commit 374d37118ae1274077a425261ef1428151eb6d7c

Author: Sultan Alsawaf <sultan@openresty.com>

Date:   Tue Nov 10 10:03:34 2020 -0800

    stp_utrace: disable IRQs when holding the bucket spin lock

    This lock can be acquired from inside an IRQ, leading to a deadlock:

    WARNING: inconsistent lock state

    4.14.35-1902.6.6.el7uek.x86_64.debug #2 Tainted: G           OE

    --------------------------------

    inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.

    sh/15779 [HC1[1]:SC0[0]:HE0:SE1] takes:

     (&(lock)->rlock#3){?.+.}, at: [<ffffffffc0c080b0>] _stp_mempool_alloc+0x35/0xab [orxray_lj_lua_fgraph_XXXXXXX]

    {HARDIRQ-ON-W} state was registered at:

      lock_acquire+0xe0/0x238

      _raw_spin_lock+0x3d/0x7a

      utrace_task_alloc+0xa4/0xe3 [orxray_lj_lua_fgraph_XXXXXXX]

      utrace_attach_task+0x136/0x194 [orxray_lj_lua_fgraph_XXXXXXX]

      __stp_utrace_attach+0x57/0x216 [orxray_lj_lua_fgraph_XXXXXXX]

      stap_start_task_finder+0x12e/0x33f [orxray_lj_lua_fgraph_XXXXXXX]

      systemtap_module_init+0x114d/0x11f0 [orxray_lj_lua_fgraph_XXXXXXX]

      _stp_handle_start+0xea/0x1c5 [orxray_lj_lua_fgraph_XXXXXXX]

      _stp_ctl_write_cmd+0x28d/0x2d1 [orxray_lj_lua_fgraph_XXXXXXX]

      full_proxy_write+0x67/0xbb

      __vfs_write+0x3a/0x170

      vfs_write+0xc7/0x1c0

      SyS_write+0x58/0xbf

      do_syscall_64+0x7e/0x22c

      entry_SYSCALL_64_after_hwframe+0x16e/0x0

    irq event stamp: 9454

    hardirqs last  enabled at (9453): [<ffffffffa696c960>] _raw_write_unlock_irqrestore+0x40/0x67

    hardirqs last disabled at (9454): [<ffffffffa6a05417>] apic_timer_interrupt+0x1c7/0x1d1

    softirqs last  enabled at (9202): [<ffffffffa6c00361>] __do_softirq+0x361/0x4e5

    softirqs last disabled at (9195): [<ffffffffa60aeb76>] irq_exit+0xf6/0x102

    other info that might help us debug this:

     Possible unsafe locking scenario:

           CPU0

           ----

      lock(&(lock)->rlock#3);

      <Interrupt>

        lock(&(lock)->rlock#3);

     *** DEADLOCK ***

    no locks held by sh/15779.

    stack backtrace:

    CPU: 16 PID: 15779 Comm: sh Tainted: G           OE   4.14.35-1902.6.6.el7uek.x86_64.debug #2

    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014

    Call Trace:

     <IRQ>

     dump_stack+0x81/0xb6

     print_usage_bug+0x1fc/0x20d

     ? check_usage_backwards+0x130/0x12b

     mark_lock+0x1f8/0x27b

     __lock_acquire+0x6e7/0x165a

     ? sched_clock_local+0x18/0x81

     ? perf_swevent_hrtimer+0x136/0x151

     lock_acquire+0xe0/0x238

     ? _stp_mempool_alloc+0x35/0xab [orxray_lj_lua_fgraph_XXXXXXX]

     _raw_spin_lock_irqsave+0x55/0x97

     ? _stp_mempool_alloc+0x35/0xab [orxray_lj_lua_fgraph_XXXXXXX]

     _stp_mempool_alloc+0x35/0xab [orxray_lj_lua_fgraph_XXXXXXX]

     _stp_ctl_get_buffer+0x69/0x215 [orxray_lj_lua_fgraph_XXXXXXX]

     _stp_ctl_send+0x4e/0x169 [orxray_lj_lua_fgraph_XXXXXXX]

     _stp_vlog+0xac/0x143 [orxray_lj_lua_fgraph_XXXXXXX]

     ? _stp_utrace_probe_cb+0xa4/0xa4 [orxray_lj_lua_fgraph_XXXXXXX]

     _stp_warn+0x6a/0x88 [orxray_lj_lua_fgraph_XXXXXXX]

     function___global_warn__overload_0+0x60/0xac [orxray_lj_lua_fgraph_XXXXXXX]

     probe_67+0xce/0x10e [orxray_lj_lua_fgraph_XXXXXXX]

     _stp_hrtimer_notify_function+0x2db/0x55f [orxray_lj_lua_fgraph_XXXXXXX]

     __hrtimer_run_queues+0x132/0x5c5

     hrtimer_interrupt+0xb7/0x1ca

     smp_apic_timer_interrupt+0xa5/0x35a

     apic_timer_interrupt+0x1cc/0x1d1

     </IRQ>

diff --git a/runtime/stp_utrace.c b/runtime/stp_utrace.c

index e2880f1e4..46ba48923 100644

--- a/runtime/stp_utrace.c

+++ b/runtime/stp_utrace.c

@@ -490,9 +490,9 @@ static int utrace_exit(void)

 		rcu_read_lock();

 		stap_hlist_for_each_entry_rcu(utrace, node, &bucket->head, hlist) {

 			utrace->freed = true;

-			stp_spin_lock(&bucket->lock);

+			stp_spin_lock_irqsave(&bucket->lock, flags);

 			hlist_del_rcu(&utrace->hlist);

-			stp_spin_unlock(&bucket->lock);

+			stp_spin_unlock_irqrestore(&bucket->lock, flags);

 			utrace_cleanup(utrace);

 		}

@@ -724,6 +724,7 @@ static struct utrace *utrace_task_alloc(struct utrace_bucket *bucket,

 					struct task_struct *task)

 {

 	struct utrace *utrace;

+	unsigned long flags;

 	utrace = kmem_cache_zalloc(utrace_cachep, STP_ALLOC_FLAGS);

 	if (unlikely(!utrace))

@@ -739,9 +740,9 @@ static struct utrace *utrace_task_alloc(struct utrace_bucket *bucket,

 	atomic_set(&utrace->resume_work_added, 0);

 	atomic_set(&utrace->report_work_added, 0);

-	stp_spin_lock(&bucket->lock);

+	stp_spin_lock_irqsave(&bucket->lock, flags);

 	hlist_add_head_rcu(&utrace->hlist, &bucket->head);

-	stp_spin_unlock(&bucket->lock);

+	stp_spin_unlock_irqrestore(&bucket->lock, flags);

 	return utrace;

 }

@@ -768,15 +769,17 @@ static struct utrace *utrace_task_alloc(struct utrace_bucket *bucket,

  */

 static void utrace_free(struct utrace_bucket *bucket, struct utrace *utrace)

 {

+	unsigned long flags;

+

 	if (unlikely(!utrace))

 		return;

 	/* Remove this utrace from the mapping list of tasks to

 	 * struct utrace. */

 	utrace->freed = true;

-	stp_spin_lock(&bucket->lock);

+	stp_spin_lock_irqsave(&bucket->lock, flags);

 	hlist_del_rcu(&utrace->hlist);

-	stp_spin_unlock(&bucket->lock);

+	stp_spin_unlock_irqrestore(&bucket->lock, flags);

 	/* Free the utrace struct. */

 #ifdef STP_TF_DEBUG

commit 6a092f5ae824d4ce972c10b8681b9272e2fd67f3

Author: Sultan Alsawaf <sultan@openresty.com>

Date:   Tue Nov 17 11:03:53 2020 -0800

    task_finder: call _stp_vma_done() upon error to fix memory leak

    The memory allocated inside stap_initialize_vma_map() is not freed upon

    error when the task finder is started because a call to _stp_vma_done()

    in the error path is missing. Add it to fix the leak.

diff --git a/task_finder.cxx b/task_finder.cxx

index d08d44a75..7c45e728b 100644

--- a/task_finder.cxx

+++ b/task_finder.cxx

@@ -66,6 +66,7 @@ task_finder_derived_probe_group::emit_module_init (systemtap_session& s)

   s.op->newline() << "if (rc) {";

   s.op->newline(1) << "stap_stop_task_finder();";

+  s.op->newline() << "_stp_vma_done();";

   s.op->newline(-1) << "}";

   s.op->newline(-1) << "}";

 }

commit 3c4f82ca024df4f8e213f7c77418493262d4a4d7

Author: Sultan Alsawaf <sultan@openresty.com>

Date:   Tue Nov 24 10:50:10 2020 -0800

    runtime_context: factor out RCU usage using a rw lock

    We can factor out the RCU insanity in here by just adding in a rw lock

    and using that to synchronize _stp_runtime_contexts_free() with any code

    that has the runtime context held.

diff --git a/runtime/linux/runtime_context.h b/runtime/linux/runtime_context.h

index 41fecba81..18566957a 100644

--- a/runtime/linux/runtime_context.h

+++ b/runtime/linux/runtime_context.h

@@ -11,15 +11,14 @@

 #ifndef _LINUX_RUNTIME_CONTEXT_H_

 #define _LINUX_RUNTIME_CONTEXT_H_

-#ifndef __rcu

-#define __rcu

-#endif

-

-static struct context __rcu *contexts[NR_CPUS] = { NULL };

+/* Can't use STP_DEFINE_RWLOCK() or this might be replaced with a spin lock */

+static DEFINE_RWLOCK(_stp_context_lock);

+static DEFINE_PER_CPU(struct context *, contexts);

+static atomic_t _stp_context_stop = ATOMIC_INIT(0);

 static int _stp_runtime_contexts_alloc(void)

 {

-	int cpu;

+	unsigned int cpu;

 	for_each_possible_cpu(cpu) {

 		/* Module init, so in user context, safe to use

@@ -31,91 +30,67 @@ static int _stp_runtime_contexts_alloc(void)

 				    (unsigned long) sizeof (struct context));

 			return -ENOMEM;

 		}

-		rcu_assign_pointer(contexts[cpu], c);

+		per_cpu(contexts, cpu) = c;

 	}

 	return 0;

 }

 /* We should be free of all probes by this time, but for example the timer for

  * _stp_ctl_work_callback may still be running and looking for contexts.  We

- * use RCU-sched synchronization to be sure its safe to free them.  */

+ * use _stp_context_stop and a write lock to be sure its safe to free them.  */

 static void _stp_runtime_contexts_free(void)

 {

-	// Note that 'free_contexts' is static because it is

-	// (probably) too big to fit on a kernel function's stack.

-	static struct context *free_contexts[NR_CPUS] = { NULL };

-	int cpu;

+	unsigned long flags;

+	unsigned int cpu;

-	/* First, save all the pointers.  */

-	rcu_read_lock_sched();

-	for_each_possible_cpu(cpu) {

-		free_contexts[cpu] = rcu_dereference_sched(contexts[cpu]);

-	}

-	rcu_read_unlock_sched();

+	/* Sync to make sure existing readers are done */

+	atomic_set(&_stp_context_stop, 1);

+	write_lock_irqsave(&_stp_context_lock, flags);

+	write_unlock_irqrestore(&_stp_context_lock, flags);

-	/* Now clear all pointers to prevent new readers.  */

-	for_each_possible_cpu(cpu) {

-		rcu_assign_pointer(contexts[cpu], NULL);

-	}

-

-	/* Sync to make sure existing readers are done.  */

-	stp_synchronize_sched();

-

-	/* Now we can actually free the contexts.  */

-	for_each_possible_cpu(cpu) {

-		struct context *c = free_contexts[cpu];

-		if (c != NULL) {

-			free_contexts[cpu] = NULL;

-			_stp_vfree(c);

-		}

-	}

+	/* Now we can actually free the contexts */

+	for_each_possible_cpu(cpu)

+		_stp_vfree(per_cpu(contexts, cpu));

 }

 static inline struct context * _stp_runtime_get_context(void)

 {

-	// RHBZ1788662 rcu operations are rejected in idle-cpu contexts

-	// in effect: skip probe if it's in rcu-idle state

-#if defined(STAPCONF_RCU_IS_WATCHING) || LINUX_VERSION_CODE >= KERNEL_VERSION(3,13,0) // linux commit #5c173eb8

-        if (! rcu_is_watching())

-		return 0;

-#elif LINUX_VERSION_CODE >= KERNEL_VERSION(3,3,0) // linux commit #9b2e4f18

-        if (! rcu_is_cpu_idle())

-		return 0;

-#else

-	; // XXX older kernels didn't put tracepoints in idle-cpu

-#endif

-	return rcu_dereference_sched(contexts[smp_processor_id()]);

+	if (atomic_read(&_stp_context_stop))

+		return NULL;

+

+	return per_cpu(contexts, smp_processor_id());

 }

 static struct context * _stp_runtime_entryfn_get_context(void)

+	__acquires(&_stp_context_lock)

 {

 	struct context* __restrict__ c = NULL;

-	preempt_disable ();

+

+	if (!read_trylock(&_stp_context_lock))

+		return NULL;

+

 	c = _stp_runtime_get_context();

 	if (c != NULL) {

-		if (atomic_inc_return(&c->busy) == 1) {

-			// NB: Notice we're not re-enabling preemption

+		if (!atomic_cmpxchg(&c->busy, 0, 1)) {

+			// NB: Notice we're not releasing _stp_context_lock

 			// here. We exepect the calling code to call

 			// _stp_runtime_entryfn_get_context() and

 			// _stp_runtime_entryfn_put_context() as a

 			// pair.

 			return c;

 		}

-		atomic_dec(&c->busy);

 	}

-	preempt_enable_no_resched();

+	read_unlock(&_stp_context_lock);

 	return NULL;

 }

 static inline void _stp_runtime_entryfn_put_context(struct context *c)

+	__releases(&_stp_context_lock)

 {

 	if (c) {

-		if (c == _stp_runtime_get_context())

-			atomic_dec(&c->busy);

-		/* else, warn about bad state? */

-		preempt_enable_no_resched();

+		atomic_set(&c->busy, 0);

+		read_unlock(&_stp_context_lock);

 	}

-	return;

 }

 static void _stp_runtime_context_wait(void)

@@ -130,9 +105,13 @@ static void _stp_runtime_context_wait(void)

 		int i;

 		holdon = 0;

-		rcu_read_lock_sched();

+		read_lock(&_stp_context_lock);

+		if (atomic_read(&_stp_context_stop)) {

+			read_unlock(&_stp_context_lock);

+			break;

+		}

 		for_each_possible_cpu(i) {

-			struct context *c = rcu_dereference_sched(contexts[i]);

+			struct context *c = per_cpu(contexts, i);

 			if (c != NULL

 			    && atomic_read (& c->busy)) {

 				holdon = 1;

@@ -146,7 +125,7 @@ static void _stp_runtime_context_wait(void)

 				}

 			}

 		}

-		rcu_read_unlock_sched();

+		read_unlock(&_stp_context_lock);

 		/*

 		 * Just in case things are really really stuck, a

commit bb25d64f7b6c98ef2fc8b711f19bd6271866d727

Author: Sultan Alsawaf <sultan@openresty.com>

Date:   Tue Dec 1 09:54:07 2020 -0800

    runtime_context: synchronize _stp_context_stop more strictly

    We're only reading _stp_context_stop while the read lock is held, so we

    can move the modification of it to inside the write lock to ensure

    strict memory ordering. As such, it no longer needs to be an atomic_t

    variable.

    We also don't need to disable IRQs when holding the write lock because

    only read_trylock is used from IRQ context, not read_lock, so there's no

    possibility of a deadlock occurring.

diff --git a/runtime/linux/runtime_context.h b/runtime/linux/runtime_context.h

index 18566957a..e716e6d39 100644

--- a/runtime/linux/runtime_context.h

+++ b/runtime/linux/runtime_context.h

@@ -14,7 +14,7 @@

 /* Can't use STP_DEFINE_RWLOCK() or this might be replaced with a spin lock */

 static DEFINE_RWLOCK(_stp_context_lock);

 static DEFINE_PER_CPU(struct context *, contexts);

-static atomic_t _stp_context_stop = ATOMIC_INIT(0);

+static bool _stp_context_stop;

 static int _stp_runtime_contexts_alloc(void)

 {

@@ -40,13 +40,12 @@ static int _stp_runtime_contexts_alloc(void)

  * use _stp_context_stop and a write lock to be sure its safe to free them.  */

 static void _stp_runtime_contexts_free(void)

 {

-	unsigned long flags;

 	unsigned int cpu;

 	/* Sync to make sure existing readers are done */

-	atomic_set(&_stp_context_stop, 1);

-	write_lock_irqsave(&_stp_context_lock, flags);

-	write_unlock_irqrestore(&_stp_context_lock, flags);

+	write_lock(&_stp_context_lock);

+	_stp_context_stop = true;

+	write_unlock(&_stp_context_lock);

 	/* Now we can actually free the contexts */

 	for_each_possible_cpu(cpu)

@@ -55,7 +54,7 @@ static void _stp_runtime_contexts_free(void)

 static inline struct context * _stp_runtime_get_context(void)

 {

-	if (atomic_read(&_stp_context_stop))

+	if (_stp_context_stop)

 		return NULL;

 	return per_cpu(contexts, smp_processor_id());

@@ -106,7 +105,7 @@ static void _stp_runtime_context_wait(void)

 		holdon = 0;

 		read_lock(&_stp_context_lock);

-		if (atomic_read(&_stp_context_stop)) {

+		if (_stp_context_stop) {

 			read_unlock(&_stp_context_lock);

 			break;

 		}

commit 0cc239e6f0fff79cb584fc857d3220402558db37

Author: Sultan Alsawaf <sultan@openresty.com>

Date:   Tue Dec 1 18:47:04 2020 -0800

    runtime_context: replace _stp_context_lock with an atomic variable

    We can't use any lock primitives here, such as spin locks or rw locks,

    because lock_acquire() has tracepoints inside of it. This can cause a

    deadlock, so we have to roll our own synchronization mechanism using an

    atomic variable.

diff --git a/runtime/linux/runtime_context.h b/runtime/linux/runtime_context.h

index e716e6d39..7dd240e1a 100644

--- a/runtime/linux/runtime_context.h

+++ b/runtime/linux/runtime_context.h

@@ -11,10 +11,9 @@

 #ifndef _LINUX_RUNTIME_CONTEXT_H_

 #define _LINUX_RUNTIME_CONTEXT_H_

-/* Can't use STP_DEFINE_RWLOCK() or this might be replaced with a spin lock */

-static DEFINE_RWLOCK(_stp_context_lock);

+/* Can't use a lock primitive for this because lock_acquire() has tracepoints */

+static atomic_t _stp_contexts_busy_ctr = ATOMIC_INIT(0);

 static DEFINE_PER_CPU(struct context *, contexts);

-static bool _stp_context_stop;

 static int _stp_runtime_contexts_alloc(void)

 {

@@ -37,15 +36,14 @@ static int _stp_runtime_contexts_alloc(void)

 /* We should be free of all probes by this time, but for example the timer for

  * _stp_ctl_work_callback may still be running and looking for contexts.  We

- * use _stp_context_stop and a write lock to be sure its safe to free them.  */

+ * use _stp_contexts_busy_ctr to be sure its safe to free them.  */

 static void _stp_runtime_contexts_free(void)

 {

 	unsigned int cpu;

 	/* Sync to make sure existing readers are done */

-	write_lock(&_stp_context_lock);

-	_stp_context_stop = true;

-	write_unlock(&_stp_context_lock);

+	while (atomic_cmpxchg(&_stp_contexts_busy_ctr, 0, INT_MAX))

+		cpu_relax();

 	/* Now we can actually free the contexts */

 	for_each_possible_cpu(cpu)

@@ -54,24 +52,20 @@ static void _stp_runtime_contexts_free(void)

 static inline struct context * _stp_runtime_get_context(void)

 {

-	if (_stp_context_stop)

-		return NULL;

-

 	return per_cpu(contexts, smp_processor_id());

 }

 static struct context * _stp_runtime_entryfn_get_context(void)

-	__acquires(&_stp_context_lock)

 {

 	struct context* __restrict__ c = NULL;

-	if (!read_trylock(&_stp_context_lock))

+	if (!atomic_add_unless(&_stp_contexts_busy_ctr, 1, INT_MAX))

 		return NULL;

 	c = _stp_runtime_get_context();

 	if (c != NULL) {

 		if (!atomic_cmpxchg(&c->busy, 0, 1)) {

-			// NB: Notice we're not releasing _stp_context_lock

+			// NB: Notice we're not releasing _stp_contexts_busy_ctr

 			// here. We exepect the calling code to call

 			// _stp_runtime_entryfn_get_context() and

 			// _stp_runtime_entryfn_put_context() as a

@@ -79,16 +73,15 @@ static struct context * _stp_runtime_entryfn_get_context(void)

 			return c;

 		}

 	}

-	read_unlock(&_stp_context_lock);

+	atomic_dec(&_stp_contexts_busy_ctr);

 	return NULL;

 }

 static inline void _stp_runtime_entryfn_put_context(struct context *c)

-	__releases(&_stp_context_lock)

 {

 	if (c) {

 		atomic_set(&c->busy, 0);

-		read_unlock(&_stp_context_lock);

+		atomic_dec(&_stp_contexts_busy_ctr);

 	}

 }

@@ -104,11 +97,9 @@ static void _stp_runtime_context_wait(void)

 		int i;

 		holdon = 0;

-		read_lock(&_stp_context_lock);

-		if (_stp_context_stop) {

-			read_unlock(&_stp_context_lock);

+		if (!atomic_add_unless(&_stp_contexts_busy_ctr, 1, INT_MAX))

 			break;

-		}

+

 		for_each_possible_cpu(i) {

 			struct context *c = per_cpu(contexts, i);

 			if (c != NULL

@@ -124,7 +115,7 @@ static void _stp_runtime_context_wait(void)

 				}

 			}

 		}

-		read_unlock(&_stp_context_lock);

+		atomic_dec(&_stp_contexts_busy_ctr);

 		/*

 		 * Just in case things are really really stuck, a

commit fbab0ea35e6af0d6599c6de3708b24008bf03ae6

Author: Sultan Alsawaf <sultan@openresty.com>

Date:   Wed Dec 2 11:07:11 2020 -0800

    runtime_context: disable preempt while holding the context

    After the context lock was converted to an atomic in the previous

    commit, the preempt disable logic disappeared. Add it back.

diff --git a/runtime/linux/runtime_context.h b/runtime/linux/runtime_context.h

index 7dd240e1a..7a1532e54 100644

--- a/runtime/linux/runtime_context.h

+++ b/runtime/linux/runtime_context.h

@@ -34,6 +34,24 @@ static int _stp_runtime_contexts_alloc(void)

 	return 0;

 }

+static bool _stp_runtime_context_trylock(void)

+{

+	bool locked;

+

+	preempt_disable();

+	locked = atomic_add_unless(&_stp_contexts_busy_ctr, 1, INT_MAX);

+	if (!locked)

+		preempt_enable_no_resched();

+

+	return locked;

+}

+

+static void _stp_runtime_context_unlock(void)

+{

+	atomic_dec(&_stp_contexts_busy_ctr);

+	preempt_enable_no_resched();

+}

+

 /* We should be free of all probes by this time, but for example the timer for

  * _stp_ctl_work_callback may still be running and looking for contexts.  We

  * use _stp_contexts_busy_ctr to be sure its safe to free them.  */

@@ -59,7 +77,7 @@ static struct context * _stp_runtime_entryfn_get_context(void)

 {

 	struct context* __restrict__ c = NULL;

-	if (!atomic_add_unless(&_stp_contexts_busy_ctr, 1, INT_MAX))

+	if (!_stp_runtime_context_trylock())

 		return NULL;

 	c = _stp_runtime_get_context();

@@ -73,7 +91,7 @@ static struct context * _stp_runtime_entryfn_get_context(void)

 			return c;

 		}

 	}

-	atomic_dec(&_stp_contexts_busy_ctr);

+	_stp_runtime_context_unlock();

 	return NULL;

 }

@@ -81,7 +99,7 @@ static inline void _stp_runtime_entryfn_put_context(struct context *c)

 {

 	if (c) {

 		atomic_set(&c->busy, 0);

-		atomic_dec(&_stp_contexts_busy_ctr);

+		_stp_runtime_context_unlock();

 	}

 }

@@ -97,7 +115,7 @@ static void _stp_runtime_context_wait(void)

 		int i;

 		holdon = 0;

-		if (!atomic_add_unless(&_stp_contexts_busy_ctr, 1, INT_MAX))

+		if (!_stp_runtime_context_trylock())

 			break;

 		for_each_possible_cpu(i) {

@@ -115,7 +133,7 @@ static void _stp_runtime_context_wait(void)

 				}

 			}

 		}

-		atomic_dec(&_stp_contexts_busy_ctr);

+		_stp_runtime_context_unlock();

 		/*

 		 * Just in case things are really really stuck, a

commit aedc044d5d38cb2fa6144d0a3345d06847862f1b

Author: Sultan Alsawaf <sultan@openresty.com>

Date:   Wed Dec 2 11:27:47 2020 -0800

    task_finder_vma: add kfree_rcu() compat for old kernels

    Newer RHEL 6 kernels have kfree_rcu(), but older ones do not. Using

    kfree_rcu() is beneficial because it lets the RCU subsystem know that

    the queued RCU callback is low-priority, and can be deferred, hence why

    we don't replace kfree_rcu() with call_rcu() outright. Luckily,

    kfree_rcu() is a macro so we can just #ifdef with it.

diff --git a/runtime/task_finder_vma.c b/runtime/task_finder_vma.c

index 7f0f6ed56..dc77a80f5 100644

--- a/runtime/task_finder_vma.c

+++ b/runtime/task_finder_vma.c

@@ -87,6 +87,15 @@ __stp_tf_vma_new_entry(void)

 	return entry;

 }

+#ifndef kfree_rcu

+static void __stp_tf_vma_free_entry(struct rcu_head *rcu)

+{

+	struct __stp_tf_vma_entry *entry = container_of(rcu, typeof(*entry), rcu);

+

+	kfree(entry);

+}

+#endif

+

 // __stp_tf_vma_put_entry(): Put a specified number of references on the entry.

 static void

 __stp_tf_vma_put_entry(struct __stp_tf_vma_bucket *bucket,

@@ -106,7 +115,11 @@ __stp_tf_vma_put_entry(struct __stp_tf_vma_bucket *bucket,

 	hlist_del_rcu(&entry->hlist);

 	stp_spin_unlock_irqrestore(&bucket->lock, flags);

+#ifdef kfree_rcu

 	kfree_rcu(entry, rcu);

+#else

+	call_rcu(&entry->rcu, __stp_tf_vma_free_entry);

+#endif

 }

 // stap_initialize_vma_map():  Initialize the free list.  Grabs the

commit 6a27888b118b7a94650a68aae028957cdd5fb5f5

Author: Sultan Alsawaf <sultan@openresty.com>

Date:   Wed Dec 2 18:09:17 2020 -0800

    REVERTME: tapset-timers: work around on-the-fly deadlocks caused by mutex_trylock

    The following deadlock exists due to tracepoints existing inside a lock

    that is used both inside probe context and outside probe context:

     #0 [ffff88017f6d7a08] kvm_wait at ffffffff81079f5a

     #1 [ffff88017f6d7a30] __pv_queued_spin_lock_slowpath at ffffffff8114f51e

     #2 [ffff88017f6d7a70] queued_spin_lock_slowpath at ffffffff810e842b

     #3 [ffff88017f6d7a80] mutex_trylock at ffffffff81882b1b

     #4 [ffff88017f6d7ab8] _stp_transport_trylock_relay_inode at ffffffffc0c599df [stap_47650d3377d05db0ab7cbbaa25765809__11657]

     #5 [ffff88017f6d7ad8] __stp_print_flush at ffffffffc09b6483 [stap_47650d3377d05db0ab7cbbaa25765809__11657]

     #6 [ffff88017f6d7b10] probe_7879 at ffffffffc0a98c85 [stap_47650d3377d05db0ab7cbbaa25765809__11657]

     #7 [ffff88017f6d7b38] enter_real_tracepoint_probe_1543 at ffffffffc0c3b757 [stap_47650d3377d05db0ab7cbbaa25765809__11657]

     #8 [ffff88017f6d7b70] enter_tracepoint_probe_1543 at ffffffffc09b117e [stap_47650d3377d05db0ab7cbbaa25765809__11657]

     #9 [ffff88017f6d7b80] lock_acquire at ffffffff811460ba

    #10 [ffff88017f6d7be8] mutex_trylock at ffffffff81882a27

    #11 [ffff88017f6d7c20] _stp_transport_trylock_relay_inode at ffffffffc0c599df [stap_47650d3377d05db0ab7cbbaa25765809__11657]

    #12 [ffff88017f6d7c40] __stp_print_flush at ffffffffc09b6483 [stap_47650d3377d05db0ab7cbbaa25765809__11657]

    #13 [ffff88017f6d7c78] _stp_vlog at ffffffffc09b8d32 [stap_47650d3377d05db0ab7cbbaa25765809__11657]

    #14 [ffff88017f6d7cd8] _stp_dbug at ffffffffc09ba43b [stap_47650d3377d05db0ab7cbbaa25765809__11657]

    #15 [ffff88017f6d7d38] systemtap_module_refresh at ffffffffc09ba51d [stap_47650d3377d05db0ab7cbbaa25765809__11657]

    #16 [ffff88017f6d7d50] module_refresher at ffffffffc09ba53e [stap_47650d3377d05db0ab7cbbaa25765809__11657]

    #17 [ffff88017f6d7d60] process_one_work at ffffffff810da9cc

    #18 [ffff88017f6d7de8] worker_thread at ffffffff810dafe6

    #19 [ffff88017f6d7e48] kthread at ffffffff810e44cf

    #20 [ffff88017f6d7f50] ret_from_fork_nospec_begin at ffffffff818958dd

    Note the deadlock due to _stp_transport_trylock_relay_inode recursing

    onto itself via mutex_trylock.

    This is a temporary fix for the issue until a proper patch is made to

    remove the mutex_trylock from __stp_print_flush. This should be reverted

    when that patch lands (it will have something to do with bulkmode).

diff --git a/tapset-timers.cxx b/tapset-timers.cxx

index 10da17cda..503498c85 100644

--- a/tapset-timers.cxx

+++ b/tapset-timers.cxx

@@ -391,11 +391,11 @@ hrtimer_derived_probe_group::emit_module_refresh (systemtap_session& s)

   s.op->newline(+1) <<   "struct stap_hrtimer_probe* stp = &stap_hrtimer_probes[i];";

   // timer disabled, but condition says enabled?

   s.op->newline( 0) <<   "if (!stp->enabled && stp->probe->cond_enabled) {";

-  s.op->newline(+1) <<     "dbug_otf(\"enabling (hrtimer) pidx %zu\\n\", stp->probe->index);";

+  s.op->newline(+1) <<     "//dbug_otf(\"enabling (hrtimer) pidx %zu\\n\", stp->probe->index);";

   s.op->newline( 0) <<     "_stp_hrtimer_start(stp);";

   // timer enabled, but condition says disabled?

   s.op->newline(-1) <<   "} else if (stp->enabled && !stp->probe->cond_enabled) {";

-  s.op->newline(+1) <<     "dbug_otf(\"disabling (hrtimer) pidx %zu\\n\", stp->probe->index);";

+  s.op->newline(+1) <<     "//dbug_otf(\"disabling (hrtimer) pidx %zu\\n\", stp->probe->index);";

   s.op->newline( 0) <<     "_stp_hrtimer_cancel(stp);";

   s.op->newline(-1) <<   "}";

   s.op->newline( 0) <<   "stp->enabled = stp->probe->cond_enabled;";

commit 7187dcf39412fcb25c432d318be8e49a6051f055

Author: Sultan Alsawaf <sultan@openresty.com>

Date:   Thu Dec 3 12:57:34 2020 -0800

    runtime: fix print races in IRQ context and during print cleanup

    Prints can race when there's a print called from IRQ context or a print

    called while print cleanup takes place, which can lead to garbled print

    messages, out-of-bounds memory accesses, and memory use-after-free. This

    is one example of racy modification of the print buffer len in IRQ

    context which caused a panic due to an out-of-bounds memory access:

    BUG: unable to handle kernel paging request at ffffe8ffff621000

    IP: [<ffffffffc05da0f3>] _stp_vsprint_memory+0x83/0x950 [stap_2c44636dfda18135ca3012a752599da6_13_533]

    PGD 174b90067 PUD 174b8f067 PMD 174b93067 PTE 0

    Oops: 0002 [#1] SMP

    CPU: 12 PID: 3468 Comm: cat Kdump: loaded Tainted: G           OE  ------------   3.10.0-1127.19.1.el7.x86_64.debug #1

    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20180531_142017-buildhw-08.phx2.fedoraproject.org-1.fc28 04/01/2014

    task: ffff88001f4f0000 ti: ffff88004ea5c000 task.ti: ffff88004ea5c000

    RIP: 0010:[<ffffffffc05da0f3>]  [<ffffffffc05da0f3>] _stp_vsprint_memory+0x83/0x950 [stap_2c44636dfda18135ca3012a752599da6_13_533]

    RSP: 0018:ffff88004ea5f9a8  EFLAGS: 00010082

    RAX: ffffe8ffff621001 RBX: ffffe8ffff620ff2 RCX: fffffffffffffffe

    RDX: 000000000000006e RSI: ffffffffffffffff RDI: ffffc90002c23730