From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752669AbbK3D40 (ORCPT ); Sun, 29 Nov 2015 22:56:26 -0500 Received: from szxga01-in.huawei.com ([58.251.152.64]:15895 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751840AbbK3D4Y (ORCPT ); Sun, 29 Nov 2015 22:56:24 -0500 From: Li Bin To: , , , CC: , , , , , Subject: [PATCH] livepatch: fix race between enabled_store() and klp_unregister_patch() Date: Mon, 30 Nov 2015 11:54:37 +0800 Message-ID: <1448855677-8392-1-git-send-email-huawei.libin@huawei.com> X-Mailer: git-send-email 1.7.1 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.175.100.166] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020201.565BC8E3.00AB,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-06-18 04:22:30, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 260a399e6302d9c161cf4d706e340aa2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org There is a potential race as following: CPU0 | CPU1 -----------------------------|----------------------------------- enabled_store() | klp_unregister_patch() | |-mutex_lock(&klp_mutex); |-mutex_lock(&klp_mutex); | |-klp_free_patch(); | |-mutex_unlock(&klp_mutex); |-[process the patch's state]| |-mutex_unlock(&klp_mutex) | Fix this race condition by adding klp_is_patch_registered() check in enabled_store() after get the lock klp_mutex. Signed-off-by: Li Bin --- kernel/livepatch/core.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c index db545cb..50af971 100644 --- a/kernel/livepatch/core.c +++ b/kernel/livepatch/core.c @@ -614,6 +614,11 @@ static ssize_t enabled_store(struct kobject *kobj, struct kobj_attribute *attr, mutex_lock(&klp_mutex); + if (!klp_is_patch_registered(patch)) { + ret = -EINVAL; + goto err; + } + if (val == patch->state) { /* already in requested state */ ret = -EINVAL; -- 1.7.1