[Bug 297335] dtrace(1): FBT probe on an NMI-reachable function re-enters dtrace_probe() and panics an INVARIANTS kernel

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297335

Mark Johnston <markj@FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|New                         |Open

--- Comment #1 from Mark Johnston <markj@FreeBSD.org> ---
> An NMI cannot interrupt itself — further NMIs are blocked until IRET

This is a problem in itself. dtrace fbt probes install breakpoints in kernel
text; once the dtrace probe fires and the handler runs, we return to the
original context via iret.  If that happens in the context of an NMI handler,
then dtrace will silently re-enable NMIs while the NMI handler continues
executing.  The amd64 NMI handler is not re-entrant, so if a second NMI is
raised before the handler finishes, then we will crash.

For the original problem, probably it's sufficient to ensure that
dtrace_probe() simply returns early if it detects it's in an NMI handler?  And
it should increment an error counter so that the user can see that it's
dropping events.

-- 
You are receiving this mail because:
You are the assignee for the bug.