linux-kernel - Re: [POC 2/7] livepatch: Allow to handle lifetime of shadow variables using the livepatch state

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Zr4GCYkfof1aJ-hp@pathway.suse.cz>
Date: Thu, 15 Aug 2024 15:43:37 +0200
From: Petr Mladek <pmladek@...e.com>
To: Miroslav Benes <mbenes@...e.cz>
Cc: Josh Poimboeuf <jpoimboe@...nel.org>,
	Joe Lawrence <joe.lawrence@...hat.com>,
	Nicolai Stange <nstange@...e.de>, live-patching@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [POC 2/7] livepatch: Allow to handle lifetime of shadow
 variables using the livepatch state

On Thu 2024-07-25 13:31:40, Miroslav Benes wrote:
> > diff --git a/kernel/livepatch/state.c b/kernel/livepatch/state.c
> > index 6693d808106b..4ec65afe3a43 100644
> > --- a/kernel/livepatch/state.c
> > +++ b/kernel/livepatch/state.c
> > @@ -198,11 +198,17 @@ void klp_release_states(struct klp_patch *patch)
> >  		if (is_state_in_other_patches(patch, state))
> >  			continue;
> >  
> > -		if (!state->callbacks.release)
> > -			continue;
> > -
> > -		if (state->callbacks.setup_succeeded)
> > +		if (state->callbacks.release && state->callbacks.setup_succeeded)
> >  			state->callbacks.release(patch, state);
> > +
> > +		if (state->is_shadow)
> > +			klp_shadow_free_all(state->id, state->callbacks.shadow_dtor);
> 
> The following
> 
> > +		/*
> > +		 * The @release callback is supposed to restore the original
> > +		 * state before the @setup callback was called.
> > +		 */
> > +		state->callbacks.setup_succeeded = 0;
> 
> should go to the previous patch perhaps?

Great catch!

I am going to refactor the code in the next version so that it would
look like:

void klp_states_post_unpatch(struct klp_patch *patch)
{
	struct klp_state *state;

	klp_for_each_state(patch, state) {
		if (is_state_in_other_patches(patch, state))
			continue;

		if (!state->callbacks.pre_patch_succeeded)
			continue;

		if (state->callbacks.post_unpatch)
			state->callbacks.post_unpatch(patch, state);

+		if (state->is_shadow)
+			klp_shadow_free_all(state->id, state->callbacks.shadow_dtor);
+
		state->callbacks.pre_patch_succeeded = 0;
	}
}


Best Regards,
Petr