break userspace
Summary: u[ret]probes break userspace
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 19
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1073627
TreeView+ depends on / blocked
 
Reported: 2014-03-06 19:10 UTC by Jonathan Lebon
Modified: 2015-02-17 20:00 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
: 1073627 (view as bug list)
Environment:
Last Closed: 2015-02-17 20:00:26 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Jonathan Lebon 2014-03-06 19:10:23 UTC
Description of problem:

Using systemtap/perf to place a uretprobe on the _start function of rsync causes rsync to fail.

Version-Release number of selected component (if applicable):

kernel version: 3.13.5-101.fc19.x86_64
rsync version: rsync-3.0.9-12.fc19.x86_64
perf version: 3.13.5-101.fc19.x86_64
systemtap version: git, at least 2.4 as well

How reproducible:

Always

Steps to Reproduce Using perf:
1. perf probe -x /usr/bin/rsync _start%return
2. perf record -e probe_rsync:_start rsync --version

Steps to Reproduce Using systemtap:
1. stap -ve 'probe process("/usr/bin/rsync").function("_start").return { next }' -c 'rsync --version'

Actual results:

rsync thinks a syntax error occurred:
rsync error: syntax or usage error (code 1) at main.c(1420) [client=3.0.9]

Expected results:

(What happens when rsync --version is normally run)
rsync doesn't think a syntax error occurred (print version info and exits successfully).

Comment 1 Jonathan Lebon 2014-03-06 22:48:38 UTC
Normal uprobes are also causing issues (same versions for all the above). This time it's in git version git-1.8.3.1-1.fc19.x86_64.

In short, placing a uprobe on function create_object_directory() causes 'git init' to fail.

Steps to Reproduce Using systemtap:
1. stap -e 'probe process.function("create_object_directory") { next }' -c 'git init'

Steps to Reproduce Using perf:

The function is inlined inside of init_db(), and perf doesn't pick it up, so we need to specify the offset manually. On my computer, this is init_db+0xf1:
1. perf probe -x /usr/bin/git init_db+0xf1
2. perf record -e probe_git:init_db -a git init

Actual results:

The git process receives a segmentation fault:
$ perf record -e probe_git:init_db -a git init
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.586 MB perf.data (~25616 samples) ]
git: Segmentation fault
$

Expected results:

The git process does not receive a segmentation fault.

Additional info:

Upstream bug report: https://sourceware.org/bugzilla/show_bug.cgi?id=16662

Comment 2 Oleg Nesterov 2014-03-07 20:11:22 UTC
(In reply to Jonathan Lebon from comment #0)
>
> Steps to Reproduce Using perf:
> 1. perf probe -x /usr/bin/rsync _start%return
> 2. perf record -e probe_rsync:_start rsync --version
> 
> Steps to Reproduce Using systemtap:
> 1. stap -ve 'probe process("/usr/bin/rsync").function("_start").return {
> next }' -c 'rsync --version'
> 
> Actual results:
> 
> rsync thinks a syntax error occurred:
> rsync error: syntax or usage error (code 1) at main.c(1420) [client=3.0.9]

Not a bug, I think. Just "don't do this". _start is the very low level
function, lets look into into glibc-2.11.2/sysdeps/x86_64/elf/start.S

   This is the canonical entry point, usually the first thing in the text
   segment.
   ...

   %rsp         The stack contains the arguments and environment:
                0(%rsp)                 argc
                8(%rsp)                 argv[0]

but uprobes assumes that regs->sp points to the address to return
and overwrites it to hook "ret".

Comment 3 Justin M. Forbes 2014-03-10 14:49:39 UTC
*********** MASS BUG UPDATE **************

We apologize for the inconvenience.  There is a large number of bugs to go through and several of them have gone stale.  Due to this, we are doing a mass bug update across all of the Fedora 19 kernel bugs.

Fedora 19 has now been rebased to 3.13.5-100.fc19.  Please test this kernel update and let us know if you issue has been resolved or if it is still present with the newer kernel.

If you experience different issues, please open a new bug report for those.

Comment 4 Frank Ch. Eigler 2014-03-10 16:40:45 UTC
The uretprobe-on-_start part of this is now done via a systemtap blacklist
in commit a79bb8f0.

Comment 5 Josh Stone 2014-03-11 17:08:34 UTC
Upstream systemtap commit d9436f1ebe9c tweaks that blacklist to allow empty filenames, as found in plt and symtab function probes.

Comment 6 Justin M. Forbes 2014-05-21 19:29:57 UTC
*********** MASS BUG UPDATE **************

We apologize for the inconvenience.  There is a large number of bugs to go through and several of them have gone stale.  Due to this, we are doing a mass bug update across all of the Fedora 19 kernel bugs.

Fedora 19 has now been rebased to 3.14.4-100.fc19.  Please test this kernel update (or newer) and let us know if you issue has been resolved or if it is still present with the newer kernel.

If you have moved on to Fedora 20, and are still experiencing this issue, please change the version to Fedora 20.

If you experience different issues, please open a new bug report for those.

Comment 7 Jonathan Lebon 2014-05-22 14:18:35 UTC
> Fedora 19 has now been rebased to 3.14.4-100.fc19.  Please test this kernel
> update (or newer) and let us know if you issue has been resolved or if it is
> still present with the newer kernel.

This issue is still present in 3.14.4-100.fc19. Oleg submitted patches already: https://lkml.org/lkml/2014/4/30/502

Comment 8 Oleg Nesterov 2014-06-16 16:25:12 UTC
(In reply to Jonathan Lebon from comment #7)
> > Fedora 19 has now been rebased to 3.14.4-100.fc19.  Please test this kernel
> > update (or newer) and let us know if you issue has been resolved or if it is
> > still present with the newer kernel.
> 
> This issue is still present in 3.14.4-100.fc19. Oleg submitted patches
> already: https://lkml.org/lkml/2014/4/30/502

Yes, thanks. Hopefully fixed in v3.15 upstream.

Comment 9 Fedora End Of Life 2015-01-09 21:12:10 UTC
This message is a notice that Fedora 19 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 19. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained. Approximately 4 (four) weeks from now this bug will
be closed as EOL if it remains open with a Fedora 'version' of '19'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 19 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 10 Fedora End Of Life 2015-02-17 20:00:26 UTC
Fedora 19 changed to end-of-life (EOL) status on 2015-01-06. Fedora 19 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.


Note You need to log in before you can comment on or make changes to this bug.