registration error (rc -84) and -DSTP_OVERLOAD_THRESHOLD

[Frank Ch. Eigler]

Hi -

rjones wrote:

> [...]
> module("ext2").statement("ext2_try_to_allocate_with_rsv@fs/ext2/balloc.c:1162") /* pc=.text+0x982 */ /* <- module("ext2").statement("*@*.c:*") */
> 
> and here is the disassembled code around that place in the module:
> 
> [...]
>      980:       74 4d                   je     9cf <ext2_try_to_allocate_with_rs
> v+0x412>
>      982:       44 29 f9                sub    %r15d,%ecx
> [...]

That doesn't look particularly scary.  However, recent versions of the
kernel have started to attempt manual decoding of the instruction
stream being kprobe'd in order to verify instruction boundaries.  It
could be that this check is not working correctly.

See kernel arch/x86/kernel/kprobes can_probe().  Unfortunately that
function is not particularly chatty about its error cases, and it's
marked __kprobes to prevent itself from being kprobed.  (That bit is
almost certainly unnecessary and counterproductive.)

If this is the problem, I believe a whole series of addresses past a
given troublemaker would exhibit this failure, on a per-function
basis.  Are the problem probe addresses in sequential sub-sequences?
Disassembling at the start would be helpful.

- FChE