Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8869016d authored by Miroslav Benes's avatar Miroslav Benes Committed by Jiri Kosina
Browse files

livepatch: add locking to force and signal functions 



klp_send_signals() and klp_force_transition() do not acquire klp_mutex,
because it seemed to be superfluous. A potential race in
klp_send_signals() was harmless and there was nothing in
klp_force_transition() which needed to be synchronized. That changed
with the addition of klp_forced variable during the review process.

There is a small window now, when klp_complete_transition() does not see
klp_forced set to true while all tasks have been already transitioned to
the target state. module_put() is called and the module can be removed.

Acquire klp_mutex in sysfs callback to prevent it. Do the same for the
signal sending just to be sure. There is no real downside to that.

Fixes: c99a2be7 ("livepatch: force transition to finish")
Fixes: 43347d56 ("livepatch: send a fake signal to all blocking tasks")
Reported-by: default avatarJason Baron <jbaron@akamai.com>
Signed-off-by: default avatarMiroslav Benes <mbenes@suse.cz>
Reviewed-by: default avatarPetr Mladek <pmladek@suse.com>
Acked-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
parent c99a2be7

kernel/livepatch/core.c

+28 −24
Original line number Diff line number Diff line
@@ -537,23 +537,25 @@ static ssize_t signal_store(struct kobject *kobj, struct kobj_attribute *attr, 
	int ret;

	bool val;



	patch = container_of(kobj, struct klp_patch, kobj);



	/*

	 * klp_mutex lock is not grabbed here intentionally. It is not really

	 * needed. The race window is harmless and grabbing the lock would only

	 * hold the action back.

	 */

	if (patch != klp_transition_patch)

		return -EINVAL;



	ret = kstrtobool(buf, &val);

	if (ret)

		return ret;



	if (val)

	if (!val)

		return count;



	mutex_lock(&klp_mutex);



	patch = container_of(kobj, struct klp_patch, kobj);

	if (patch != klp_transition_patch) {

		mutex_unlock(&klp_mutex);

		return -EINVAL;

	}



	klp_send_signals();



	mutex_unlock(&klp_mutex);



	return count;

}
@@ -564,23 +566,25 @@ static ssize_t force_store(struct kobject *kobj, struct kobj_attribute *attr, 
	int ret;

	bool val;



	patch = container_of(kobj, struct klp_patch, kobj);



	/*

	 * klp_mutex lock is not grabbed here intentionally. It is not really

	 * needed. The race window is harmless and grabbing the lock would only

	 * hold the action back.

	 */

	if (patch != klp_transition_patch)

		return -EINVAL;



	ret = kstrtobool(buf, &val);

	if (ret)

		return ret;



	if (val)

	if (!val)

		return count;



	mutex_lock(&klp_mutex);



	patch = container_of(kobj, struct klp_patch, kobj);

	if (patch != klp_transition_patch) {

		mutex_unlock(&klp_mutex);

		return -EINVAL;

	}



	klp_force_transition();



	mutex_unlock(&klp_mutex);



	return count;

}