linux-kernel - Re: [RFE] Who's using a module?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200316173408.GA6841@linux-8ccs>
Date:   Mon, 16 Mar 2020 18:34:09 +0100
From:   Jessica Yu <jeyu@...nel.org>
To:     Lucas De Marchi <lucas.de.marchi@...il.com>
Cc:     Konstantin Kharlamov <hi-angel@...dex.ru>,
        linux-modules <linux-modules@...r.kernel.org>,
        lkml <linux-kernel@...r.kernel.org>,
        Steven Rostedt <rostedt@...dmis.org>
Subject: Re: [RFE] Who's using a module?

+++ Lucas De Marchi [13/03/20 09:22 -0700]:
>+Jessica +Steve +lkml
>
>On Wed, Mar 11, 2020 at 6:33 AM Konstantin Kharlamov <hi-angel@...dex.ru> wrote:
>>
>> Once in a while there's a need to remove a module (for example because you rebuilt it, or to reload it with different parameters, or whatever…). And then doing `rmmod modulename` and `modprobe -r modulename` gives:
>>
>>         rmmod: ERROR: Module modulename is in use
>>
>> If you're lucky, firing up `lsmod | grep modulename` will get you offenders inside "used by" column. But often there's nothing except the count above zero. It is very easy to reproduce if you check `lsmod` output for your graphics driver. I checked it on `i915` and `amdgpu`: when graphics session is opened you can't remove it and `lsmod` doesn't show who's using it.
>>
>> There's very popular and old question on SO¹ that at the moment has over 55k views, and the only answer that seem to work for people is insanely big and convoluted; it is using a custom kernel driver and kernel tracing capabilities. I guess this amount of research means: no, currently there's no easy way to get who's using a module.
>>
>> It would be amazing if kernel has capability to figure out who's using a module.
>
>Yeah, right now this would need some work on the kernel side to record
>the callers of try_module_get()/__module_get()... usually done e.g on
>fops-like structs in a owner field.
>The only thing we have there right now is the trace. The trace is not
>so bad since it can be added in the kernel command line, but would
>usually only be enabled while debugging.
>
>For implementing such a feature I think we would need to add/remove
>module owner into the mod struct whenever we have a _get()/_put().
>Maybe it's worth it, but it doesn't
>come without overhead. I'd like to hear what other people think.

Hmm, we technically have mod->source_list and mod->target_list
already, which keeps track of modules that depend on THIS_MODULE and
modules that THIS_MODULE depends on, respectively. However, this is
limited to symbol dependencies only, which is what is shown in lsmod
in the Used By field. In other words, we currently only keep track of
module dependencies when a module uses a symbol from another module.

Indeed, it could be nice to keep track of try_module_get() callers,
but I'm afraid this is not as trivial as simply adding owner to
mod->source_list when try_module_get() is called. try_module_get() and
module_put() are designed to be quick and callable from interrupt and
process context, and mod->{source,target}_list are protected by the
module_mutex. Even if we could use module_mutex, it may increase lock
contention considerably. So the locking scheme would have to be
reworked to make this happen. I suppose this could be introduced as a
DEBUG option, and I'd welcome a patch if there's someone out there
interested in picking up the legwork. But I don't get the feeling
that the demand for this is that high (perhaps I'm totally wrong?),
especially for something that ftrace could report on much better. I
could for example trace all module_get's and put's from boot and see
which processes and even the call sites where these calls stem from.
E.g., if I enable tracing in /sys/kernel/debug/tracing/events/module/module_{get,put}
(and filter name == "i915"), you'd see output like:

               X-2404  [000] ....  2334.643888: module_put: i915 call_site=dma_buf_release refcnt=33
               X-2404  [000] ....  2334.643990: module_put: i915 call_site=dma_buf_release refcnt=32
        kwin_x11-2877  [007] ....  2334.645605: module_get: i915 call_site=dma_buf_export refcnt=33
        kwin_x11-2877  [007] ....  2334.650827: module_get: i915 call_site=dma_buf_export refcnt=34

Of course, you'd have to know to enable tracing before the problem
occurs..

Hope that helps clarify things a bit,

Jessica