Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 57bd5b59 authored by Kefeng Wang's avatar Kefeng Wang Committed by Greg Kroah-Hartman
Browse files

once: Fix panic when module unload 

[ Upstream commit 1027b96ec9d34f9abab69bc1a4dc5b1ad8ab1349 ]

DO_ONCE
DEFINE_STATIC_KEY_TRUE(___once_key);
__do_once_done
  once_disable_jump(once_key);
    INIT_WORK(&w->work, once_deferred);
    struct once_work *w;
    w->key = key;
    schedule_work(&w->work);                     module unload
                                                   //*the key is
destroy*
process_one_work
  once_deferred
    BUG_ON(!static_key_enabled(work->key));
       static_key_count((struct static_key *)x)    //*access key, crash*

When module uses DO_ONCE mechanism, it could crash due to the above
concurrency problem, we could reproduce it with link[1].

Fix it by add/put module refcount in the once work process.

[1] https://lore.kernel.org/netdev/eaa6c371-465e-57eb-6be9-f4b16b9d7cbf@huawei.com/



Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: David S. Miller <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Reported-by: default avatarMinmin chen <chenmingmin@huawei.com>
Signed-off-by: default avatarKefeng Wang <wangkefeng.wang@huawei.com>
Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 5892f910

include/linux/once.h

+2 −2
Original line number Diff line number Diff line
@@ -7,7 +7,7 @@ 


bool __do_once_start(bool *done, unsigned long *flags);

void __do_once_done(bool *done, struct static_key_true *once_key,

		    unsigned long *flags);

		    unsigned long *flags, struct module *mod);



/* Call a function exactly once. The idea of DO_ONCE() is to perform

 * a function call such as initialization of random seeds, etc, only
@@ -46,7 +46,7 @@ void __do_once_done(bool *done, struct static_key_true *once_key, 
			if (unlikely(___ret)) {				     \

				func(__VA_ARGS__);			     \

				__do_once_done(&___done, &___once_key,	     \

					       &___flags);		     \

					       &___flags, THIS_MODULE);	     \

			}						     \

		}							     \

		___ret;							     \

lib/once.c

+8 −3
Original line number Diff line number Diff line
@@ -3,10 +3,12 @@ 
#include <linux/spinlock.h>

#include <linux/once.h>

#include <linux/random.h>

#include <linux/module.h>



struct once_work {

	struct work_struct work;

	struct static_key_true *key;

	struct module *module;

};



static void once_deferred(struct work_struct *w)
@@ -16,10 +18,11 @@ static void once_deferred(struct work_struct *w) 
	work = container_of(w, struct once_work, work);

	BUG_ON(!static_key_enabled(work->key));

	static_branch_disable(work->key);

	module_put(work->module);

	kfree(work);

}



static void once_disable_jump(struct static_key_true *key)

static void once_disable_jump(struct static_key_true *key, struct module *mod)

{

	struct once_work *w;
@@ -29,6 +32,8 @@ static void once_disable_jump(struct static_key_true *key) 


	INIT_WORK(&w->work, once_deferred);

	w->key = key;

	w->module = mod;

	__module_get(mod);

	schedule_work(&w->work);

}
@@ -53,11 +58,11 @@ bool __do_once_start(bool *done, unsigned long *flags) 
EXPORT_SYMBOL(__do_once_start);



void __do_once_done(bool *done, struct static_key_true *once_key,

		    unsigned long *flags)

		    unsigned long *flags, struct module *mod)

	__releases(once_lock)

{

	*done = true;

	spin_unlock_irqrestore(&once_lock, *flags);

	once_disable_jump(once_key);

	once_disable_jump(once_key, mod);

}

EXPORT_SYMBOL(__do_once_done);