linked list within a kernel probe

chrishell chris at
Tue Jan 3 13:52:02 EST 2023

Hello out there, I have an issue with a linked list which holds pointers 
to memory pages for a kprobe. The linked list get initialised but I 
cannot use it within the kprobe.

I use main or head pointer to hold everything in one place:

struct kprobe_head {
	struct list_head	*p_mem_cache;	
	struct kprobe_fsops	*pfops;
	struct kprobe 		*pProbe;

and the pointer to access everything:

static struct kprobe_head *pHead;

then I have the structure which this list is made of:

struct kprobe_mem_cache {

	void			*p_page;
	__u32			size;
	__u8			dirty;
	struct list_head	list_element;

the list looks like:
                     ____________________   _________________
                     |                  |<-|                 |<-| 

pHead->p_mem_cache->| kprobe_mem_cache |->| krobe_mem_cache |->| ...
                     --------------------  -------------------

the p_page pointer is the pointer to the alloacted page. Therefore each 
element of that linked list holds a pointer to allocated memory segment.

in the __init function I do, among other things, allocate some memory 
for that structure, thought a static struct would be also sufficient.

/* create the head storage record */
pHead = (struct kprobe_head*) kzalloc(sizeof(struct kprobe_head), 
	if(pHead == NULL)
		return -ENOMEM;
then I create the linked list with this function:

static __u8 _kprobe_setup_cache_elements( struct kprobe_head *pHead, 
__u16 elements, __u32 size)
	unsigned int  	count 	= 0;
	__u8		rc	= 0;
	struct list_head local_head;


	if(pHead != NULL) {

		pr_err("create list with %p\n", pHead);

		for(count=0; count<elements; count++) {
			struct kprobe_mem_cache *new = kzalloc(sizeof(struct 
kprobe_mem_cache), GFP_KERNEL);
			if(NULL == new) {
				pr_err("error: kzalloc issue");
				return -ENOMEM;

			/* allocate memory for one page */
			new->p_page = vmalloc(size);
			if(NULL == new->p_page) {
				pr_err("error: vmalloc issue");
				return -ENOMEM;
			else {
				pr_err("List Element %d added  Size: %u  addr: %p \n", count, size, 

			new->size 	= size;
			new->dirty  	= 0;

			list_add_tail(&new->list_element, &local_head);

		pHead->p_mem_cache = &local_head;
	return rc;

right after that, still in the __init function I traverse trough this 
linked list, just to see if its work.

if(pHead->p_mem_cache != NULL)
		pr_err("within loop %p  %p\n", pHead, pHead->p_mem_cache);
		list_for_each(local_head, pHead->p_mem_cache) {
			local_page = list_entry(local_head, struct kprobe_mem_cache, 
				pr_err("address: %u \n", local_page->size );

And here it works.

The problem now is that this is a kprobe kernel module and I defined a 
kprobe function as pre_handler function called submit_bio_pre which is 
evoked whenever the block layer function submit_bio is called by the 
kernel. Within that function however the access to that linked list failed

int submit_bio_pre(struct kprobe *p_submit_bio, struct pt_regs *regs)
	int rc    			= 0;
	struct bio *bio 		= NULL;
	static unsigned int  len        = 0;
	static unsigned int counter;
	struct kprobe_mem_cache  *tmp  = NULL;
	struct kprobe_mem_cache *local_page = NULL;
	struct list_head *local_head = NULL;
	bio = (struct bio*) regs_get_kernel_argument(regs, 0);

	if(pHead != NULL)
		pr_err("#### pHead is initialized %p #####\n", pHead);

	if(pHead->p_mem_cache != NULL)
		pr_err("#### pHead->p_mem_cache is initialized %p #######\n", 

	if(pHead->p_mem_cache != NULL && counter == 0)
		pr_err("within loop submit_bio_pre \n");
		list_for_each(local_head, pHead->p_mem_cache) {
			local_page = list_entry(local_head, struct kprobe_mem_cache, 
				pr_err("address bio: %u \n", local_page->size );

As it seems is the head pointer valid and has the same address as in the 
init function. Also the head pointer to the linked list is a valid one. 
But traversing through the linked list is not possible any more. As you 
can see I added a spin_lock to that kprobe function, albeit I only read 
from the linked list. This function does something completely different 
normally anyway.

When I load this module, the initialisation of the linked list works, 
also the following walk through the list, but within the kprobe function 
sometimes I can see the first and second pr_err. But after that the 
kernel breaks:

[  191.460196] Unable to handle kernel paging request at virtual address 

[  191.669571] Call trace: 

[  191.672021]  submit_bio_pre+0xcc/0x150 

[  191.676641]  kprobe_breakpoint_handler+0x100/0x190 

[  191.681445]  call_break_hook+0x68/0x80 

[  191.685201]  brk_handler+0x1c/0x60

So can anybody tell me, what is the reason that the linked list doesn't 
work within the kprobe?

Thank you in advance

BR Christian

More information about the Kernelnewbies mailing list