Commit 3b2c77d0 authored by Petr Mladek's avatar Petr Mladek Committed by Jiri Kosina

livepatch: Allow to call a custom callback when freeing shadow variables

We might need to do some actions before the shadow variable is freed.
For example, we might need to remove it from a list or free some data
that it points to.

This is already possible now. The user can get the shadow variable
by klp_shadow_get(), do the necessary actions, and then call
klp_shadow_free().

This patch allows to do it a more elegant way. The user could implement
the needed actions in a callback that is passed to klp_shadow_free()
as a parameter. The callback usually does reverse operations to
the constructor callback that can be called by klp_shadow_*alloc().

It is especially useful for klp_shadow_free_all(). There we need to do
these extra actions for each found shadow variable with the given ID.

Note that the memory used by the shadow variable itself is still released
later by rcu callback. It is needed to protect internal structures that
keep all shadow variables. But the destructor is called immediately.
The shadow variable must not be access anyway after klp_shadow_free()
is called. The user is responsible to protect this any suitable way.

Be aware that the destructor is called under klp_shadow_lock. It is
the same as for the contructor in klp_shadow_alloc().
Signed-off-by: default avatarPetr Mladek <pmladek@suse.com>
Acked-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
Acked-by: default avatarMiroslav Benes <mbenes@suse.cz>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent e91c2518
...@@ -65,11 +65,15 @@ to do actions that can be done only once when a new variable is allocated. ...@@ -65,11 +65,15 @@ to do actions that can be done only once when a new variable is allocated.
* klp_shadow_free() - detach and free a <obj, id> shadow variable * klp_shadow_free() - detach and free a <obj, id> shadow variable
- find and remove a <obj, id> reference from global hashtable - find and remove a <obj, id> reference from global hashtable
- if found, free shadow variable - if found
- call destructor function if defined
- free shadow variable
* klp_shadow_free_all() - detach and free all <*, id> shadow variables * klp_shadow_free_all() - detach and free all <*, id> shadow variables
- find and remove any <*, id> references from global hashtable - find and remove any <*, id> references from global hashtable
- if found, free shadow variable - if found
- call destructor function if defined
- free shadow variable
2. Use cases 2. Use cases
...@@ -136,7 +140,7 @@ variable: ...@@ -136,7 +140,7 @@ variable:
void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
{ {
klp_shadow_free(sta, PS_LOCK); klp_shadow_free(sta, PS_LOCK, NULL);
kfree(sta); kfree(sta);
... ...
......
...@@ -189,6 +189,7 @@ static inline bool klp_have_reliable_stack(void) ...@@ -189,6 +189,7 @@ static inline bool klp_have_reliable_stack(void)
typedef int (*klp_shadow_ctor_t)(void *obj, typedef int (*klp_shadow_ctor_t)(void *obj,
void *shadow_data, void *shadow_data,
void *ctor_data); void *ctor_data);
typedef void (*klp_shadow_dtor_t)(void *obj, void *shadow_data);
void *klp_shadow_get(void *obj, unsigned long id); void *klp_shadow_get(void *obj, unsigned long id);
void *klp_shadow_alloc(void *obj, unsigned long id, void *klp_shadow_alloc(void *obj, unsigned long id,
...@@ -197,8 +198,8 @@ void *klp_shadow_alloc(void *obj, unsigned long id, ...@@ -197,8 +198,8 @@ void *klp_shadow_alloc(void *obj, unsigned long id,
void *klp_shadow_get_or_alloc(void *obj, unsigned long id, void *klp_shadow_get_or_alloc(void *obj, unsigned long id,
size_t size, gfp_t gfp_flags, size_t size, gfp_t gfp_flags,
klp_shadow_ctor_t ctor, void *ctor_data); klp_shadow_ctor_t ctor, void *ctor_data);
void klp_shadow_free(void *obj, unsigned long id); void klp_shadow_free(void *obj, unsigned long id, klp_shadow_dtor_t dtor);
void klp_shadow_free_all(unsigned long id); void klp_shadow_free_all(unsigned long id, klp_shadow_dtor_t dtor);
#else /* !CONFIG_LIVEPATCH */ #else /* !CONFIG_LIVEPATCH */
......
...@@ -243,15 +243,26 @@ void *klp_shadow_get_or_alloc(void *obj, unsigned long id, ...@@ -243,15 +243,26 @@ void *klp_shadow_get_or_alloc(void *obj, unsigned long id,
} }
EXPORT_SYMBOL_GPL(klp_shadow_get_or_alloc); EXPORT_SYMBOL_GPL(klp_shadow_get_or_alloc);
static void klp_shadow_free_struct(struct klp_shadow *shadow,
klp_shadow_dtor_t dtor)
{
hash_del_rcu(&shadow->node);
if (dtor)
dtor(shadow->obj, shadow->data);
kfree_rcu(shadow, rcu_head);
}
/** /**
* klp_shadow_free() - detach and free a <obj, id> shadow variable * klp_shadow_free() - detach and free a <obj, id> shadow variable
* @obj: pointer to parent object * @obj: pointer to parent object
* @id: data identifier * @id: data identifier
* @dtor: custom callback that can be used to unregister the variable
* and/or free data that the shadow variable points to (optional)
* *
* This function releases the memory for this <obj, id> shadow variable * This function releases the memory for this <obj, id> shadow variable
* instance, callers should stop referencing it accordingly. * instance, callers should stop referencing it accordingly.
*/ */
void klp_shadow_free(void *obj, unsigned long id) void klp_shadow_free(void *obj, unsigned long id, klp_shadow_dtor_t dtor)
{ {
struct klp_shadow *shadow; struct klp_shadow *shadow;
unsigned long flags; unsigned long flags;
...@@ -263,8 +274,7 @@ void klp_shadow_free(void *obj, unsigned long id) ...@@ -263,8 +274,7 @@ void klp_shadow_free(void *obj, unsigned long id)
(unsigned long)obj) { (unsigned long)obj) {
if (klp_shadow_match(shadow, obj, id)) { if (klp_shadow_match(shadow, obj, id)) {
hash_del_rcu(&shadow->node); klp_shadow_free_struct(shadow, dtor);
kfree_rcu(shadow, rcu_head);
break; break;
} }
} }
...@@ -276,11 +286,13 @@ EXPORT_SYMBOL_GPL(klp_shadow_free); ...@@ -276,11 +286,13 @@ EXPORT_SYMBOL_GPL(klp_shadow_free);
/** /**
* klp_shadow_free_all() - detach and free all <*, id> shadow variables * klp_shadow_free_all() - detach and free all <*, id> shadow variables
* @id: data identifier * @id: data identifier
* @dtor: custom callback that can be used to unregister the variable
* and/or free data that the shadow variable points to (optional)
* *
* This function releases the memory for all <*, id> shadow variable * This function releases the memory for all <*, id> shadow variable
* instances, callers should stop referencing them accordingly. * instances, callers should stop referencing them accordingly.
*/ */
void klp_shadow_free_all(unsigned long id) void klp_shadow_free_all(unsigned long id, klp_shadow_dtor_t dtor)
{ {
struct klp_shadow *shadow; struct klp_shadow *shadow;
unsigned long flags; unsigned long flags;
...@@ -290,10 +302,8 @@ void klp_shadow_free_all(unsigned long id) ...@@ -290,10 +302,8 @@ void klp_shadow_free_all(unsigned long id)
/* Delete all <*, id> from hash */ /* Delete all <*, id> from hash */
hash_for_each(klp_shadow_hash, i, shadow, node) { hash_for_each(klp_shadow_hash, i, shadow, node) {
if (klp_shadow_match(shadow, shadow->obj, id)) { if (klp_shadow_match(shadow, shadow->obj, id))
hash_del_rcu(&shadow->node); klp_shadow_free_struct(shadow, dtor);
kfree_rcu(shadow, rcu_head);
}
} }
spin_unlock_irqrestore(&klp_shadow_lock, flags); spin_unlock_irqrestore(&klp_shadow_lock, flags);
......
...@@ -98,9 +98,19 @@ struct dummy *livepatch_fix1_dummy_alloc(void) ...@@ -98,9 +98,19 @@ struct dummy *livepatch_fix1_dummy_alloc(void)
return d; return d;
} }
static void livepatch_fix1_dummy_leak_dtor(void *obj, void *shadow_data)
{
void *d = obj;
void **shadow_leak = shadow_data;
kfree(*shadow_leak);
pr_info("%s: dummy @ %p, prevented leak @ %p\n",
__func__, d, *shadow_leak);
}
void livepatch_fix1_dummy_free(struct dummy *d) void livepatch_fix1_dummy_free(struct dummy *d)
{ {
void **shadow_leak, *leak; void **shadow_leak;
/* /*
* Patch: fetch the saved SV_LEAK shadow variable, detach and * Patch: fetch the saved SV_LEAK shadow variable, detach and
...@@ -109,15 +119,10 @@ void livepatch_fix1_dummy_free(struct dummy *d) ...@@ -109,15 +119,10 @@ void livepatch_fix1_dummy_free(struct dummy *d)
* was loaded.) * was loaded.)
*/ */
shadow_leak = klp_shadow_get(d, SV_LEAK); shadow_leak = klp_shadow_get(d, SV_LEAK);
if (shadow_leak) { if (shadow_leak)
leak = *shadow_leak; klp_shadow_free(d, SV_LEAK, livepatch_fix1_dummy_leak_dtor);
klp_shadow_free(d, SV_LEAK); else
kfree(leak);
pr_info("%s: dummy @ %p, prevented leak @ %p\n",
__func__, d, leak);
} else {
pr_info("%s: dummy @ %p leaked!\n", __func__, d); pr_info("%s: dummy @ %p leaked!\n", __func__, d);
}
kfree(d); kfree(d);
} }
...@@ -163,7 +168,7 @@ static int livepatch_shadow_fix1_init(void) ...@@ -163,7 +168,7 @@ static int livepatch_shadow_fix1_init(void)
static void livepatch_shadow_fix1_exit(void) static void livepatch_shadow_fix1_exit(void)
{ {
/* Cleanup any existing SV_LEAK shadow variables */ /* Cleanup any existing SV_LEAK shadow variables */
klp_shadow_free_all(SV_LEAK); klp_shadow_free_all(SV_LEAK, livepatch_fix1_dummy_leak_dtor);
WARN_ON(klp_unregister_patch(&patch)); WARN_ON(klp_unregister_patch(&patch));
} }
......
...@@ -68,22 +68,27 @@ bool livepatch_fix2_dummy_check(struct dummy *d, unsigned long jiffies) ...@@ -68,22 +68,27 @@ bool livepatch_fix2_dummy_check(struct dummy *d, unsigned long jiffies)
return time_after(jiffies, d->jiffies_expire); return time_after(jiffies, d->jiffies_expire);
} }
static void livepatch_fix2_dummy_leak_dtor(void *obj, void *shadow_data)
{
void *d = obj;
void **shadow_leak = shadow_data;
kfree(*shadow_leak);
pr_info("%s: dummy @ %p, prevented leak @ %p\n",
__func__, d, *shadow_leak);
}
void livepatch_fix2_dummy_free(struct dummy *d) void livepatch_fix2_dummy_free(struct dummy *d)
{ {
void **shadow_leak, *leak; void **shadow_leak;
int *shadow_count; int *shadow_count;
/* Patch: copy the memory leak patch from the fix1 module. */ /* Patch: copy the memory leak patch from the fix1 module. */
shadow_leak = klp_shadow_get(d, SV_LEAK); shadow_leak = klp_shadow_get(d, SV_LEAK);
if (shadow_leak) { if (shadow_leak)
leak = *shadow_leak; klp_shadow_free(d, SV_LEAK, livepatch_fix2_dummy_leak_dtor);
klp_shadow_free(d, SV_LEAK); else
kfree(leak);
pr_info("%s: dummy @ %p, prevented leak @ %p\n",
__func__, d, leak);
} else {
pr_info("%s: dummy @ %p leaked!\n", __func__, d); pr_info("%s: dummy @ %p leaked!\n", __func__, d);
}
/* /*
* Patch: fetch the SV_COUNTER shadow variable and display * Patch: fetch the SV_COUNTER shadow variable and display
...@@ -93,7 +98,7 @@ void livepatch_fix2_dummy_free(struct dummy *d) ...@@ -93,7 +98,7 @@ void livepatch_fix2_dummy_free(struct dummy *d)
if (shadow_count) { if (shadow_count) {
pr_info("%s: dummy @ %p, check counter = %d\n", pr_info("%s: dummy @ %p, check counter = %d\n",
__func__, d, *shadow_count); __func__, d, *shadow_count);
klp_shadow_free(d, SV_COUNTER); klp_shadow_free(d, SV_COUNTER, NULL);
} }
kfree(d); kfree(d);
...@@ -140,7 +145,7 @@ static int livepatch_shadow_fix2_init(void) ...@@ -140,7 +145,7 @@ static int livepatch_shadow_fix2_init(void)
static void livepatch_shadow_fix2_exit(void) static void livepatch_shadow_fix2_exit(void)
{ {
/* Cleanup any existing SV_COUNTER shadow variables */ /* Cleanup any existing SV_COUNTER shadow variables */
klp_shadow_free_all(SV_COUNTER); klp_shadow_free_all(SV_COUNTER, NULL);
WARN_ON(klp_unregister_patch(&patch)); WARN_ON(klp_unregister_patch(&patch));
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment