Re: [RFC 10/10] kmod: add a sanity check on module loading

From: Rusty Russell <rusty@rustcorp.com.au>
To: "Luis R. Rodriguez" <mcgrof@kernel.org>
Cc: Filipe Manana <fdmanana@suse.com>,
	"Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
	"linux-doc\@vger.kernel.org" <linux-doc@vger.kernel.org>,
	rgoldwyn@suse.com, hare <hare@suse.com>,
	Jonathan Corbet <corbet@lwn.net>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	linux-kselftest@vger.kernel.org,
	Andrew Morton <akpm@linux-foundation.org>,
	Dan Williams <dan.j.williams@intel.com>,
	Aaron Tomlin <atomlin@redhat.com>,
	rwright@hpe.com, Heinrich Schuchardt <xypron.glpk@gmx.de>,
	Michal Marek <mmarek@suse.com>,
	martin.wilck@suse.com, Jeff Mahoney <jeffm@suse.com>,
	Ingo Molnar <mingo@redhat.com>, Petr Mladek <pmladek@suse.com>,
	Dmitry Torokhov <dmitry.torokhov@gmail.com>,
	Guenter Roeck <linux@roeck-us.net>,
	"Eric W. Biederman" <ebiederm@xmission.com>,
	shuah@kernel.org, DSterba@suse.com,
	Kees Cook <keescook@chromium.org>,
	Josh Poimboeuf <jpoimboe@redhat.com>,
	Arnaldo Carvalho de Melo <acme@redhat.com>,
	Miroslav Benes <mbenes@suse.cz>, NeilBrown <neilb@suse.com>,
	"linux-kernel\@vger.kernel.o rg" <linux-kernel@vger.kernel.org>,
	David Miller <davem@davemloft.net>, Jessica Yu <jeyu@redhat.com>,
	Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>,
	Julia Lawall <julia.lawall@lip6.fr>
Subject: Re: [RFC 10/10] kmod: add a sanity check on module loading
Date: Tue, 03 Jan 2017 10:34:53 +1030	[thread overview]
Message-ID: <87y3ytc8ka.fsf@rustcorp.com.au> (raw)
In-Reply-To: <CAB=NE6Wd4jvUVS6pNds0yND_PX-MMpVjtvnJOHsNWX_5H7Mdkg@mail.gmail.com>

"Luis R. Rodriguez" <mcgrof@kernel.org> writes:
>> Maybe a similar hack for try_then_request_module(), but many places seem
>> to open-code request_module() so it's not as trivial...

Hi Luis, Jessica (who is the main module maintainer now),

        Back from break, sorry about delay.

> Right, out of ~350 request_module() calls (not included try requests)
> only ~46 check the return value. Hence a validation check, and come to
> think of it, *this* was the issue that originally had me believing
> that in some places we might end up in a null deref --if those open
> coded request_module() calls assume the driver is loaded there could
> be many places where a NULL is inevitable.

Yes, assuming success == module loade is simply a bug.  I wrote
try_then_request_module() to attempt to encapsulate the correct logic
into a single place; maybe we need other helpers to cover (most of?) the
remaining cases?

> Granted, I agree they
> should be fixed, we could add a grammar rule to start nagging at
> driver developers for started, but it does beg the question also of
> what a tightly knit validation for modprobe might look like, and hence
> this patch and now the completed not-yet-posted alias work.

I really think aliases-in-kernel is too heavy a hammer, but a warning
when modprobe "succeeds" and the module still isn't found would be
a Good Thing.

> Would it be worthy as a kconfig kmod debugging aide for now? I can
> follow up with a semantic patch to nag about checking the return value
> of request_module(), and we can  have 0-day then also complain about
> new invalid uses.

Yeah, a warning about this would be win for sure.

BTW, I wrote the original "check-for-module-before-loading" in
module-init-tools, but I'm starting to wonder if it was a premature
optimization.  Have you thought about simply removing it and always
trying to load the module?  If it doesn't slow things down, perhaps
simplicity FTW?

Thanks,
Rusty.