linux-kernel - [GIT PULL] ftrace/module: Call clean up function when module init fails early

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 7 Jan 2016 13:25:23 -0500
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	Ingo Molnar <mingo@...nel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"Qiu, PeiyangX" <peiyangx.qiu@...el.com>,
	"Zhang, Yanmin" <yanmin_zhang@...ux.intel.com>
Subject: [GIT PULL] ftrace/module: Call clean up function when module init
 fails early


Linus,

PeiyangX Qiu reported that if a module fails to load between calling
ftrace_module_init() and do_init_module() that the allocations made
in ftrace_module_init() will not be freed, resulting in a memory leak.

The solution is to call ftrace_release_mod() on the failing module in
the fail path befor do_init_module() is called. This will remove any
allocations made for that module, and nothing if ftrace_module_init()
wasn't called yet for that module.

Note, once do_init_module() is called, the MODULE_GOING notifiers are
called for the failed module, which calls into the ftrace code to do the
proper clean up (basically calling ftrace_release_mod()).


Please pull the latest trace-v4.4-rc4-4 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
trace-v4.4-rc4-4

Tag SHA1: 4bc8d900c8ad045c130aff2481aabefada00be4f
Head SHA1: 049fb9bd416077b3622d317a45796be4f2431df3


Steven Rostedt (Red Hat) (1):
      ftrace/module: Call clean up function when module init fails early

----
 include/linux/ftrace.h | 1 +
 kernel/module.c        | 6 ++++++
 2 files changed, 7 insertions(+)
---------------------------
commit 049fb9bd416077b3622d317a45796be4f2431df3
Author: Steven Rostedt (Red Hat) <rostedt@...dmis.org>
Date:   Tue Jan 5 20:32:47 2016 -0500

    ftrace/module: Call clean up function when module init fails early
    
    If the module init code fails after calling ftrace_module_init() and before
    calling do_init_module(), we can suffer from a memory leak. This is because
    ftrace_module_init() allocates pages to store the locations that ftrace
    hooks are placed in the module text. If do_init_module() fails, it still
    calls the MODULE_GOING notifiers which will tell ftrace to do a clean up of
    the pages it allocated for the module. But if load_module() fails before
    then, the pages allocated by ftrace_module_init() will never be freed.
    
    Call ftrace_release_mod() on the module if load_module() fails before
    getting to do_init_module().
    
    Link: http://lkml.kernel.org/r/567CEA31.1070507@intel.com
    
    Reported-by: "Qiu, PeiyangX" <peiyangx.qiu@...el.com>
    Fixes: a949ae560a511 "ftrace/module: Hardcode ftrace_module_init() call into load_module()"
    Cc: stable@...r.kernel.org # v2.6.38+
    Acked-by: Rusty Russell <rusty@...tcorp.com.au>
    Signed-off-by: Steven Rostedt <rostedt@...dmis.org>

diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
index eae6548efbf0..60048c50404e 100644
--- a/include/linux/ftrace.h
+++ b/include/linux/ftrace.h
@@ -586,6 +586,7 @@ extern int ftrace_arch_read_dyn_info(char *buf, int size);
 
 extern int skip_trace(unsigned long ip);
 extern void ftrace_module_init(struct module *mod);
+extern void ftrace_release_mod(struct module *mod);
 
 extern void ftrace_disable_daemon(void);
 extern void ftrace_enable_daemon(void);
diff --git a/kernel/module.c b/kernel/module.c
index 8f051a106676..38c7bd5583ff 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3571,6 +3571,12 @@ static int load_module(struct load_info *info, const char __user *uargs,
 	synchronize_sched();
 	mutex_unlock(&module_mutex);
  free_module:
+	/*
+	 * Ftrace needs to clean up what it initialized.
+	 * This does nothing if ftrace_module_init() wasn't called,
+	 * but it must be called outside of module_mutex.
+	 */
+	ftrace_release_mod(mod);
 	/* Free lock-classes; relies on the preceding sync_rcu() */
 	lockdep_free_key_range(mod->module_core, mod->core_size);