linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH v2] once: Fix panic when module unload
@ 2021-08-06  8:21 Kefeng Wang
  2021-08-06 13:43 ` Jakub Kicinski
  2021-08-06 15:22 ` Hannes Frederic Sowa
  0 siblings, 2 replies; 6+ messages in thread
From: Kefeng Wang @ 2021-08-06  8:21 UTC (permalink / raw)
  To: linux-kernel, netdev, hannes, davem
  Cc: akpm, gregkh, Kefeng Wang, Daniel Borkmann, Eric Dumazet, Minmin chen

DO_ONCE
DEFINE_STATIC_KEY_TRUE(___once_key);
__do_once_done
  once_disable_jump(once_key);
    INIT_WORK(&w->work, once_deferred);
    struct once_work *w;
    w->key = key;
    schedule_work(&w->work);                     module unload
                                                   //*the key is
destroy*
process_one_work
  once_deferred
    BUG_ON(!static_key_enabled(work->key));
       static_key_count((struct static_key *)x)    //*access key, crash*

When module uses DO_ONCE mechanism, it could crash due to the above
concurrency problem, we could reproduce it with link[1].

Fix it by add/put module refcount in the once work process.

[1] https://lore.kernel.org/netdev/eaa6c371-465e-57eb-6be9-f4b16b9d7cbf@huawei.com/

Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: David S. Miller <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Reported-by: Minmin chen <chenmingmin@huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
---
v2: always pass THIS_MODULE to macro DO_ONCE(), suggested by hannes

 include/linux/once.h |  4 ++--
 lib/once.c           | 11 ++++++++---
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/include/linux/once.h b/include/linux/once.h
index 9225ee6d96c7..ae6f4eb41cbe 100644
--- a/include/linux/once.h
+++ b/include/linux/once.h
@@ -7,7 +7,7 @@
 
 bool __do_once_start(bool *done, unsigned long *flags);
 void __do_once_done(bool *done, struct static_key_true *once_key,
-		    unsigned long *flags);
+		    unsigned long *flags, struct module *mod);
 
 /* Call a function exactly once. The idea of DO_ONCE() is to perform
  * a function call such as initialization of random seeds, etc, only
@@ -46,7 +46,7 @@ void __do_once_done(bool *done, struct static_key_true *once_key,
 			if (unlikely(___ret)) {				     \
 				func(__VA_ARGS__);			     \
 				__do_once_done(&___done, &___once_key,	     \
-					       &___flags);		     \
+					       &___flags, THIS_MODULE);	     \
 			}						     \
 		}							     \
 		___ret;							     \
diff --git a/lib/once.c b/lib/once.c
index 8b7d6235217e..59149bf3bfb4 100644
--- a/lib/once.c
+++ b/lib/once.c
@@ -3,10 +3,12 @@
 #include <linux/spinlock.h>
 #include <linux/once.h>
 #include <linux/random.h>
+#include <linux/module.h>
 
 struct once_work {
 	struct work_struct work;
 	struct static_key_true *key;
+	struct module *module;
 };
 
 static void once_deferred(struct work_struct *w)
@@ -16,10 +18,11 @@ static void once_deferred(struct work_struct *w)
 	work = container_of(w, struct once_work, work);
 	BUG_ON(!static_key_enabled(work->key));
 	static_branch_disable(work->key);
+	module_put(work->module);
 	kfree(work);
 }
 
-static void once_disable_jump(struct static_key_true *key)
+static void once_disable_jump(struct static_key_true *key, struct module *mod)
 {
 	struct once_work *w;
 
@@ -29,6 +32,8 @@ static void once_disable_jump(struct static_key_true *key)
 
 	INIT_WORK(&w->work, once_deferred);
 	w->key = key;
+	w->module = mod;
+	__module_get(mod);
 	schedule_work(&w->work);
 }
 
@@ -53,11 +58,11 @@ bool __do_once_start(bool *done, unsigned long *flags)
 EXPORT_SYMBOL(__do_once_start);
 
 void __do_once_done(bool *done, struct static_key_true *once_key,
-		    unsigned long *flags)
+		    unsigned long *flags, struct module *mod)
 	__releases(once_lock)
 {
 	*done = true;
 	spin_unlock_irqrestore(&once_lock, *flags);
-	once_disable_jump(once_key);
+	once_disable_jump(once_key, mod);
 }
 EXPORT_SYMBOL(__do_once_done);
-- 
2.26.2


^ permalink raw reply related	[flat|nested] 6+ messages in thread

* Re: [PATCH v2] once: Fix panic when module unload
  2021-08-06  8:21 [PATCH v2] once: Fix panic when module unload Kefeng Wang
@ 2021-08-06 13:43 ` Jakub Kicinski
  2021-08-06 13:51   ` Greg KH
  2021-08-06 15:22 ` Hannes Frederic Sowa
  1 sibling, 1 reply; 6+ messages in thread
From: Jakub Kicinski @ 2021-08-06 13:43 UTC (permalink / raw)
  To: Kefeng Wang, gregkh
  Cc: linux-kernel, netdev, hannes, davem, akpm, Daniel Borkmann,
	Eric Dumazet, Minmin chen

On Fri, 6 Aug 2021 16:21:24 +0800 Kefeng Wang wrote:
> DO_ONCE
> DEFINE_STATIC_KEY_TRUE(___once_key);
> __do_once_done
>   once_disable_jump(once_key);
>     INIT_WORK(&w->work, once_deferred);
>     struct once_work *w;
>     w->key = key;
>     schedule_work(&w->work);                     module unload
>                                                    //*the key is
> destroy*
> process_one_work
>   once_deferred
>     BUG_ON(!static_key_enabled(work->key));
>        static_key_count((struct static_key *)x)    //*access key, crash*
> 
> When module uses DO_ONCE mechanism, it could crash due to the above
> concurrency problem, we could reproduce it with link[1].
> 
> Fix it by add/put module refcount in the once work process.
> 
> [1] https://lore.kernel.org/netdev/eaa6c371-465e-57eb-6be9-f4b16b9d7cbf@huawei.com/

Seems reasonable. Greg does it look good to you?

I think we can take it thru networking since nobody cared to pick up v1.

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH v2] once: Fix panic when module unload
  2021-08-06 13:43 ` Jakub Kicinski
@ 2021-08-06 13:51   ` Greg KH
  2021-08-09  1:15     ` Kefeng Wang
  0 siblings, 1 reply; 6+ messages in thread
From: Greg KH @ 2021-08-06 13:51 UTC (permalink / raw)
  To: Jakub Kicinski
  Cc: Kefeng Wang, linux-kernel, netdev, hannes, davem, akpm,
	Daniel Borkmann, Eric Dumazet, Minmin chen

On Fri, Aug 06, 2021 at 06:43:28AM -0700, Jakub Kicinski wrote:
> On Fri, 6 Aug 2021 16:21:24 +0800 Kefeng Wang wrote:
> > DO_ONCE
> > DEFINE_STATIC_KEY_TRUE(___once_key);
> > __do_once_done
> >   once_disable_jump(once_key);
> >     INIT_WORK(&w->work, once_deferred);
> >     struct once_work *w;
> >     w->key = key;
> >     schedule_work(&w->work);                     module unload
> >                                                    //*the key is
> > destroy*
> > process_one_work
> >   once_deferred
> >     BUG_ON(!static_key_enabled(work->key));
> >        static_key_count((struct static_key *)x)    //*access key, crash*
> > 
> > When module uses DO_ONCE mechanism, it could crash due to the above
> > concurrency problem, we could reproduce it with link[1].
> > 
> > Fix it by add/put module refcount in the once work process.
> > 
> > [1] https://lore.kernel.org/netdev/eaa6c371-465e-57eb-6be9-f4b16b9d7cbf@huawei.com/
> 
> Seems reasonable. Greg does it look good to you?

Me?  I was not paying attention to this at all, sorry...

> I think we can take it thru networking since nobody cared to pick up v1.

Sure, I trust you :)

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH v2] once: Fix panic when module unload
  2021-08-06  8:21 [PATCH v2] once: Fix panic when module unload Kefeng Wang
  2021-08-06 13:43 ` Jakub Kicinski
@ 2021-08-06 15:22 ` Hannes Frederic Sowa
  2021-08-09  1:13   ` Kefeng Wang
  1 sibling, 1 reply; 6+ messages in thread
From: Hannes Frederic Sowa @ 2021-08-06 15:22 UTC (permalink / raw)
  To: Kefeng Wang, linux-kernel, netdev, David Miller
  Cc: Andrew Morton, Greg Kroah-Hartman, Daniel Borkmann, Eric Dumazet,
	Minmin chen

On Fri, Aug 6, 2021, at 10:21, Kefeng Wang wrote:
> DO_ONCE
> DEFINE_STATIC_KEY_TRUE(___once_key);
> __do_once_done
>   once_disable_jump(once_key);
>     INIT_WORK(&w->work, once_deferred);
>     struct once_work *w;
>     w->key = key;
>     schedule_work(&w->work);                     module unload
>                                                    //*the key is
> destroy*
> process_one_work
>   once_deferred
>     BUG_ON(!static_key_enabled(work->key));
>        static_key_count((struct static_key *)x)    //*access key, crash*
> 
> When module uses DO_ONCE mechanism, it could crash due to the above
> concurrency problem, we could reproduce it with link[1].
> 
> Fix it by add/put module refcount in the once work process.
> 
> [1] 
> https://lore.kernel.org/netdev/eaa6c371-465e-57eb-6be9-f4b16b9d7cbf@huawei.com/
> 
> Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
> Cc: Daniel Borkmann <daniel@iogearbox.net>
> Cc: David S. Miller <davem@davemloft.net>
> Cc: Eric Dumazet <edumazet@google.com>
> Reported-by: Minmin chen <chenmingmin@huawei.com>
> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>

Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>

Thanks,
Hannes

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH v2] once: Fix panic when module unload
  2021-08-06 15:22 ` Hannes Frederic Sowa
@ 2021-08-09  1:13   ` Kefeng Wang
  0 siblings, 0 replies; 6+ messages in thread
From: Kefeng Wang @ 2021-08-09  1:13 UTC (permalink / raw)
  To: Hannes Frederic Sowa, linux-kernel, netdev, David Miller
  Cc: Andrew Morton, Greg Kroah-Hartman, Daniel Borkmann, Eric Dumazet,
	Minmin chen


On 2021/8/6 23:22, Hannes Frederic Sowa wrote:
> On Fri, Aug 6, 2021, at 10:21, Kefeng Wang wrote:
>> DO_ONCE
>> DEFINE_STATIC_KEY_TRUE(___once_key);
>> __do_once_done
>>    once_disable_jump(once_key);
>>      INIT_WORK(&w->work, once_deferred);
>>      struct once_work *w;
>>      w->key = key;
>>      schedule_work(&w->work);                     module unload
>>                                                     //*the key is
>> destroy*
>> process_one_work
>>    once_deferred
>>      BUG_ON(!static_key_enabled(work->key));
>>         static_key_count((struct static_key *)x)    //*access key, crash*
>>
>> When module uses DO_ONCE mechanism, it could crash due to the above
>> concurrency problem, we could reproduce it with link[1].
>>
>> Fix it by add/put module refcount in the once work process.
>>
>> [1]
>> https://lore.kernel.org/netdev/eaa6c371-465e-57eb-6be9-f4b16b9d7cbf@huawei.com/
>>
>> Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
>> Cc: Daniel Borkmann <daniel@iogearbox.net>
>> Cc: David S. Miller <davem@davemloft.net>
>> Cc: Eric Dumazet <edumazet@google.com>
>> Reported-by: Minmin chen <chenmingmin@huawei.com>
>> Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Thanks.
>
> Thanks,
> Hannes
> .
>

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH v2] once: Fix panic when module unload
  2021-08-06 13:51   ` Greg KH
@ 2021-08-09  1:15     ` Kefeng Wang
  0 siblings, 0 replies; 6+ messages in thread
From: Kefeng Wang @ 2021-08-09  1:15 UTC (permalink / raw)
  To: Greg KH, Jakub Kicinski
  Cc: linux-kernel, netdev, hannes, davem, akpm, Daniel Borkmann,
	Eric Dumazet, Minmin chen


On 2021/8/6 21:51, Greg KH wrote:
> On Fri, Aug 06, 2021 at 06:43:28AM -0700, Jakub Kicinski wrote:
>> On Fri, 6 Aug 2021 16:21:24 +0800 Kefeng Wang wrote:
>>> DO_ONCE
>>> DEFINE_STATIC_KEY_TRUE(___once_key);
>>> __do_once_done
>>>    once_disable_jump(once_key);
>>>      INIT_WORK(&w->work, once_deferred);
>>>      struct once_work *w;
>>>      w->key = key;
>>>      schedule_work(&w->work);                     module unload
>>>                                                     //*the key is
>>> destroy*
>>> process_one_work
>>>    once_deferred
>>>      BUG_ON(!static_key_enabled(work->key));
>>>         static_key_count((struct static_key *)x)    //*access key, crash*
>>>
>>> When module uses DO_ONCE mechanism, it could crash due to the above
>>> concurrency problem, we could reproduce it with link[1].
>>>
>>> Fix it by add/put module refcount in the once work process.
>>>
>>> [1] https://lore.kernel.org/netdev/eaa6c371-465e-57eb-6be9-f4b16b9d7cbf@huawei.com/
>> Seems reasonable. Greg does it look good to you?
> Me?  I was not paying attention to this at all, sorry...
>
>> I think we can take it thru networking since nobody cared to pick up v1.
Thanks all ;)
> Sure, I trust you :)
> .
>

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2021-08-09  1:15 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-06  8:21 [PATCH v2] once: Fix panic when module unload Kefeng Wang
2021-08-06 13:43 ` Jakub Kicinski
2021-08-06 13:51   ` Greg KH
2021-08-09  1:15     ` Kefeng Wang
2021-08-06 15:22 ` Hannes Frederic Sowa
2021-08-09  1:13   ` Kefeng Wang

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).