livepatch-shadow-fix1.c 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * Copyright (C) 2017 Joe Lawrence <joe.lawrence@redhat.com>
  4. */
  5. /*
  6. * livepatch-shadow-fix1.c - Shadow variables, livepatch demo
  7. *
  8. * Purpose
  9. * -------
  10. *
  11. * Fixes the memory leak introduced in livepatch-shadow-mod through the
  12. * use of a shadow variable. This fix demonstrates the "extending" of
  13. * short-lived data structures by patching its allocation and release
  14. * functions.
  15. *
  16. *
  17. * Usage
  18. * -----
  19. *
  20. * This module is not intended to be standalone. See the "Usage"
  21. * section of livepatch-shadow-mod.c.
  22. */
  23. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  24. #include <linux/module.h>
  25. #include <linux/kernel.h>
  26. #include <linux/livepatch.h>
  27. #include <linux/slab.h>
  28. /* Shadow variable enums */
  29. #define SV_LEAK 1
  30. /* Allocate new dummies every second */
  31. #define ALLOC_PERIOD 1
  32. /* Check for expired dummies after a few new ones have been allocated */
  33. #define CLEANUP_PERIOD (3 * ALLOC_PERIOD)
  34. /* Dummies expire after a few cleanup instances */
  35. #define EXPIRE_PERIOD (4 * CLEANUP_PERIOD)
  36. struct dummy {
  37. struct list_head list;
  38. unsigned long jiffies_expire;
  39. };
  40. /*
  41. * The constructor makes more sense together with klp_shadow_get_or_alloc().
  42. * In this example, it would be safe to assign the pointer also to the shadow
  43. * variable returned by klp_shadow_alloc(). But we wanted to show the more
  44. * complicated use of the API.
  45. */
  46. static int shadow_leak_ctor(void *obj, void *shadow_data, void *ctor_data)
  47. {
  48. int **shadow_leak = shadow_data;
  49. int **leak = ctor_data;
  50. if (!ctor_data)
  51. return -EINVAL;
  52. *shadow_leak = *leak;
  53. return 0;
  54. }
  55. static struct dummy *livepatch_fix1_dummy_alloc(void)
  56. {
  57. struct dummy *d;
  58. int *leak;
  59. int **shadow_leak;
  60. d = kzalloc(sizeof(*d), GFP_KERNEL);
  61. if (!d)
  62. return NULL;
  63. d->jiffies_expire = jiffies +
  64. msecs_to_jiffies(1000 * EXPIRE_PERIOD);
  65. /*
  66. * Patch: save the extra memory location into a SV_LEAK shadow
  67. * variable. A patched dummy_free routine can later fetch this
  68. * pointer to handle resource release.
  69. */
  70. leak = kzalloc(sizeof(*leak), GFP_KERNEL);
  71. if (!leak)
  72. goto err_leak;
  73. shadow_leak = klp_shadow_alloc(d, SV_LEAK, sizeof(leak), GFP_KERNEL,
  74. shadow_leak_ctor, &leak);
  75. if (!shadow_leak) {
  76. pr_err("%s: failed to allocate shadow variable for the leaking pointer: dummy @ %p, leak @ %p\n",
  77. __func__, d, leak);
  78. goto err_shadow;
  79. }
  80. pr_info("%s: dummy @ %p, expires @ %lx\n",
  81. __func__, d, d->jiffies_expire);
  82. return d;
  83. err_shadow:
  84. kfree(leak);
  85. err_leak:
  86. kfree(d);
  87. return NULL;
  88. }
  89. static void livepatch_fix1_dummy_leak_dtor(void *obj, void *shadow_data)
  90. {
  91. void *d = obj;
  92. int **shadow_leak = shadow_data;
  93. kfree(*shadow_leak);
  94. pr_info("%s: dummy @ %p, prevented leak @ %p\n",
  95. __func__, d, *shadow_leak);
  96. }
  97. static void livepatch_fix1_dummy_free(struct dummy *d)
  98. {
  99. int **shadow_leak;
  100. /*
  101. * Patch: fetch the saved SV_LEAK shadow variable, detach and
  102. * free it. Note: handle cases where this shadow variable does
  103. * not exist (ie, dummy structures allocated before this livepatch
  104. * was loaded.)
  105. */
  106. shadow_leak = klp_shadow_get(d, SV_LEAK);
  107. if (shadow_leak)
  108. klp_shadow_free(d, SV_LEAK, livepatch_fix1_dummy_leak_dtor);
  109. else
  110. pr_info("%s: dummy @ %p leaked!\n", __func__, d);
  111. kfree(d);
  112. }
  113. static struct klp_func funcs[] = {
  114. {
  115. .old_name = "dummy_alloc",
  116. .new_func = livepatch_fix1_dummy_alloc,
  117. },
  118. {
  119. .old_name = "dummy_free",
  120. .new_func = livepatch_fix1_dummy_free,
  121. }, { }
  122. };
  123. static struct klp_object objs[] = {
  124. {
  125. .name = "livepatch_shadow_mod",
  126. .funcs = funcs,
  127. }, { }
  128. };
  129. static struct klp_patch patch = {
  130. .mod = THIS_MODULE,
  131. .objs = objs,
  132. };
  133. static int livepatch_shadow_fix1_init(void)
  134. {
  135. return klp_enable_patch(&patch);
  136. }
  137. static void livepatch_shadow_fix1_exit(void)
  138. {
  139. /* Cleanup any existing SV_LEAK shadow variables */
  140. klp_shadow_free_all(SV_LEAK, livepatch_fix1_dummy_leak_dtor);
  141. }
  142. module_init(livepatch_shadow_fix1_init);
  143. module_exit(livepatch_shadow_fix1_exit);
  144. MODULE_LICENSE("GPL");
  145. MODULE_INFO(livepatch, "Y");