hprobe_expire() is used to atomically switch pending uretprobe instance
(struct return_instance) from being SRCU protected to be refcounted.
This can be done from background timer thread, or synchronously within
current thread when task is forked.

In the former case, return_instance has to be protected through RCU read
lock, and that's what hprobe_expire() used to check with
lockdep_assert(rcu_read_lock_held()).

But in the latter case (hprobe_expire() called from dup_utask()) there
is no RCU lock being held, and it's both unnecessary and incovenient.
Inconvenient due to the intervening memory allocations inside
dup_return_instance()'s loop. Unnecessary because dup_utask() is called
synchronously in current thread, and no uretprobe can run at that point,
so return_instance can't be freed either.

So drop rcu_read_lock_held() condition, and expand corresponding comment
to explain necessary lifetime guarantees. lockdep_assert()-detected
issue is a false positive.

Fixes: dd1a7567784e ("uprobes: SRCU-protect uretprobe lifetime (with timeout)")
Reported-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
---
 kernel/events/uprobes.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index e783da1d1762..4d2140cab7ec 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -762,10 +762,14 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
 	enum hprobe_state hstate;
 
 	/*
-	 * return_instance's hprobe is protected by RCU.
-	 * Underlying uprobe is itself protected from reuse by SRCU.
+	 * Caller should guarantee that return_instance is not going to be
+	 * freed from under us. This can be achieved either through holding
+	 * rcu_read_lock() or by owning return_instance in the first place.
+	 *
+	 * Underlying uprobe is itself protected from reuse by SRCU, so ensure
+	 * SRCU lock is held properly.
 	 */
-	lockdep_assert(rcu_read_lock_held() && srcu_read_lock_held(&uretprobes_srcu));
+	lockdep_assert(srcu_read_lock_held(&uretprobes_srcu));
 
 	hstate = READ_ONCE(hprobe->state);
 	switch (hstate) {
-- 
2.43.5

On 02/25, Andrii Nakryiko wrote:
>
> --- a/kernel/events/uprobes.c
> +++ b/kernel/events/uprobes.c
> @@ -762,10 +762,14 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
>  	enum hprobe_state hstate;
>
>  	/*
> -	 * return_instance's hprobe is protected by RCU.
> -	 * Underlying uprobe is itself protected from reuse by SRCU.
> +	 * Caller should guarantee that return_instance is not going to be
> +	 * freed from under us. This can be achieved either through holding
> +	 * rcu_read_lock() or by owning return_instance in the first place.
> +	 *
> +	 * Underlying uprobe is itself protected from reuse by SRCU, so ensure
> +	 * SRCU lock is held properly.
>  	 */
> -	lockdep_assert(rcu_read_lock_held() && srcu_read_lock_held(&uretprobes_srcu));
> +	lockdep_assert(srcu_read_lock_held(&uretprobes_srcu));

Reviewed-by: Oleg Nesterov <oleg@redhat.com>

On Tue, Feb 25, 2025 at 02:32:14PM -0800, Andrii Nakryiko wrote:
> hprobe_expire() is used to atomically switch pending uretprobe instance
> (struct return_instance) from being SRCU protected to be refcounted.
> This can be done from background timer thread, or synchronously within
> current thread when task is forked.
> 
> In the former case, return_instance has to be protected through RCU read
> lock, and that's what hprobe_expire() used to check with
> lockdep_assert(rcu_read_lock_held()).
> 
> But in the latter case (hprobe_expire() called from dup_utask()) there
> is no RCU lock being held, and it's both unnecessary and incovenient.
> Inconvenient due to the intervening memory allocations inside
> dup_return_instance()'s loop. Unnecessary because dup_utask() is called
> synchronously in current thread, and no uretprobe can run at that point,
> so return_instance can't be freed either.
> 
> So drop rcu_read_lock_held() condition, and expand corresponding comment
> to explain necessary lifetime guarantees. lockdep_assert()-detected
> issue is a false positive.
> 
> Fixes: dd1a7567784e ("uprobes: SRCU-protect uretprobe lifetime (with timeout)")
> Reported-by: Breno Leitao <leitao@debian.org>
> Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

lgtm

Reviewed-by: Jiri Olsa <jolsa@kernel.org>

jirka

> ---
>  kernel/events/uprobes.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
> index e783da1d1762..4d2140cab7ec 100644
> --- a/kernel/events/uprobes.c
> +++ b/kernel/events/uprobes.c
> @@ -762,10 +762,14 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
>  	enum hprobe_state hstate;
>  
>  	/*
> -	 * return_instance's hprobe is protected by RCU.
> -	 * Underlying uprobe is itself protected from reuse by SRCU.
> +	 * Caller should guarantee that return_instance is not going to be
> +	 * freed from under us. This can be achieved either through holding
> +	 * rcu_read_lock() or by owning return_instance in the first place.
> +	 *
> +	 * Underlying uprobe is itself protected from reuse by SRCU, so ensure
> +	 * SRCU lock is held properly.
>  	 */
> -	lockdep_assert(rcu_read_lock_held() && srcu_read_lock_held(&uretprobes_srcu));
> +	lockdep_assert(srcu_read_lock_held(&uretprobes_srcu));
>  
>  	hstate = READ_ONCE(hprobe->state);
>  	switch (hstate) {
> -- 
> 2.43.5
>

The following commit has been merged into the perf/urgent branch of tip:

Commit-ID:     f8c857238a392f21d5726d07966f6061007c8d4f
Gitweb:        https://git.kernel.org/tip/f8c857238a392f21d5726d07966f6061007c8d4f
Author:        Andrii Nakryiko <andrii@kernel.org>
AuthorDate:    Tue, 25 Feb 2025 14:32:14 -08:00
Committer:     Ingo Molnar <mingo@kernel.org>
CommitterDate: Tue, 25 Feb 2025 23:36:19 +01:00

uprobes: Remove too strict lockdep_assert() condition in hprobe_expire()

hprobe_expire() is used to atomically switch pending uretprobe instance
(struct return_instance) from being SRCU protected to be refcounted.
This can be done from background timer thread, or synchronously within
current thread when task is forked.

In the former case, return_instance has to be protected through RCU read
lock, and that's what hprobe_expire() used to check with
lockdep_assert(rcu_read_lock_held()).

But in the latter case (hprobe_expire() called from dup_utask()) there
is no RCU lock being held, and it's both unnecessary and incovenient.
Inconvenient due to the intervening memory allocations inside
dup_return_instance()'s loop. Unnecessary because dup_utask() is called
synchronously in current thread, and no uretprobe can run at that point,
so return_instance can't be freed either.

So drop rcu_read_lock_held() condition, and expand corresponding comment
to explain necessary lifetime guarantees. lockdep_assert()-detected
issue is a false positive.

Fixes: dd1a7567784e ("uprobes: SRCU-protect uretprobe lifetime (with timeout)")
Reported-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20250225223214.2970740-1-andrii@kernel.org
---
 kernel/events/uprobes.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index af53fbd..b4ca889 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -767,10 +767,14 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
 	enum hprobe_state hstate;
 
 	/*
-	 * return_instance's hprobe is protected by RCU.
-	 * Underlying uprobe is itself protected from reuse by SRCU.
+	 * Caller should guarantee that return_instance is not going to be
+	 * freed from under us. This can be achieved either through holding
+	 * rcu_read_lock() or by owning return_instance in the first place.
+	 *
+	 * Underlying uprobe is itself protected from reuse by SRCU, so ensure
+	 * SRCU lock is held properly.
 	 */
-	lockdep_assert(rcu_read_lock_held() && srcu_read_lock_held(&uretprobes_srcu));
+	lockdep_assert(srcu_read_lock_held(&uretprobes_srcu));
 
 	hstate = READ_ONCE(hprobe->state);
 	switch (hstate) {