Skip to content

Commit

Permalink
livepatch: add locking to force and signal functions
Browse files Browse the repository at this point in the history
klp_send_signals() and klp_force_transition() do not acquire klp_mutex,
because it seemed to be superfluous. A potential race in
klp_send_signals() was harmless and there was nothing in
klp_force_transition() which needed to be synchronized. That changed
with the addition of klp_forced variable during the review process.

There is a small window now, when klp_complete_transition() does not see
klp_forced set to true while all tasks have been already transitioned to
the target state. module_put() is called and the module can be removed.

Acquire klp_mutex in sysfs callback to prevent it. Do the same for the
signal sending just to be sure. There is no real downside to that.

Fixes: c99a2be ("livepatch: force transition to finish")
Fixes: 43347d5 ("livepatch: send a fake signal to all blocking tasks")
Reported-by: Jason Baron <[email protected]>
Signed-off-by: Miroslav Benes <[email protected]>
Reviewed-by: Petr Mladek <[email protected]>
Acked-by: Josh Poimboeuf <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
  • Loading branch information
mirab authored and Jiri Kosina committed Jan 11, 2018
1 parent c99a2be commit 8869016
Showing 1 changed file with 28 additions and 24 deletions.
52 changes: 28 additions & 24 deletions kernel/livepatch/core.c
Original file line number Diff line number Diff line change
Expand Up @@ -537,22 +537,24 @@ static ssize_t signal_store(struct kobject *kobj, struct kobj_attribute *attr,
int ret;
bool val;

patch = container_of(kobj, struct klp_patch, kobj);

/*
* klp_mutex lock is not grabbed here intentionally. It is not really
* needed. The race window is harmless and grabbing the lock would only
* hold the action back.
*/
if (patch != klp_transition_patch)
return -EINVAL;

ret = kstrtobool(buf, &val);
if (ret)
return ret;

if (val)
klp_send_signals();
if (!val)
return count;

mutex_lock(&klp_mutex);

patch = container_of(kobj, struct klp_patch, kobj);
if (patch != klp_transition_patch) {
mutex_unlock(&klp_mutex);
return -EINVAL;
}

klp_send_signals();

mutex_unlock(&klp_mutex);

return count;
}
Expand All @@ -564,22 +566,24 @@ static ssize_t force_store(struct kobject *kobj, struct kobj_attribute *attr,
int ret;
bool val;

patch = container_of(kobj, struct klp_patch, kobj);

/*
* klp_mutex lock is not grabbed here intentionally. It is not really
* needed. The race window is harmless and grabbing the lock would only
* hold the action back.
*/
if (patch != klp_transition_patch)
return -EINVAL;

ret = kstrtobool(buf, &val);
if (ret)
return ret;

if (val)
klp_force_transition();
if (!val)
return count;

mutex_lock(&klp_mutex);

patch = container_of(kobj, struct klp_patch, kobj);
if (patch != klp_transition_patch) {
mutex_unlock(&klp_mutex);
return -EINVAL;
}

klp_force_transition();

mutex_unlock(&klp_mutex);

return count;
}
Expand Down

0 comments on commit 8869016

Please sign in to comment.