On Wed, 30 Sep 2026 13:36:18 +0800
Leon Hwang <[email protected]> wrote:
> On x86, an optkprobe at A replaces five bytes with a jump. If a disabled
> probe B is at A+2, get_optimized_kprobe() stops at B when arming a new
> probe C at A+4. It leaves A optimized:
>
> A A+1 A+2 A+3 A+4
> A's jump | e9 | d0 | d1 | d2 | d3 |
> after C | e9 | d0 | d1 | d2 | cc |
>
> The INT3 for C overwrites the last byte of A's jump displacement, so
> execution can jump to the wrong address. B can have prepared optinsns
> while disarmed, but has no jump to unoptimize.
Oops, good catch! get_optimized_kprobe() only checks the first disabled
one and do not unoptimize the A.
>
> Continue past disarmed and unprepared probes to find the active optimized
> probe before arming a probe in its jump.
Yeah, this looks good to me. Let me send via probes/fixes.
Thank you!!
>
> Fixes: afd66255b9a4 ("kprobes: Introduce kprobes jump optimization")
> Cc: [email protected]
> Signed-off-by: Leon Hwang <[email protected]>
> ---
> kernel/kprobes.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> index 6337da5cab9e..e6f6e18fa1b5 100644
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -495,14 +495,16 @@ static bool kprobe_queued(struct kprobe *p)
> static struct kprobe *get_optimized_kprobe(kprobe_opcode_t *addr)
> {
> int i;
> - struct kprobe *p = NULL;
> + struct kprobe *p;
> struct optimized_kprobe *op;
>
> /* Don't check i == 0, since that is a breakpoint case. */
> - for (i = 1; !p && i < MAX_OPTIMIZED_LENGTH / sizeof(kprobe_opcode_t);
> i++)
> + for (i = 1; i < MAX_OPTIMIZED_LENGTH / sizeof(kprobe_opcode_t); i++) {
> p = get_kprobe(addr - i);
> + /* A disabled probe can have prepared, but inactive, optinsns.
> */
> + if (!p || !kprobe_optready(p) || kprobe_disarmed(p))
> + continue;
>
> - if (p && kprobe_optready(p)) {
> op = container_of(p, struct optimized_kprobe, kp);
> if (arch_within_optimized_kprobe(op, addr))
> return p;
> --
> 2.55.0
>
--
Masami Hiramatsu (Google) <[email protected]>
