Re: [PATCH] livepatch: Fix leak on klp_init_patch_early failure path

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Thu, Dec 16, 2021 at 03:14:38PM +0100, Petr Mladek wrote:
> On Wed 2021-12-15 16:35:24, Greg Kroah-Hartman wrote:
> > On Wed, Dec 15, 2021 at 09:19:59AM +0100, Petr Mladek wrote:
> > > On Tue 2021-12-14 16:50:15, Greg Kroah-Hartman wrote:
> > > > 
> > > > kobject_init() does allocate things internally, where does it say it
> > > > does not?  What is trying to be "fixed" here?
> > > 
> > > Could you please show where things are allocated in kobject_init()?
> > > I do not see it in the code!
> > > 
> > > It looks to me like a cargo cult claim to me.
> > 
> > Hm, I thought I saw it yesterday when I reviewed the code.  Let me look
> > again...
> > 
> > > Documentation/core-api/kobject.rst says:
> > > 
> > >    Once you registered your kobject via kobject_add(), you must never use
> > >    kfree() to free it directly. The only safe way is to use kobject_put().
> > > 
> > > kobject_add() makes perfect sense because it copies the name, takes
> > > reference to the parent, etc.
> > > 
> > > kobject_init() just initializes the structure members and nothing else.
> > 
> > Now it does.  In the past, I think we did create some memory.  I know
> > when we hook debugobjects up to kobjects (there's an external patch for
> > that floating around somewhere), that is one reason to keep the
> > kobject_put() rule, and there might have been other reasons in the past
> > 20+ years as well.
> > 
> > So yes, while you are correct today, the "normal" reference counted
> > object model patern is "after the object is initialized, it MUST only be
> > freed by handling its reference count."  So let's stick to that rule for
> > now.
> 
> Good point.
> 
> 
> > If you want, I can put some code in the kobject_init() logic to force
> > this to be the case if it bothers you :)
> 
> I actually know about one case where this might be very useful.
> 
> There is the problem with kobject lifetime and module removal.
> module is removed after mod->exit() callback finishes. But some
> kobject release() callbacks might be delayed, especillay when
> CONFIG_DEBUG_KOBJECT_RELEASE is enabled.

Ick, modules and kobjects, just say no :)

> I have proposed there a solution where kobject_add_internal() takes reference
> on the module. It would make sure that the module will stay in the
> memory until the release callbacks is called, see
> https://lore.kernel.org/all/Ya84O2%2FnYCyNb%2Ffp@alley/

I don't want to add module pointers to kobjects.

kobjects are data.  modules are code.  Module references control code
lifespans.  Kobject references control data lifespans.  They are
different, so let us never mix the two please.

Yes, release callbacks are code, but if you really need to worry about
your release callback being unloaded, then just refuse to unload your
module until your data is all released!

The huge majority of kobject users never touch them directly, they use
the driver model, which should not have this issue.  Only code that
wants to touch kobjects in the "raw" have problems like this, and if you
want to mess with them at that level, you can handle the release data
issue.

Then there's the issue of static kobjects that are defined in code
(modules), but are treated as a reference count of data.  ick...

thanks,

greg k-h