From: Suren Baghdasaryan <surenb@google.com>
To: akpm@linux-foundation.org
Cc: kent.overstreet@linux.dev, mhocko@suse.com, vbabka@suse.cz,
hannes@cmpxchg.org, roman.gushchin@linux.dev, mgorman@suse.de,
dave@stgolabs.net, willy@infradead.org, liam.howlett@oracle.com,
penguin-kernel@i-love.sakura.ne.jp, corbet@lwn.net,
void@manifault.com, peterz@infradead.org, juri.lelli@redhat.com,
catalin.marinas@arm.com, will@kernel.org, arnd@arndb.de,
tglx@linutronix.de, mingo@redhat.com,
dave.hansen@linux.intel.com, x86@kernel.org, peterx@redhat.com,
david@redhat.com, axboe@kernel.dk, mcgrof@kernel.org,
masahiroy@kernel.org, nathan@kernel.org, dennis@kernel.org,
jhubbard@nvidia.com, tj@kernel.org, muchun.song@linux.dev,
rppt@kernel.org, paulmck@kernel.org, pasha.tatashin@soleen.com,
yosryahmed@google.com, yuzhao@google.com, dhowells@redhat.com,
hughd@google.com, andreyknvl@gmail.com, keescook@chromium.org,
ndesaulniers@google.com, vvvvvv@google.com,
gregkh@linuxfoundation.org, ebiggers@google.com,
ytcoode@gmail.com, vincent.guittot@linaro.org,
dietmar.eggemann@arm.com, rostedt@goodmis.org,
bsegall@google.com, bristot@redhat.com, vschneid@redhat.com,
cl@linux.com, penberg@kernel.org, iamjoonsoo.kim@lge.com,
42.hyeyoo@gmail.com, glider@google.com, elver@google.com,
dvyukov@google.com, songmuchun@bytedance.com, jbaron@akamai.com,
aliceryhl@google.com, rientjes@google.com, minchan@google.com,
kaleshsingh@google.com, surenb@google.com,
kernel-team@android.com, linux-doc@vger.kernel.org,
linux-kernel@vger.kernel.org, iommu@lists.linux.dev,
linux-arch@vger.kernel.org, linux-fsdevel@vger.kernel.org,
linux-mm@kvack.org, linux-modules@vger.kernel.org,
kasan-dev@googlegroups.com, cgroups@vger.kernel.org
Subject: [PATCH v6 12/37] lib: prevent module unloading if memory is not freed
Date: Thu, 21 Mar 2024 09:36:34 -0700 [thread overview]
Message-ID: <20240321163705.3067592-13-surenb@google.com> (raw)
In-Reply-To: <20240321163705.3067592-1-surenb@google.com>
Skip freeing module's data section if there are non-zero allocation tags
because otherwise, once these allocations are freed, the access to their
code tag would cause UAF.
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
---
include/linux/codetag.h | 6 +++---
kernel/module/main.c | 27 +++++++++++++++++++--------
lib/codetag.c | 11 ++++++++---
3 files changed, 30 insertions(+), 14 deletions(-)
diff --git a/include/linux/codetag.h b/include/linux/codetag.h
index c44f5b83f24d..bfd0ba5c4185 100644
--- a/include/linux/codetag.h
+++ b/include/linux/codetag.h
@@ -35,7 +35,7 @@ struct codetag_type_desc {
size_t tag_size;
void (*module_load)(struct codetag_type *cttype,
struct codetag_module *cmod);
- void (*module_unload)(struct codetag_type *cttype,
+ bool (*module_unload)(struct codetag_type *cttype,
struct codetag_module *cmod);
};
@@ -71,10 +71,10 @@ codetag_register_type(const struct codetag_type_desc *desc);
#if defined(CONFIG_CODE_TAGGING) && defined(CONFIG_MODULES)
void codetag_load_module(struct module *mod);
-void codetag_unload_module(struct module *mod);
+bool codetag_unload_module(struct module *mod);
#else
static inline void codetag_load_module(struct module *mod) {}
-static inline void codetag_unload_module(struct module *mod) {}
+static inline bool codetag_unload_module(struct module *mod) { return true; }
#endif
#endif /* _LINUX_CODETAG_H */
diff --git a/kernel/module/main.c b/kernel/module/main.c
index ffa6b3e9cb43..2d25eebc549d 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -1211,15 +1211,19 @@ static void *module_memory_alloc(unsigned int size, enum mod_mem_type type)
return module_alloc(size);
}
-static void module_memory_free(void *ptr, enum mod_mem_type type)
+static void module_memory_free(void *ptr, enum mod_mem_type type,
+ bool unload_codetags)
{
+ if (!unload_codetags && mod_mem_type_is_core_data(type))
+ return;
+
if (mod_mem_use_vmalloc(type))
vfree(ptr);
else
module_memfree(ptr);
}
-static void free_mod_mem(struct module *mod)
+static void free_mod_mem(struct module *mod, bool unload_codetags)
{
for_each_mod_mem_type(type) {
struct module_memory *mod_mem = &mod->mem[type];
@@ -1230,20 +1234,27 @@ static void free_mod_mem(struct module *mod)
/* Free lock-classes; relies on the preceding sync_rcu(). */
lockdep_free_key_range(mod_mem->base, mod_mem->size);
if (mod_mem->size)
- module_memory_free(mod_mem->base, type);
+ module_memory_free(mod_mem->base, type,
+ unload_codetags);
}
/* MOD_DATA hosts mod, so free it at last */
lockdep_free_key_range(mod->mem[MOD_DATA].base, mod->mem[MOD_DATA].size);
- module_memory_free(mod->mem[MOD_DATA].base, MOD_DATA);
+ module_memory_free(mod->mem[MOD_DATA].base, MOD_DATA, unload_codetags);
}
/* Free a module, remove from lists, etc. */
static void free_module(struct module *mod)
{
+ bool unload_codetags;
+
trace_module_free(mod);
- codetag_unload_module(mod);
+ unload_codetags = codetag_unload_module(mod);
+ if (!unload_codetags)
+ pr_warn("%s: memory allocation(s) from the module still alive, cannot unload cleanly\n",
+ mod->name);
+
mod_sysfs_teardown(mod);
/*
@@ -1285,7 +1296,7 @@ static void free_module(struct module *mod)
kfree(mod->args);
percpu_modfree(mod);
- free_mod_mem(mod);
+ free_mod_mem(mod, unload_codetags);
}
void *__symbol_get(const char *symbol)
@@ -2298,7 +2309,7 @@ static int move_module(struct module *mod, struct load_info *info)
return 0;
out_enomem:
for (t--; t >= 0; t--)
- module_memory_free(mod->mem[t].base, t);
+ module_memory_free(mod->mem[t].base, t, true);
return ret;
}
@@ -2428,7 +2439,7 @@ static void module_deallocate(struct module *mod, struct load_info *info)
percpu_modfree(mod);
module_arch_freeing_init(mod);
- free_mod_mem(mod);
+ free_mod_mem(mod, true);
}
int __weak module_finalize(const Elf_Ehdr *hdr,
diff --git a/lib/codetag.c b/lib/codetag.c
index 54d2828eba25..408062f722ce 100644
--- a/lib/codetag.c
+++ b/lib/codetag.c
@@ -5,6 +5,7 @@
#include <linux/module.h>
#include <linux/seq_buf.h>
#include <linux/slab.h>
+#include <linux/vmalloc.h>
struct codetag_type {
struct list_head link;
@@ -206,12 +207,13 @@ void codetag_load_module(struct module *mod)
mutex_unlock(&codetag_lock);
}
-void codetag_unload_module(struct module *mod)
+bool codetag_unload_module(struct module *mod)
{
struct codetag_type *cttype;
+ bool unload_ok = true;
if (!mod)
- return;
+ return true;
mutex_lock(&codetag_lock);
list_for_each_entry(cttype, &codetag_types, link) {
@@ -228,7 +230,8 @@ void codetag_unload_module(struct module *mod)
}
if (found) {
if (cttype->desc.module_unload)
- cttype->desc.module_unload(cttype, cmod);
+ if (!cttype->desc.module_unload(cttype, cmod))
+ unload_ok = false;
cttype->count -= range_size(cttype, &cmod->range);
idr_remove(&cttype->mod_idr, mod_id);
@@ -237,6 +240,8 @@ void codetag_unload_module(struct module *mod)
up_write(&cttype->mod_lock);
}
mutex_unlock(&codetag_lock);
+
+ return unload_ok;
}
#else /* CONFIG_MODULES */
--
2.44.0.291.gc1ea87d7ee-goog
next prev parent reply other threads:[~2024-03-21 16:37 UTC|newest]
Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-21 16:36 [PATCH v6 00/37] Memory allocation profiling Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 01/37] fix missing vmalloc.h includes Suren Baghdasaryan
2024-04-03 21:12 ` Nathan Chancellor
2024-04-03 21:41 ` Kent Overstreet
2024-04-03 21:48 ` David Hildenbrand
2024-04-03 22:57 ` Kent Overstreet
2024-04-04 2:55 ` Randy Dunlap
2024-03-21 16:36 ` [PATCH v6 02/37] asm-generic/io.h: Kill vmalloc.h dependency Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 03/37] mm/slub: Mark slab_free_freelist_hook() __always_inline Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 04/37] scripts/kallysms: Always include __start and __stop symbols Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 05/37] fs: Convert alloc_inode_sb() to a macro Suren Baghdasaryan
2024-03-21 20:31 ` Andrew Morton
2024-03-21 21:13 ` Suren Baghdasaryan
2024-03-21 21:15 ` Kent Overstreet
2024-03-21 22:09 ` Andrew Morton
2024-03-21 22:17 ` Kent Overstreet
2024-03-21 22:47 ` Suren Baghdasaryan
2024-04-04 16:57 ` Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 06/37] mm: introduce slabobj_ext to support slab object extensions Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 07/37] mm: introduce __GFP_NO_OBJ_EXT flag to selectively prevent slabobj_ext creation Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 08/37] mm/slab: introduce SLAB_NO_OBJ_EXT to avoid obj_ext creation Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 09/37] slab: objext: introduce objext_flags as extension to page_memcg_data_flags Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 10/37] lib: code tagging framework Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 11/37] lib: code tagging module support Suren Baghdasaryan
2024-03-21 16:36 ` Suren Baghdasaryan [this message]
2024-03-21 16:36 ` [PATCH v6 13/37] lib: add allocation tagging support for memory allocation profiling Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 14/37] lib: introduce support for page allocation tagging Suren Baghdasaryan
2024-03-26 3:12 ` Matthew Wilcox
2024-03-26 6:23 ` Suren Baghdasaryan
2024-03-27 3:24 ` Matthew Wilcox
2024-03-27 5:30 ` Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 15/37] lib: introduce early boot parameter to avoid page_ext memory overhead Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 16/37] mm: percpu: increase PERCPU_MODULE_RESERVE to accommodate allocation tags Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 17/37] change alloc_pages name in dma_map_ops to avoid name conflicts Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 18/37] mm: enable page allocation tagging Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 19/37] mm: create new codetag references during page splitting Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 20/37] mm: fix non-compound multi-order memory accounting in __free_pages Suren Baghdasaryan
2024-03-21 16:48 ` Matthew Wilcox
2024-03-21 17:04 ` Matthew Wilcox
2024-03-21 17:19 ` Suren Baghdasaryan
2024-03-21 17:22 ` Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 21/37] mm/page_ext: enable early_page_ext when CONFIG_MEM_ALLOC_PROFILING_DEBUG=y Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 22/37] lib: add codetag reference into slabobj_ext Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 23/37] mm/slab: add allocation accounting into slab allocation and free paths Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 24/37] rust: Add a rust helper for krealloc() Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 25/37] mm/slab: enable slab allocation tagging for kmalloc and friends Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 26/37] mempool: Hook up to memory allocation profiling Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 27/37] mm: percpu: Introduce pcpuobj_ext Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 28/37] mm: percpu: Add codetag reference into pcpuobj_ext Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 29/37] mm: percpu: enable per-cpu allocation tagging Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 30/37] mm: vmalloc: Enable memory allocation profiling Suren Baghdasaryan
2024-03-23 18:05 ` SeongJae Park
2024-03-25 14:56 ` Suren Baghdasaryan
2024-03-25 17:49 ` SeongJae Park
2024-03-25 17:59 ` Suren Baghdasaryan
2024-03-25 18:20 ` SeongJae Park
2024-03-26 7:51 ` Suren Baghdasaryan
2024-03-26 15:39 ` SeongJae Park
2024-04-16 19:27 ` Sourav Panda
2024-03-21 16:36 ` [PATCH v6 31/37] rhashtable: Plumb through alloc tag Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 32/37] lib: add memory allocations report in show_mem() Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 33/37] codetag: debug: skip objext checking when it's for objext itself Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 34/37] codetag: debug: mark codetags for reserved pages as empty Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 35/37] codetag: debug: introduce OBJEXTS_ALLOC_FAIL to mark failed slab_ext allocations Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 36/37] MAINTAINERS: Add entries for code tagging and memory allocation profiling Suren Baghdasaryan
2024-03-21 16:36 ` [PATCH v6 37/37] memprofiling: Documentation Suren Baghdasaryan
2024-03-21 20:41 ` [PATCH v6 00/37] Memory allocation profiling Andrew Morton
2024-03-21 21:08 ` Suren Baghdasaryan
2024-04-05 13:37 ` Klara Modin
2024-04-05 14:14 ` Suren Baghdasaryan
2024-04-05 14:30 ` Klara Modin
2024-04-05 15:20 ` Suren Baghdasaryan
2024-04-05 15:37 ` Klara Modin
2024-04-06 21:42 ` Suren Baghdasaryan
2024-04-25 1:59 ` Kees Cook
2024-04-25 3:25 ` Kent Overstreet
2024-04-25 15:39 ` Suren Baghdasaryan
2024-04-25 20:00 ` Kees Cook
2024-04-25 21:35 ` Suren Baghdasaryan
2024-04-25 20:08 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240321163705.3067592-13-surenb@google.com \
--to=surenb@google.com \
--cc=42.hyeyoo@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=aliceryhl@google.com \
--cc=andreyknvl@gmail.com \
--cc=arnd@arndb.de \
--cc=axboe@kernel.dk \
--cc=bristot@redhat.com \
--cc=bsegall@google.com \
--cc=catalin.marinas@arm.com \
--cc=cgroups@vger.kernel.org \
--cc=cl@linux.com \
--cc=corbet@lwn.net \
--cc=dave.hansen@linux.intel.com \
--cc=dave@stgolabs.net \
--cc=david@redhat.com \
--cc=dennis@kernel.org \
--cc=dhowells@redhat.com \
--cc=dietmar.eggemann@arm.com \
--cc=dvyukov@google.com \
--cc=ebiggers@google.com \
--cc=elver@google.com \
--cc=glider@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=hannes@cmpxchg.org \
--cc=hughd@google.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=iommu@lists.linux.dev \
--cc=jbaron@akamai.com \
--cc=jhubbard@nvidia.com \
--cc=juri.lelli@redhat.com \
--cc=kaleshsingh@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=keescook@chromium.org \
--cc=kent.overstreet@linux.dev \
--cc=kernel-team@android.com \
--cc=liam.howlett@oracle.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-modules@vger.kernel.org \
--cc=masahiroy@kernel.org \
--cc=mcgrof@kernel.org \
--cc=mgorman@suse.de \
--cc=mhocko@suse.com \
--cc=minchan@google.com \
--cc=mingo@redhat.com \
--cc=muchun.song@linux.dev \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=pasha.tatashin@soleen.com \
--cc=paulmck@kernel.org \
--cc=penberg@kernel.org \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=peterx@redhat.com \
--cc=peterz@infradead.org \
--cc=rientjes@google.com \
--cc=roman.gushchin@linux.dev \
--cc=rostedt@goodmis.org \
--cc=rppt@kernel.org \
--cc=songmuchun@bytedance.com \
--cc=tglx@linutronix.de \
--cc=tj@kernel.org \
--cc=vbabka@suse.cz \
--cc=vincent.guittot@linaro.org \
--cc=void@manifault.com \
--cc=vschneid@redhat.com \
--cc=vvvvvv@google.com \
--cc=will@kernel.org \
--cc=willy@infradead.org \
--cc=x86@kernel.org \
--cc=yosryahmed@google.com \
--cc=ytcoode@gmail.com \
--cc=yuzhao@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).