title: Kernel Oops when unregister jprobes on Android/ARM
body: <p>I wrote a kernel module (see code below) for my Nexus 5 to trace some syscalls via kprobes (I have built a custom kernel that has kprobes enabled for this). </p>
  
  <p>Occasionally, when unloading the module via <code>rmmod</code> my phone freezes and reboots. Trying to isolate the root cause of the bug, now in my module is nothing left except code to register a jprobe for the syscall do_fork (but the bug happens for other probed functions too) and unregister it when unloading (so, I think it is probably a kprobes bug on ARM rather than a Android specific problem). Maybe anyone can point me to a known bug in kprobes?</p>
  
  <p>The logs about the kernel panic tell me about some paging problem <code>Unable to handle kernel paging request at virtual address c0193a2c</code>, where <code>c0193a2c</code> is actually the address of <code>do_fork</code>.</p>
  
  <pre><code>#include &lt;linux/init.h&gt;     
  #include &lt;linux/kernel.h&gt;   
  #include &lt;linux/module.h&gt;   
  #include &lt;linux/kprobes.h&gt;
  
  long trace_do_fork(unsigned long clone_flags, unsigned long stack_start,
             struct pt_regs *regs, unsigned long stack_size,
             int __user *parent_tidptr, int __user *child_tidptr)
  {
      jprobe_return();
      return 0;
  }
  
  #define CREATE_JPROBE(victim, target)            \
          static struct jprobe jp_##victim = {         \
                  .entry = (kprobe_opcode_t *) target, \
                  .kp = {                  \
                          .symbol_name = #victim,      \
                  },                   \
          }
  
  CREATE_JPROBE(do_fork, trace_do_fork);
  
  #define NUM_PROBES 1
  static struct jprobe *jprobes[NUM_PROBES] = {
      &amp;jp_do_fork,
  };
  
  static int __init droidtracer_init(void)
  {
      int err;
      /* plant jprobes */  
      err = register_jprobes(jprobes, NUM_PROBES);
      if (err) {
          printk(KERN_ERR "RV; register_jprobes failed = %d\n", err);
          return err;
      }
      printk(KERN_INFO "RV; planted %d jprobes\n", NUM_PROBES);  
  
      return 0;
  }
  
  static void __exit droidtracer_exit(void)
  {
      unregister_jprobes(jprobes, NUM_PROBES);    
  }
  
  module_init(droidtracer_init);
  module_exit(droidtracer_exit);
  </code></pre>
  
  <p>Here is the output from cat <code>/proc/last_kmsg</code> on my Nexus 5:</p>
  
  <pre><code>[ 1967.788836] RV; planted 1 jprobes
  [ 1967.908095] init: untracked pid 15957 exited with status 17
  [ 1967.987314] type=1400 audit(1449702053.652:53): avc: denied { write } for pid=16008 comm="app_process32_o" name="system@framework@boot.art" dev="dm-0" ino=491522 scontext=u:r:shell:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file
  [ 1968.102799] init: untracked pid 16001 exited with status 52
  [ 1968.122856] init: untracked pid 15960 exited with status 0
  [ 1968.330685] init: untracked pid 16008 exited with status 0
  [ 1969.106371] Unable to handle kernel paging request at virtual address c0193a2c
  [ 1969.106418] pgd = c0004000
  [ 1969.106489] [c0193a2c] *pgd=0001141e(bad)
  [ 1969.106602] Internal error: Oops: 80d [#1] PREEMPT SMP ARM
  [ 1969.106642] Modules linked in: droidtracer(O-) [last unloaded: droidtracer]
  [ 1969.106821] CPU: 3    Tainted: G           O  (3.4.0-g5170b88 #23)
  [ 1969.106897] PC is at __patch_text+0x34/0x58
  [ 1969.106939] LR is at mem_text_address_writeable+0xac/0xc4
  [ 1969.106980] pc : [&lt;c0a4db78&gt;]    lr : [&lt;c01166a4&gt;]    psr: 20000093
  [ 1969.106982] sp : e8d43ea0  ip : c0193000  fp : e8d43ebc
  [ 1969.107088] r10: 00000001  r9 : dae8fde4  r8 : 00000001
  [ 1969.107158] r7 : a0000013  r6 : dae8fe54  r5 : e1a0c00d  r4 : c0193a2c
  [ 1969.107197] r3 : c113a4a4  r2 : c0007000  r1 : c0193a2c  r0 : c0193000
  [ 1969.107238] Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
  [ 1969.107310] Control: 10c5787d  Table: 3558006a  DAC: 00000015
  [ 1969.107350] 
  [ 1969.107351] PC: 0xc0a4daf8:
  [ 1969.107455] daf8  e89da9f8 e592300c e3a04002 e1a00004 e5813004 e89da9f8 e592300c e12fff33
  [ 1969.107818] db18  e1a04000 e1a00004 e89da9f8 e592200c eaffff9c e1a02006 e3a07001 eaffff99
  [ 1969.108213] db38  e1a04005 eaffffd1 c0b00670 e1a0c00d e92dd830 e24cb004 e24dd008 e1a04000
  [ 1969.108575] db58  e24b0018 e1a05001 ebdb228f e1a00004 ebdb22a2 e30a34a4 e34c3113 e1a01004
  [ 1969.108971] db78  e4815004 e1a00004 e5933010 e12fff33 ebdb22cb e24b0018 ebdb228e e24bd014
  [ 1969.109340] db98  e89da830 e1a0c00d e92dd800 e24cb004 ebffffe5 e89da800 e1a0c00d e92dd800
  [ 1969.109738] dbb8  e24cb004 e52de004 e8bd4000 e5902030 e5900014 e3c234ff e3120401 e1a03103
  [ 1969.110132] dbd8  e2032402 e2622000 e1823003 12802004 e2800008 15812038 e0803003 e581303c
  [ 1969.110504] 
  [ 1969.110505] LR: 0xc0116624:
  [ 1969.110610] 6624  e3a01000 e592200c e5c31014 e59221f0 e5922024 389da818 e59f1074 e1500001
  [ 1969.111006] 6644  289da818 e1a01aa0 e3100601 e3c00eff e59f4058 e0822181 e3c0000f e583000c
  [ 1969.111375] 6664  12820004 01a00002 e5832008 e5901000 15830008 e201c003 e5832004 e35c0002
  [ 1969.111771] 6684  e5831010 189da818 e3c11902 e5801000 ee072f3a f57ff04f e594000c ebffda1c
  [ 1969.112166] 66a4  e3a03001 e5c43014 e89da818 c0008000 c11ff920 c0b00000 e1a0c00d e92dd800
  [ 1969.112534] 66c4  e24cb004 e52de004 e8bd4000 e59f302c e5d32014 e3520000 089da800 e5931008
  [ 1969.112927] 66e4  e5930010 e5932004 e5810000 ee072f3a f57ff04f e593000c ebffda05 e89da800
  [ 1969.113324] 6704  c11ff920 e1a0c00d e92dd830 e24cb004 e24dd008 e52de004 e8bd4000 e1a04000
  [ 1969.113723] 
  [ 1969.113724] SP: 0xe8d43e20:
  [ 1969.113797] 3e20  c116efa0 c113c0d8 e8d43ee4 c0a4db78 20000093 ffffffff e8d43e8c 00000001
  [ 1969.114190] 3e40  dae8fde4 00000001 e8d43ebc e8d43e58 c0a4c618 c010022c c0193000 c0193a2c
  [ 1969.114558] 3e60  c0007000 c113a4a4 c0193a2c e1a0c00d dae8fe54 a0000013 00000001 dae8fde4
  [ 1969.114950] 3e80  00000001 e8d43ebc c0193000 e8d43ea0 c01166a4 c0a4db78 20000093 ffffffff
  [ 1969.115344] 3ea0  dae8df20 20000093 dae8fe40 00000003 e8d43ecc e8d43ec0 c0a4cabc c0a4db50
  [ 1969.115739] 3ec0  e8d43ef4 e8d43ed0 c01f18c4 c0a4caa4 00000001 e8d42000 c241bd24 00000000
  [ 1969.116103] 3ee0  dae8fe40 c01f17d8 e8d43fbc e8d43ef8 c01f1548 c01f17e4 c0a4ab08 c01c1eac
  [ 1969.116497] 3f00  00000000 c241bd2c 00000000 00000000 618fcdfb 000001ca 00000001 c0a4b040
  [ 1969.116894] 
  [ 1969.116895] IP: 0xc0192f80:
  [ 1969.116967] 2f80  e58732c0 e58732bc e58731ec e58731f0 e59c300c e59301ec e3500000 0a00000c
  [ 1969.117366] 2fa0  e3140c01 0a00003d e2803028 e1932f9f e2822001 e1831f92 e3310000 1afffffa
  [ 1969.117763] 2fc0  e3a03000 e580316c e5803170 e58701ec e58701f0 e1a00004 e1a01007 eb00a279
  [ 1969.118129] 2fe0  e250a000 13a09000 0a000033 e59701ec e3500000 0a000000 ebfffca5 e51bc040
  [ 1969.118527] 3000  e35c0000 1a000004 e30c1ec0 e34c1126 e591000c e59713c8 eb036498 e59703cc
  [ 1969.118924] 3020  ebfffe62 e1a00007 eb042de4 e1a00007 eb00166d eaffffa8 e1a0000a eb042dfd
  [ 1969.119284] 3040  e3500000 e58703bc 1affffbb e3e0a00b e3a09000 eafffff4 e30c1ec0 e34c1126
  [ 1969.119648] 3060  e591001c e3a010d0 eb0362da f57ff05f e3500000 e58703cc 0a000223 e51bc03c
  [ 1969.120044] 
  [ 1969.120045] FP: 0xe8d43e3c:
  [ 1969.120118] 3e3c  00000001 dae8fde4 00000001 e8d43ebc e8d43e58 c0a4c618 c010022c c0193000
  [ 1969.120513] 3e5c  c0193a2c c0007000 c113a4a4 c0193a2c e1a0c00d dae8fe54 a0000013 00000001
  [ 1969.120907] 3e7c  dae8fde4 00000001 e8d43ebc c0193000 e8d43ea0 c01166a4 c0a4db78 20000093
  [ 1969.121275] 3e9c  ffffffff dae8df20 20000093 dae8fe40 00000003 e8d43ecc e8d43ec0 c0a4cabc
  [ 1969.121646] 3ebc  c0a4db50 e8d43ef4 e8d43ed0 c01f18c4 c0a4caa4 00000001 e8d42000 c241bd24
  [ 1969.122045] 3edc  00000000 dae8fe40 c01f17d8 e8d43fbc e8d43ef8 c01f1548 c01f17e4 c0a4ab08
  [ 1969.122442] 3efc  c01c1eac 00000000 c241bd2c 00000000 00000000 618fcdfb 000001ca 00000001
  [ 1969.122808] 3f1c  c0a4b040 c1131740 c1131740 00001f21 00000000 c112e450 c1131740 00000000
  [ 1969.123204] 
  [ 1969.123205] R0: 0xc0192f80:
  [ 1969.123308] 2f80  e58732c0 e58732bc e58731ec e58731f0 e59c300c e59301ec e3500000 0a00000c
  [ 1969.123673] 2fa0  e3140c01 0a00003d e2803028 e1932f9f e2822001 e1831f92 e3310000 1afffffa
  [ 1969.124068] 2fc0  e3a03000 e580316c e5803170 e58701ec e58701f0 e1a00004 e1a01007 eb00a279
  [ 1969.124464] 2fe0  e250a000 13a09000 0a000033 e59701ec e3500000 0a000000 ebfffca5 e51bc040
  [ 1969.124827] 3000  e35c0000 1a000004 e30c1ec0 e34c1126 e591000c e59713c8 eb036498 e59703cc
  [ 1969.125223] 3020  ebfffe62 e1a00007 eb042de4 e1a00007 eb00166d eaffffa8 e1a0000a eb042dfd
  [ 1969.125618] 3040  e3500000 e58703bc 1affffbb e3e0a00b e3a09000 eafffff4 e30c1ec0 e34c1126
  [ 1969.126013] 3060  e591001c e3a010d0 eb0362da f57ff05f e3500000 e58703cc 0a000223 e51bc03c
  [ 1969.126383] 
  [ 1969.126384] R1: 0xc01939ac:
  [ 1969.126489] 39ac  1afffffa e587a454 eafffdcb c11cbe80 c11688f0 c1168f54 c1134040 c0d6c9ac
  [ 1969.126856] 39cc  c1142f38 c113c0d8 c112e5c0 c11cceb8 c0d6c96c c126cee4 c0199c94 c0d6c980
  [ 1969.127253] 39ec  c0d6c994 e1a0c00d e92dd800 e24cb004 e52de004 e8bd4000 e1a0200d e3c23d7f
  [ 1969.127649] 3a0c  e3a01000 e3c3303f e1a02001 e593c00c e58c029c e593000c eb0079f6 e89da800
  [ 1969.128050] 3a2c  e1a0c00d e92dddf0 e24cb004 e24dd020 e52de004 e8bd4000 e3100201 e1a04000
  [ 1969.128419] 3a4c  e1a06001 e1a07002 e1a05003 0a00000d e3100801 1a00005c e3a00015 eb002f48
  [ 1969.128817] 3a6c  e3500000 0a00009c e3a00007 eb002f44 e3500000 0a000098 e3a00006 eb002f40
  [ 1969.129217] 3a8c  e3500000 0a000094 e5978040 e218800f 13a08000 1a000012 e3140502 1a000010
  [ 1969.129587] 
  [ 1969.129588] R2: 0xc0006f80:
  [ 1969.129662] 6f80  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
  [ 1969.130063] 6fa0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
  [ 1969.130431] 6fc0  349ec811 349ecc11 00000000 00000000 00000000 00000000 00000000 00000000
  [ 1969.130828] 6fe0  00000000 00000000 00000000 00000000 00000000 00000000 36be7811 36be7c11
  [ 1969.131223] 7000  0001141e 0011140e 0021940e 0031940e 0041940e 0051940e 0061940e 0071940e
  [ 1969.131587] 7020  0081940e 0091940e 00a1940e 00b1941e 00c1941e 00d1941e 00e1941e 00f1941e
  [ 1969.131955] 7040  0101940e 0111141e 0121141e 0131141e 0141141e 0151141e 0161141e 0171141e
  [ 1969.132352] 7060  0181141e 0191141e 01a1141e 01b1141e 01c1141e 01d1141e 01e1141e 01f1141e
  [ 1969.132748] 
  [ 1969.132749] R3: 0xc113a424:
  [ 1969.132821] a424  6f0565ba 31608756 fbbc260d 3ab7828b f06b23d0 ae0ec13c 64d26067 20dba45a
  [ 1969.133212] a444  36c8dc43 292974a6 331e896e d0b7bc08 06876874 d288e84f 1672f9f9 9cc6ff8c
  [ 1969.133578] a464  178284ea 4f454bb9 9fa41d71 91e87642 cd987452 16bf87ac 124bab00 00000001
  [ 1969.133949] a484  00000000 20fd1972 c010d2f0 ffffffff 00000009 0007b0d7 c01184c0 c0118474
  [ 1969.134351] a4a4  c0118220 c01182cc c01182e4 c01182e4 c01182e8 c01182e8 c0118364 c011844c
  [ 1969.134752] a4c4  c011845c c011839c c01183e4 c0118418 00000022 ffffffff 00000000 fa002000
  [ 1969.135119] a4e4  fa003000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
  [ 1969.135516] a504  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
  [ 1969.135878] 
  [ 1969.135879] R4: 0xc01939ac:
  [ 1969.135952] 39ac  1afffffa e587a454 eafffdcb c11cbe80 c11688f0 c1168f54 c1134040 c0d6c9ac
  [ 1969.136351] 39cc  c1142f38 c113c0d8 c112e5c0 c11cceb8 c0d6c96c c126cee4 c0199c94 c0d6c980
  [ 1969.136747] 39ec  c0d6c994 e1a0c00d e92dd800 e24cb004 e52de004 e8bd4000 e1a0200d e3c23d7f
  [ 1969.137116] 3a0c  e3a01000 e3c3303f e1a02001 e593c00c e58c029c e593000c eb0079f6 e89da800
  [ 1969.137515] 3a2c  e1a0c00d e92dddf0 e24cb004 e24dd020 e52de004 e8bd4000 e3100201 e1a04000
  [ 1969.137879] 3a4c  e1a06001 e1a07002 e1a05003 0a00000d e3100801 1a00005c e3a00015 eb002f48
  [ 1969.138276] 3a6c  e3500000 0a00009c e3a00007 eb002f44 e3500000 0a000098 e3a00006 eb002f40
  [ 1969.138644] 3a8c  e3500000 0a000094 e5978040 e218800f 13a08000 1a000012 e3140502 1a000010
  [ 1969.139038] 
  [ 1969.139039] R5: 0xe1a0bf8d:
  [ 1969.139112] bf8c  5d02005d 5d04000a 00203d20 3d205d10 77656e20 72724120 29287961 5d1c003b
  [ 1969.139509] bfac  6977202c 74206874 66206568 6f6c6c6f 676e6977 74696b20 000a3a73 003b5d02
  [ 1969.139870] bfcc  203b5d03 5b5d1000 746c6127 74786574 3d205d27 0d002720 63275b5d 27646966
  [ 1969.140267] bfec  203d205d 5d0d0027 6574275b 5d277478 27203d20 57165211 ff6aff65 51105110
  [ 1969.140636] c00c  ff64ff64 54144f0f ff6aff65 55154e0d ff6bff63 510e4f0d ff64ff63 48055310
  [ 1969.141036] c02c  ff5bff66 55125512 ff68ff68 5412520f ff68ff65 520f5613 ff65ff69 510e5411
  [ 1969.141431] c04c  ff64ff67 5410510d ff65ff63 5512510d ff67ff63 500d5916 ff63ff6c 54115714
  [ 1969.141799] c06c  ff67ff6a 5412500d ff68ff63 59165512 ff6cff68 4f0d5310 ff63ff66 54115613
  [ 1969.142201] c08c  ff67ff69 53105512 ff66ff68 54125412 ff68ff68 53105412 ff66ff68 53105512
  [ 1969.142601] 
  [ 1969.142603] R6: 0xdae8fdd4:
  [ 1969.142676] fdd4  dae8fde0 c01f1944 c01f16ec c113b004 00000004 00000000 00000000 00000000
  [ 1969.143074] fdf4  00000000 dae8fdf8 dae8fdf8 c0a49acc c116b588 c113b004 dae8fe40 dae8fe3c
  [ 1969.143472] fe14  dae8fe20 c01f1a84 c01f1900 c0a4ca98 bf00a0f4 c113b004 c113b004 dae8fe74
  [ 1969.143841] fe34  dae8fe40 c01f1ba8 c01f1a50 c0a4ca98 bf00a0f4 00000004 c113b004 00000003
  [ 1969.144239] fe54  00000002 c113b004 bf00a0f4 c0a4ca98 00000000 dae8fe94 dae8fe78 c01f1c1c
  [ 1969.144633] fe74  c01f1b04 c0b09a34 bf00a0f4 bf00a0f4 00000001 dae8fea4 dae8fe98 c0a4cc34
  [ 1969.145028] fe94  c01f1bf4 dae8fec4 dae8fea8 c0a4ecf4 c0a4cc10 00000000 00000001 00000001
  [ 1969.145392] feb4  bf00a0f4 dae8fee4 dae8fec8 c0a4f03c c0a4ec80 c0a49acc c0a49748 00000001
  [ 1969.145787] 
  [ 1969.145788] R9: 0xdae8fd64:
  [ 1969.145859] fd64  c112ed38 00000002 dae8e000 c113b004 c113b868 c112ed24 c112ed38 dae8e000
  [ 1969.146259] fd84  c113c0d8 dae8fdac dae8fd98 c0a4afe4 c0a4a71c 00000002 00000004 dae8fddc
  [ 1969.146656] fda4  dae8fdb0 c01f17c4 c0a4afb0 dae8fde4 c113b004 c01f17d8 dae8fe40 c01f17d8
  [ 1969.147056] fdc4  bf00a0f0 dae8e000 00000000 dae8fe1c dae8fde0 c01f1944 c01f16ec c113b004
  [ 1969.147422] fde4  00000004 00000000 00000000 00000000 00000000 dae8fdf8 dae8fdf8 c0a49acc
  [ 1969.147822] fe04  c116b588 c113b004 dae8fe40 dae8fe3c dae8fe20 c01f1a84 c01f1900 c0a4ca98
  [ 1969.148220] fe24  bf00a0f4 c113b004 c113b004 dae8fe74 dae8fe40 c01f1ba8 c01f1a50 c0a4ca98
  [ 1969.148591] fe44  bf00a0f4 00000004 c113b004 00000003 00000002 c113b004 bf00a0f4 c0a4ca98
  [ 1969.148958] Process migration/3 (pid: 16049, stack limit = 0xe8d422f0)
  [ 1969.149029] Stack: (0xe8d43ea0 to 0xe8d44000)
  [ 1969.149071] 3ea0: dae8df20 20000093 dae8fe40 00000003 e8d43ecc e8d43ec0 c0a4cabc c0a4db50
  [ 1969.149144] 3ec0: e8d43ef4 e8d43ed0 c01f18c4 c0a4caa4 00000001 e8d42000 c241bd24 00000000
  [ 1969.149216] 3ee0: dae8fe40 c01f17d8 e8d43fbc e8d43ef8 c01f1548 c01f17e4 c0a4ab08 c01c1eac
  [ 1969.149257] 3f00: 00000000 c241bd2c 00000000 00000000 618fcdfb 000001ca 00000001 c0a4b040
  [ 1969.149330] 3f20: c1131740 c1131740 00001f21 00000000 c112e450 c1131740 00000000 00000000
  [ 1969.149403] 3f40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 c01c0214
  [ 1969.149475] 3f60: 00000000 00000001 00000000 dc961de4 dc961de0 00000013 00000013 00000000
  [ 1969.149518] 3f80: 00000000 dc961dd0 c241bd24 20fd1972 00000013 dc961dd0 c241bd24 c01f1484
  [ 1969.149592] 3fa0: 00000013 00000000 00000000 00000000 e8d43ff4 e8d43fc0 c01b5f58 c01f1490
  [ 1969.149664] 3fc0: 00000000 c241bd24 00000000 00000000 e8d43fd0 e8d43fd0 00000000 dc961dd0
  [ 1969.149736] 3fe0: c01b5ec0 c0107c20 00000000 e8d43ff8 c0107c20 c01b5ecc 00000000 00000000
  [ 1969.149784] [&lt;c0a4db78&gt;] (__patch_text+0x34/0x58) from [&lt;c0a4cabc&gt;] (__arch_disarm_kprobe+0x24/0x2c)
  [ 1969.149863] [&lt;c0a4cabc&gt;] (__arch_disarm_kprobe+0x24/0x2c) from [&lt;c01f18c4&gt;] (stop_machine_cpu_stop+0xec/0x11c)
  [ 1969.149940] [&lt;c01f18c4&gt;] (stop_machine_cpu_stop+0xec/0x11c) from [&lt;c01f1548&gt;] (cpu_stopper_thread+0xc4/0x1a8)
  [ 1969.150018] [&lt;c01f1548&gt;] (cpu_stopper_thread+0xc4/0x1a8) from [&lt;c01b5f58&gt;] (kthread+0x98/0xa4)
  [ 1969.150096] [&lt;c01b5f58&gt;] (kthread+0x98/0xa4) from [&lt;c0107c20&gt;] (kernel_thread_exit+0x0/0x8)
  [ 1969.150139] Code: ebdb22a2 e30a34a4 e34c3113 e1a01004 (e4815004) 
  [ 1969.150239] ---[ end trace a138dd63f3507951 ]---
  [ 1969.150279] Kernel panic - not syncing: Fatal exception
  [ 1970.712851] SMP: failed to stop secondary CPUs
  [ 1971.713234] Rebooting in 5 seconds..
  [ 1978.277336] SMP: failed to stop secondary CPUs
  [ 1978.277440] Going down for restart now
  [ 1978.278139] Calling SCM to disable SPMI PMIC arbiter
  
  No errors detected
  Boot info:
  Last boot reason: kernel_panic
  </code></pre>