Re: kernel panic when kretprobe all system calls

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

Re: kernel panic when kretprobe all system calls

Guang Lei Li
[hidden email] wrote on 2005-09-26 23:55:08:

> Frank Ch. Eigler wrote:
>
> >Hi -
> >
> >>[... kretprobes on syscalls ...]
> >
> >This has been seen before, and is being tracked as bug #1345 in
> >bugzilla.  It has apparently been reproduced by the kretprobes
> >developers and is being debugged.  More RAM seems to trigger the
> >bug less often.
> >
> >- FChE
> >
> It helps if  we don't insert return probes in sys_calls such as
> sys_execve, sys_exit, sys_groupexit. Frank, can we tempory put an
> retprobe embargo policy on those system calls?
>
> Hien.
>
Hi, how is the bug #1345 going now? I ran the latest systemTap to probe
all returns of syscalls on my x86, and still got kernel panic. Although
I didn't meet the same problem on my Power5 system, I think it is due to
the large RAM of it(15G)

I looked into the comments in the bugzilla, and found Hien has worked
out a fix for i386. But he abandoned his idea because of not portable.
So at present, will I avoid this problem only by not probing the return
of those syscalls in the blacklist? Is there a better solution now?

Thanks.
Reply | Threaded
Open this post in threaded view
|

Re: kernel panic when kretprobe all system calls

Jim Keniston
On Mon, 2005-11-07 at 18:30, Guang Lei Li wrote:

> [hidden email] wrote on 2005-09-26 23:55:08:
>
> > Frank Ch. Eigler wrote:
> >
> > >Hi -
> > >
> > >>[... kretprobes on syscalls ...]
> > >
> > >This has been seen before, and is being tracked as bug #1345 in
> > >bugzilla.  It has apparently been reproduced by the kretprobes
> > >developers and is being debugged.  More RAM seems to trigger the
> > >bug less often.
> > >
> > >- FChE
> > >
> > It helps if  we don't insert return probes in sys_calls such as
> > sys_execve, sys_exit, sys_groupexit. Frank, can we tempory put an
> > retprobe embargo policy on those system calls?
> >
> > Hien.
> >
> Hi, how is the bug #1345 going now? I ran the latest systemTap to probe
> all returns of syscalls on my x86, and still got kernel panic. Although
> I didn't meet the same problem on my Power5 system, I think it is due to
> the large RAM of it(15G)
>
> I looked into the comments in the bugzilla, and found Hien has worked
> out a fix for i386. But he abandoned his idea because of not portable.
> So at present, will I avoid this problem only by not probing the return
> of those syscalls in the blacklist? Is there a better solution now?
>
> Thanks.

Hien and I have discussed an architecture-independent fix to kprobes
that would allow you to set return probes on "problem" functions such as
sys_execve without encountering the problems described in #1345.  I've
updated the bugzilla entry.

Jim