livepatch: add locking to force and signal functions (8869016d) · Commits · 戴 / test

klp_send_signals() and klp_force_transition() do not acquire klp_mutex, because it seemed to be superfluous. A potential race in klp_send_signals() was harmless and there was nothing in klp_force_transition() which needed to be synchronized. That changed with the addition of klp_forced variable during the review process. There is a small window now, when klp_complete_transition() does not see klp_forced set to true while all tasks have been already transitioned to the target state. module_put() is called and the module can be removed. Acquire klp_mutex in sysfs callback to prevent it. Do the same for the signal sending just to be sure. There is no real downside to that. Fixes: ("livepatch: force transition to finish") Fixes: ("livepatch: send a fake signal to all blocking tasks") Reported-by:

Jason Baron <jbaron@akamai.com> Signed-off-by:

Miroslav Benes <mbenes@suse.cz> Reviewed-by:

Petr Mladek <pmladek@suse.com> Acked-by:

Josh Poimboeuf <jpoimboe@redhat.com> Signed-off-by:

Jiri Kosina <jkosina@suse.cz>

kernel/livepatch/core.c

+28 −24

Original line number	Diff line number	Diff line
		@@ -537,23 +537,25 @@ static ssize_t signal_store(struct kobject kobj, struct kobj_attribute attr,
		int ret;
		bool val;

		patch = container_of(kobj, struct klp_patch, kobj);

		/*
		* klp_mutex lock is not grabbed here intentionally. It is not really
		* needed. The race window is harmless and grabbing the lock would only
		* hold the action back.
		*/
		if (patch != klp_transition_patch)
		return -EINVAL;

		ret = kstrtobool(buf, &val);
		if (ret)
		return ret;

		if (val)
		if (!val)
		return count;

		mutex_lock(&klp_mutex);

		patch = container_of(kobj, struct klp_patch, kobj);
		if (patch != klp_transition_patch) {
		mutex_unlock(&klp_mutex);
		return -EINVAL;
		}

		klp_send_signals();

		mutex_unlock(&klp_mutex);

		return count;
		}

		@@ -564,23 +566,25 @@ static ssize_t force_store(struct kobject kobj, struct kobj_attribute attr,
		int ret;
		bool val;

		patch = container_of(kobj, struct klp_patch, kobj);

		/*
		* klp_mutex lock is not grabbed here intentionally. It is not really
		* needed. The race window is harmless and grabbing the lock would only
		* hold the action back.
		*/
		if (patch != klp_transition_patch)
		return -EINVAL;

		ret = kstrtobool(buf, &val);
		if (ret)
		return ret;

		if (val)
		if (!val)
		return count;

		mutex_lock(&klp_mutex);

		patch = container_of(kobj, struct klp_patch, kobj);
		if (patch != klp_transition_patch) {
		mutex_unlock(&klp_mutex);
		return -EINVAL;
		}

		klp_force_transition();

		mutex_unlock(&klp_mutex);

		return count;
		}

Admin message