linux-kernel - Re: [PATCH v5.1 15/15] livepatch: allow removal of a disabled patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LSU.2.20.1703071549030.29377@pobox.suse.cz>
Date:   Tue, 7 Mar 2017 15:50:11 +0100 (CET)
From:   Miroslav Benes <mbenes@...e.cz>
To:     Josh Poimboeuf <jpoimboe@...hat.com>
cc:     Jessica Yu <jeyu@...hat.com>, Jiri Kosina <jikos@...nel.org>,
        Petr Mladek <pmladek@...e.com>, linux-kernel@...r.kernel.org,
        live-patching@...r.kernel.org,
        Michael Ellerman <mpe@...erman.id.au>,
        Heiko Carstens <heiko.carstens@...ibm.com>, x86@...nel.org,
        linuxppc-dev@...ts.ozlabs.org, linux-s390@...r.kernel.org,
        Vojtech Pavlik <vojtech@...e.com>, Jiri Slaby <jslaby@...e.cz>,
        Chris J Arges <chris.j.arges@...onical.com>,
        Andy Lutomirski <luto@...nel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Kamalesh Babulal <kamalesh@...ux.vnet.ibm.com>,
        Balbir Singh <bsingharora@...il.com>
Subject: Re: [PATCH v5.1 15/15] livepatch: allow removal of a disabled
 patch

On Mon, 6 Mar 2017, Josh Poimboeuf wrote:

> 
> Currently we do not allow patch module to unload since there is no
> method to determine if a task is still running in the patched code.
> 
> The consistency model gives us the way because when the unpatching
> finishes we know that all tasks were marked as safe to call an original
> function. Thus every new call to the function calls the original code
> and at the same time no task can be somewhere in the patched code,
> because it had to leave that code to be marked as safe.
> 
> We can safely let the patch module go after that.
> 
> Completion is used for synchronization between module removal and sysfs
> infrastructure in a similar way to commit 942e443127e9 ("module: Fix
> mod->mkobj.kobj potentially freed too early").
> 
> Note that we still do not allow the removal for immediate model, that is
> no consistency model. The module refcount may increase in this case if
> somebody disables and enables the patch several times. This should not
> cause any harm.
> 
> With this change a call to try_module_get() is moved to
> __klp_enable_patch from klp_register_patch to make module reference
> counting symmetric (module_put() is in a patch disable path) and to
> allow to take a new reference to a disabled module when being enabled.
> 
> Finally, we need to be very careful about possible races between
> klp_unregister_patch(), kobject_put() functions and operations
> on the related sysfs files.
> 
> kobject_put(&patch->kobj) must be called without klp_mutex. Otherwise,
> it might be blocked by enabled_store() that needs the mutex as well.
> In addition, enabled_store() must check if the patch was not
> unregisted in the meantime.
> 
> There is no need to do the same for other kobject_put() callsites
> at the moment. Their sysfs operations neither take the lock nor
> they access any data that might be freed in the meantime.
> 
> There was an attempt to use kobjects the right way and prevent these
> races by design. But it made the patch definition more complicated
> and opened another can of worms. See
> https://lkml.kernel.org/r/1464018848-4303-1-git-send-email-pmladek@suse.com
> 
> [Thanks to Petr Mladek for improving the commit message.]
> 
> Signed-off-by: Miroslav Benes <mbenes@...e.cz>
> Signed-off-by: Josh Poimboeuf <jpoimboe@...hat.com>
> Reviewed-by: Petr Mladek <pmladek@...e.com>
> ---
> v5.1: improve error handling in enable path -- call module_put() in
>       klp_cancel_transition()

Looks good.

Acked-by: Miroslav Benes <mbenes@...e.cz>

if it is needed for Josh's code.

Regards,
Miroslav