| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250502141844.154517322@infradead.org>
Date: Fri, 02 May 2025 16:12:07 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: mcgrof@...nel.org
Cc: x86@...nel.org,
hpa@...or.com,
petr.pavlu@...e.com,
samitolvanen@...gle.com,
da.gomez@...sung.com,
masahiroy@...nel.org,
nathan@...nel.org,
nicolas@...sle.eu,
linux-kernel@...r.kernel.org,
linux-modules@...r.kernel.org,
linux-kbuild@...r.kernel.org,
hch@...radead.org,
gregkh@...uxfoundation.org,
roypat@...zon.co.uk,
"Peter Zijlstra (Intel)" <peterz@...radead.org>
Subject: [PATCH v3 3/5] module: Extend the MODULE_ namespace parsing
Instead of only accepting "module:${name}", extend it with a comma
separated list of module names and add tail glob support.
That is, something like: "module:foo-*,bar" is now possible.
Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
---
kernel/module/main.c | 36 ++++++++++++++++++++++++++++++++++--
scripts/mod/modpost.c | 36 ++++++++++++++++++++++++++++++++++--
2 files changed, 68 insertions(+), 4 deletions(-)
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -1083,12 +1083,44 @@ static char *get_modinfo(const struct lo
return get_next_modinfo(info, tag, NULL);
}
+/**
+ * verify_module_namespace() - does @modname have access to this symbol's @namespace
+ * @namespace: export symbol namespace
+ * @modname: module name
+ *
+ * If @namespace is prefixed with "module:" to indicate it is a module namespace
+ * then test if @modname matches any of the comma separated patterns.
+ *
+ * The patterns only support tail-glob.
+ */
static bool verify_module_namespace(const char *namespace, const char *modname)
{
+ size_t len, modlen = strlen(modname);
const char *prefix = "module:";
+ const char *sep;
+ bool glob;
- return strstarts(namespace, prefix) &&
- !strsmp(namespace + strlen(prefix), modname);
+ if (!strstarts(namespace, prefix))
+ return false;
+
+ for (namespace += strlen(prefix); *namespace; namespace = sep) {
+ sep = strchrnul(namespace, ',');
+ len = sep - namespace;
+
+ glob = false;
+ if (sep[-1] == '*') {
+ len--;
+ glob = true;
+ }
+
+ if (*sep)
+ sep++;
+
+ if (strncmp(namespace, modname, len) == 0 && (glob || len == modlen))
+ return true;
+ }
+
+ return false;
}
static int verify_namespace_is_imported(const struct load_info *info,
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1682,12 +1682,44 @@ void buf_write(struct buffer *buf, const
buf->pos += len;
}
+/**
+ * verify_module_namespace() - does @modname have access to this symbol's @namespace
+ * @namespace: export symbol namespace
+ * @modname: module name
+ *
+ * If @namespace is prefixed with "module:" to indicate it is a module namespace
+ * then test if @modname matches any of the comma separated patterns.
+ *
+ * The patterns only support tail-glob.
+ */
static bool verify_module_namespace(const char *namespace, const char *modname)
{
+ size_t len, modlen = strlen(modname);
const char *prefix = "module:";
+ const char *sep;
+ bool glob;
- return strstarts(namespace, prefix) &&
- !strcmp(namespace + strlen(prefix), modname);
+ if (!strstarts(namespace, prefix))
+ return false;
+
+ for (namespace += strlen(prefix); *namespace; namespace = sep) {
+ sep = strchrnul(namespace, ',');
+ len = sep - namespace;
+
+ glob = false;
+ if (sep[-1] == '*') {
+ len--;
+ glob = true;
+ }
+
+ if (*sep)
+ sep++;
+
+ if (strncmp(namespace, modname, len) == 0 && (glob || len == modlen))
+ return true;
+ }
+
+ return false;
}
static void check_exports(struct module *mod)
Powered by blists - more mailing lists