linux-kernel - Module init call vs symbols exporting race?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 06 Nov 2007 12:20:58 +0300
From:	Pavel Emelyanov <xemul@...nvz.org>
To:	Rusty Russell <rusty@...tcorp.com.au>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Module init call vs symbols exporting race?

Hi.

I looked at the sys_init_module() and found that the ->init callback
for the module is called without the module_mutex held and *after*
the module's symbols are exported. Doesn't this create the race when
loading two modules in parallel? Like this.

Consider the first module to be (without any internal locking for
simplicity)

=== foo.c ===
static struct list_head foo_list;

void foo_register(struct list_head *elem)
{
	list_add(elem, &foo_list);
}
EXPORT_SYMBOL(foo_register);

static int foo_init(void)
{
	INIT_LIST_HEAD(&foo_list);
}
module_init(foo_init);
===

and the second one

=== bar.c ===
struct bar_struct {
	struct list_head list;
	...
} bar;

static int bar_init(void)
{
	foo_register(&bar.list);
}
module_init(bar_init);
===

If I understand the sys_init_module() right, the following code
flow is possible:

1CPU                                        2CPU
sys_init_module(/* foo module */)           sys_init_module(/* bar module */)
  mutex_lock(&module_mutex);
  load_module();
      /* export the foo_init here */
  mutex_unlock(&module_mutex);
                                            mutex_lock(&module_mutex);
                                            load_module();
                                                /* resolve the foo_init here */
                                            mutex_unlock(&mudule_mutex);
                                            mod->init(); /* bar_init */
           /*
            * OOPS! The foo_list is not ready yet, because the foo_init
            * is not called yet.
            */
  mod->init(); /* foo_init... too late */

Is this analysis correct?

Thanks,
Pavel
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/