Messages in this thread | | | Date | Tue, 4 Jul 2023 17:11:42 +0200 | Subject | Re: [PATCH] module: always complete idempotent loads | From | Vegard Nossum <> |
| |
On 7/4/23 15:37, Linus Torvalds wrote: > On Tue, 4 Jul 2023 at 03:09, Vegard Nossum <vegard.nossum@oracle.com> wrote: >> >> Commit 9b9879fc0327 added a hashtable storing lists of concurrent module >> loads. However, it didn't fix up all the error paths in >> init_module_from_file(); this would lead to leaving the function while an >> on-stack 'struct idempotent' element is still in the hash table, which >> leads to all sorts of badness as spotted by syzkaller: > > You are of course 100% right. > > However, I'd rather just use a wrapper function and make this thing > much clearer. Like I should have done originally. > > So I'd be inclined towards a patch like the attached instead. Works for you?
Looks mostly good. This bit is now included inside the concurrency check:
if (!f || !(f->f_mode & FMODE_READ)) return -EBADF;
Since the cookie is file_inode(f) I think that means that you could have one caller without FMODE_READ hit this check and it would potentially return -EBADF even for other callers who did open the file properly.
Maybe just do the f_mode check in finit_module()? Or... new helper, fdget_mode()??
Apart from this, there is another bit that looks a bit weird:
len = kernel_read_file(f, 0, &buf, INT_MAX, NULL, READING_MODULE); if (len < 0) { mod_stat_inc(&failed_kreads); mod_stat_add_long(len, &invalid_kread_bytes);
I don't think we should be adding error codes to byte counts.
Vegard
| |