linux-kernel - [PATCH RFC] ftrace: Clear hashes of saved init functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun,  8 Oct 2017 14:33:04 -0700
From:   Joel Fernandes <joelaf@...gle.com>
To:     linux-kernel@...r.kernel.org, Steven Rostedt <rostedt@...dmis.org>
Cc:     Joel Fernandes <joelaf@...gle.com>, Jessica Yu <jeyu@...nel.org>
Subject: [PATCH RFC] ftrace: Clear hashes of saved init functions

Filters are supposed to be saved for init functions, however module init memory
is freed after module init which also frees the ftrace dyn records. However, the
filters are still left as is, this patch uses the mod_map infrastructure
added by Steven to clear the hashes of the saved init functions when the
module is unloaded.

This fixes the following sequence of commands for a module:
================================================
void bar(void)
{
    printk(KERN_INFO "bar!\n");
}

void foo(void)
{
    printk(KERN_INFO "foo!\n");
    bar();
}

static int __init hello_init(void)
{
    printk(KERN_INFO "Hello world!\n");
    foo();
    return 0;
}

static void __exit hello_cleanup(void)
{
    printk(KERN_INFO "Cleaning up module.\n");
}

module_init(hello_init);
module_exit(hello_cleanup);
================================================

Commands:
echo '*:mod:test' > /d/tracing/set_ftrace_filter
echo function > /d/tracing/current_tracer
modprobe test
rmmod test
sleep 1
modprobe test
cat /d/tracing/set_ftrace_filter

Behavior without patch: Init function is still in the filter
Expected behavior: Shouldn't have any of the filters set

Cc: Jessica Yu <jeyu@...nel.org>
Cc: Steven Rostedt <rostedt@...dmis.org>
Signed-off-by: Joel Fernandes <joelaf@...gle.com>
---
 kernel/trace/ftrace.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 9e99bd55732e..e3f8372fb053 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5711,6 +5711,42 @@ static int referenced_filters(struct dyn_ftrace *rec)
 	return cnt;
 }
 
+static void
+clear_mod_func_from_hash(struct ftrace_mod_func *func, struct ftrace_hash *hash)
+{
+	struct ftrace_func_entry *entry;
+
+	if (ftrace_hash_empty(hash))
+		return;
+
+	entry = __ftrace_lookup_ip(hash, func->ip);
+
+	/*
+	 * Do not allow this rec to match again.
+	 * Yeah, it may waste some memory, but will be removed
+	 * if/when the hash is modified again.
+	 */
+	if (entry)
+		entry->ip = 0;
+}
+
+static void
+clear_mod_func_from_hashes(struct ftrace_mod_func *func)
+{
+	struct trace_array *tr;
+
+	mutex_lock(&trace_types_lock);
+	list_for_each_entry(tr, &ftrace_trace_arrays, list) {
+		if (!tr->ops || !tr->ops->func_hash)
+			continue;
+		mutex_lock(&tr->ops->func_hash->regex_lock);
+		clear_mod_func_from_hash(func, tr->ops->func_hash->filter_hash);
+		clear_mod_func_from_hash(func, tr->ops->func_hash->notrace_hash);
+		mutex_unlock(&tr->ops->func_hash->regex_lock);
+	}
+	mutex_unlock(&trace_types_lock);
+}
+
 static void
 clear_mod_from_hash(struct ftrace_page *pg, struct ftrace_hash *hash)
 {
@@ -5771,12 +5807,24 @@ void ftrace_release_mod(struct module *mod)
 {
 	struct ftrace_mod_map *mod_map;
 	struct ftrace_mod_map *n;
+	struct ftrace_mod_func *mod_func;
 	struct dyn_ftrace *rec;
 	struct ftrace_page **last_pg;
 	struct ftrace_page *tmp_page = NULL;
 	struct ftrace_page *pg;
 	int order;
 
+	/* mod_map is freed via call_rcu_sched() */
+	preempt_disable();
+	list_for_each_entry_rcu(mod_map, &ftrace_mod_maps, list) {
+		if (mod_map->mod != mod)
+			continue;
+		list_for_each_entry_rcu(mod_func, &mod_map->funcs, list) {
+			clear_mod_func_from_hashes(mod_func);
+		}
+	}
+	preempt_enable();
+
 	mutex_lock(&ftrace_lock);
 
 	if (ftrace_disabled)
-- 
2.14.2.920.gcf0c67979c-goog