[PATCH v2 0/2] lkdtm: update block layer crashpoints

[PATCH v2 0/2] lkdtm: update block layer crashpoints

[Kevin Mitchell]

This is v2 of https://lkml.org/lkml/2021/8/16/1497.

These patches update the lkdtm crashpoints in the block layer that have been
moved or removed.  In response to feedback, I've renamed the SCSI_DISPATCH_CMD
crashpoint to SCSI_QUEUE_RQ to correspond to the new function that it hooks
into. I have also added a commit to remove IDE_CORE_CP.

[PATCH v2 1/2] lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ

[Kevin Mitchell]

When scsi_dispatch_cmd was moved to scsi_lib.c and made static, some
compilers (i.e., at least gcc 8.4.0) decided to compile this
inline. This is a problem for lkdtm.ko, which inserted a kprobe
on this function for the SCSI_DISPATCH_CMD crashpoint.

Move this crashpoint one function up the call chain to
scsi_queue_rq. Though this is also a static function, it should never be
inlined because it is assigned as a structure entry. Therefore,
kprobe_register should always be able to find it.

Fixes: 82042a2cdb55 ("scsi: move scsi_dispatch_cmd to scsi_lib.c")
Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
---
 Documentation/fault-injection/provoke-crashes.rst | 2 +-
 drivers/misc/lkdtm/core.c                         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst
index a20ba5d93932..18de17354206 100644
--- a/Documentation/fault-injection/provoke-crashes.rst
+++ b/Documentation/fault-injection/provoke-crashes.rst
@@ -29,7 +29,7 @@ recur_count
 cpoint_name
 	Where in the kernel to trigger the action. It can be
 	one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
-	FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_DISPATCH_CMD,
+	FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ,
 	IDE_CORE_CP, or DIRECT
 
 cpoint_type
diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
index 9dda87c6b54a..016cb0b150fc 100644
--- a/drivers/misc/lkdtm/core.c
+++ b/drivers/misc/lkdtm/core.c
@@ -82,7 +82,7 @@ static struct crashpoint crashpoints[] = {
 	CRASHPOINT("FS_DEVRW",		 "ll_rw_block"),
 	CRASHPOINT("MEM_SWAPOUT",	 "shrink_inactive_list"),
 	CRASHPOINT("TIMERADD",		 "hrtimer_start"),
-	CRASHPOINT("SCSI_DISPATCH_CMD",	 "scsi_dispatch_cmd"),
+	CRASHPOINT("SCSI_QUEUE_RQ",	 "scsi_queue_rq"),
 	CRASHPOINT("IDE_CORE_CP",	 "generic_ide_ioctl"),
 #endif
 };
-- 
2.32.0

[PATCH v2 2/2] lkdtm: remove IDE_CORE_CP crashpoint

[Kevin Mitchell]

With the removal of the legacy IDE driver in kb7fb14d3ac63 ("ide: remove
the legacy ide driver"), this crashpoint no longer points to a valid
function.

Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
---
 Documentation/fault-injection/provoke-crashes.rst | 3 +--
 drivers/misc/lkdtm/core.c                         | 1 -
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst
index 18de17354206..3abe84225613 100644
--- a/Documentation/fault-injection/provoke-crashes.rst
+++ b/Documentation/fault-injection/provoke-crashes.rst
@@ -29,8 +29,7 @@ recur_count
 cpoint_name
 	Where in the kernel to trigger the action. It can be
 	one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
-	FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ,
-	IDE_CORE_CP, or DIRECT
+	FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT.
 
 cpoint_type
 	Indicates the action to be taken on hitting the crash point.
diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
index 016cb0b150fc..e50e7bfc4674 100644
--- a/drivers/misc/lkdtm/core.c
+++ b/drivers/misc/lkdtm/core.c
@@ -83,7 +83,6 @@ static struct crashpoint crashpoints[] = {
 	CRASHPOINT("MEM_SWAPOUT",	 "shrink_inactive_list"),
 	CRASHPOINT("TIMERADD",		 "hrtimer_start"),
 	CRASHPOINT("SCSI_QUEUE_RQ",	 "scsi_queue_rq"),
-	CRASHPOINT("IDE_CORE_CP",	 "generic_ide_ioctl"),
 #endif
 };
 
-- 
2.32.0

Re: [PATCH v2 1/2] lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ

[Kees Cook]

On Wed, Aug 18, 2021 at 07:29:39PM -0700, Kevin Mitchell wrote:
> When scsi_dispatch_cmd was moved to scsi_lib.c and made static, some
> compilers (i.e., at least gcc 8.4.0) decided to compile this
> inline. This is a problem for lkdtm.ko, which inserted a kprobe
> on this function for the SCSI_DISPATCH_CMD crashpoint.
> 
> Move this crashpoint one function up the call chain to
> scsi_queue_rq. Though this is also a static function, it should never be
> inlined because it is assigned as a structure entry. Therefore,
> kprobe_register should always be able to find it.
> 
> Fixes: 82042a2cdb55 ("scsi: move scsi_dispatch_cmd to scsi_lib.c")
> Signed-off-by: Kevin Mitchell <kevmitch@arista.com>

Thanks!

Acked-by: Kees Cook <keescook@chromium.org>

-Kees

> ---
>  Documentation/fault-injection/provoke-crashes.rst | 2 +-
>  drivers/misc/lkdtm/core.c                         | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst
> index a20ba5d93932..18de17354206 100644
> --- a/Documentation/fault-injection/provoke-crashes.rst
> +++ b/Documentation/fault-injection/provoke-crashes.rst
> @@ -29,7 +29,7 @@ recur_count
>  cpoint_name
>  	Where in the kernel to trigger the action. It can be
>  	one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
> -	FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_DISPATCH_CMD,
> +	FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ,
>  	IDE_CORE_CP, or DIRECT
>  
>  cpoint_type
> diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
> index 9dda87c6b54a..016cb0b150fc 100644
> --- a/drivers/misc/lkdtm/core.c
> +++ b/drivers/misc/lkdtm/core.c
> @@ -82,7 +82,7 @@ static struct crashpoint crashpoints[] = {
>  	CRASHPOINT("FS_DEVRW",		 "ll_rw_block"),
>  	CRASHPOINT("MEM_SWAPOUT",	 "shrink_inactive_list"),
>  	CRASHPOINT("TIMERADD",		 "hrtimer_start"),
> -	CRASHPOINT("SCSI_DISPATCH_CMD",	 "scsi_dispatch_cmd"),
> +	CRASHPOINT("SCSI_QUEUE_RQ",	 "scsi_queue_rq"),
>  	CRASHPOINT("IDE_CORE_CP",	 "generic_ide_ioctl"),
>  #endif
>  };
> -- 
> 2.32.0
> 

-- 
Kees Cook

Re: [PATCH v2 2/2] lkdtm: remove IDE_CORE_CP crashpoint

[Kees Cook]

On Wed, Aug 18, 2021 at 07:29:40PM -0700, Kevin Mitchell wrote:
> With the removal of the legacy IDE driver in kb7fb14d3ac63 ("ide: remove
> the legacy ide driver"), this crashpoint no longer points to a valid
> function.
> 
> Signed-off-by: Kevin Mitchell <kevmitch@arista.com>

Hah, whoops. Yes. :)

Acked-by: Kees Cook <keescook@chromium.org>

Thanks!

-Kees

> ---
>  Documentation/fault-injection/provoke-crashes.rst | 3 +--
>  drivers/misc/lkdtm/core.c                         | 1 -
>  2 files changed, 1 insertion(+), 3 deletions(-)
> 
> diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst
> index 18de17354206..3abe84225613 100644
> --- a/Documentation/fault-injection/provoke-crashes.rst
> +++ b/Documentation/fault-injection/provoke-crashes.rst
> @@ -29,8 +29,7 @@ recur_count
>  cpoint_name
>  	Where in the kernel to trigger the action. It can be
>  	one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
> -	FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ,
> -	IDE_CORE_CP, or DIRECT
> +	FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ, or DIRECT.
>  
>  cpoint_type
>  	Indicates the action to be taken on hitting the crash point.
> diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
> index 016cb0b150fc..e50e7bfc4674 100644
> --- a/drivers/misc/lkdtm/core.c
> +++ b/drivers/misc/lkdtm/core.c
> @@ -83,7 +83,6 @@ static struct crashpoint crashpoints[] = {
>  	CRASHPOINT("MEM_SWAPOUT",	 "shrink_inactive_list"),
>  	CRASHPOINT("TIMERADD",		 "hrtimer_start"),
>  	CRASHPOINT("SCSI_QUEUE_RQ",	 "scsi_queue_rq"),
> -	CRASHPOINT("IDE_CORE_CP",	 "generic_ide_ioctl"),
>  #endif
>  };
>  
> -- 
> 2.32.0
> 

-- 
Kees Cook

Re: [PATCH v2 1/2] lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ

[Christoph Hellwig]

Looks good,

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH v2 2/2] lkdtm: remove IDE_CORE_CP crashpoint

[Christoph Hellwig]

Looks good,

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH v2 0/2] lkdtm: update block layer crashpoints

[Kees Cook]

Hi Greg,

You weren't explicitly in the To: for this series (only Cc), but are
you able to pick these up as well? I can resend them as a pull request
if you need.

Thanks!

-Kees

On Wed, Aug 18, 2021 at 07:29:38PM -0700, Kevin Mitchell wrote:
> This is v2 of https://lkml.org/lkml/2021/8/16/1497.
> 
> These patches update the lkdtm crashpoints in the block layer that have been
> moved or removed.  In response to feedback, I've renamed the SCSI_DISPATCH_CMD
> crashpoint to SCSI_QUEUE_RQ to correspond to the new function that it hooks
> into. I have also added a commit to remove IDE_CORE_CP.
> 
> 

-- 
Kees Cook

Re: [PATCH v2 0/2] lkdtm: update block layer crashpoints

[Martin K. Petersen]

Kevin,

> This is v2 of https://lkml.org/lkml/2021/8/16/1497.
>
> These patches update the lkdtm crashpoints in the block layer that
> have been moved or removed.  In response to feedback, I've renamed the
> SCSI_DISPATCH_CMD crashpoint to SCSI_QUEUE_RQ to correspond to the new
> function that it hooks into. I have also added a commit to remove
> IDE_CORE_CP.

These look good to me.

Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>

-- 
Martin K. Petersen	Oracle Linux Engineering