lkml.org 
[lkml]   [2023]   [Jul]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] module: always complete idempotent loads
From

On 7/4/23 15:37, Linus Torvalds wrote:
> On Tue, 4 Jul 2023 at 03:09, Vegard Nossum <vegard.nossum@oracle.com> wrote:
>>
>> Commit 9b9879fc0327 added a hashtable storing lists of concurrent module
>> loads. However, it didn't fix up all the error paths in
>> init_module_from_file(); this would lead to leaving the function while an
>> on-stack 'struct idempotent' element is still in the hash table, which
>> leads to all sorts of badness as spotted by syzkaller:
>
> You are of course 100% right.
>
> However, I'd rather just use a wrapper function and make this thing
> much clearer. Like I should have done originally.
>
> So I'd be inclined towards a patch like the attached instead. Works for you?

Looks mostly good. This bit is now included inside the concurrency check:

if (!f || !(f->f_mode & FMODE_READ))
return -EBADF;

Since the cookie is file_inode(f) I think that means that you could have
one caller without FMODE_READ hit this check and it would potentially
return -EBADF even for other callers who did open the file properly.

Maybe just do the f_mode check in finit_module()? Or... new helper,
fdget_mode()??

Apart from this, there is another bit that looks a bit weird:

len = kernel_read_file(f, 0, &buf, INT_MAX, NULL, READING_MODULE);
if (len < 0) {
mod_stat_inc(&failed_kreads);
mod_stat_add_long(len, &invalid_kread_bytes);

I don't think we should be adding error codes to byte counts.


Vegard

\
 
 \ /
  Last update: 2023-07-04 17:12    [W:0.060 / U:1.624 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site