/* * core.c - Kernel Live Patching Core * * Copyright (C) 2014 Seth Jennings <sjenning@redhat.com> * Copyright (C) 2014 SUSE * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, see <http://www.gnu.org/licenses/>. */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <linux/module.h>#include <linux/kernel.h>#include <linux/mutex.h>#include <linux/slab.h>#include <linux/list.h>#include <linux/kallsyms.h>#include <linux/livepatch.h>#include <linux/elf.h>#include <linux/moduleloader.h>#include <linux/completion.h>#include <asm/cacheflush.h>#include "core.h"#include "patch.h"#include "transition.h" /* * klp_mutex is a coarse lock which serializes access to klp data. All * accesses to klp-related variables and structures must have mutex protection, * except within the following functions which carefully avoid the need for it: * * - klp_ftrace_handler() * - klp_update_patch_state() */DEFINE_MUTEX(klp_mutex); /* * Actively used patches: enabled or in transition. Note that replaced * or disabled patches are not listed even though the related kernel * module still can be loaded. */LIST_HEAD(klp_patches); static struct kobject *klp_root_kobj; static bool klp_is_module(struct klp_object *obj){ return obj->name;} /* sets obj->mod if object is not vmlinux and module is found */static void klp_find_object_module(struct klp_object *obj){ struct module *mod; if (!klp_is_module(obj)) return; mutex_lock(&module_mutex); /* * We do not want to block removal of patched modules and therefore * we do not take a reference here. The patches are removed by * klp_module_going() instead. */ mod = find_module(obj->name); /* * Do not mess work of klp_module_coming() and klp_module_going(). * Note that the patch might still be needed before klp_module_going() * is called. Module functions can be called even in the GOING state * until mod->exit() finishes. This is especially important for * patches that modify semantic of the functions. */ if (mod && mod->klp_alive) obj->mod = mod; mutex_unlock(&module_mutex);} static bool klp_initialized(void){ return !!klp_root_kobj;} static struct klp_func *klp_find_func(struct klp_object *obj, struct klp_func *old_func){ struct klp_func *func; klp_for_each_func(obj, func) { if ((strcmp(old_func->old_name, func->old_name) == 0) && (old_func->old_sympos == func->old_sympos)) { return func; } } return NULL;} static struct klp_object *klp_find_object(struct klp_patch *patch, struct klp_object *old_obj){ struct klp_object *obj; klp_for_each_object(patch, obj) { if (klp_is_module(old_obj)) { if (klp_is_module(obj) && strcmp(old_obj->name, obj->name) == 0) { return obj; } } else if (!klp_is_module(obj)) { return obj; } } return NULL;} struct klp_find_arg { const char *objname; const char *name; unsigned long addr; unsigned long count; unsigned long pos;}; static int klp_find_callback(void *data, const char *name, struct module *mod, unsigned long addr){ struct klp_find_arg *args = data; if ((mod && !args->objname) || (!mod && args->objname)) return 0; if (strcmp(args->name, name)) return 0; if (args->objname && strcmp(args->objname, mod->name)) return 0; args->addr = addr; args->count++; /* * Finish the search when the symbol is found for the desired position * or the position is not defined for a non-unique symbol. */ if ((args->pos && (args->count == args->pos)) || (!args->pos && (args->count > 1))) return 1; return 0;} static int klp_find_object_symbol(const char *objname, const char *name, unsigned long sympos, unsigned long *addr){ struct klp_find_arg args = { .objname = objname, .name = name, .addr = 0, .count = 0, .pos = sympos, }; mutex_lock(&module_mutex); if (objname) module_kallsyms_on_each_symbol(klp_find_callback, &args); else kallsyms_on_each_symbol(klp_find_callback, &args); mutex_unlock(&module_mutex); /* * Ensure an address was found. If sympos is 0, ensure symbol is unique; * otherwise ensure the symbol position count matches sympos. */ if (args.addr == 0) pr_err("symbol '%s' not found in symbol table\n", name); else if (args.count > 1 && sympos == 0) { pr_err("unresolvable ambiguity for symbol '%s' in object '%s'\n", name, objname); } else if (sympos != args.count && sympos > 0) { pr_err("symbol position %lu for symbol '%s' in object '%s' not found\n", sympos, name, objname ? objname : "vmlinux"); } else { *addr = args.addr; return 0; } *addr = 0; return -EINVAL;} static int klp_resolve_symbols(Elf_Shdr *relasec, struct module *pmod){ int i, cnt, vmlinux, ret; char objname[MODULE_NAME_LEN]; char symname[KSYM_NAME_LEN]; char *strtab = pmod->core_kallsyms.strtab; Elf_Rela *relas; Elf_Sym *sym; unsigned long sympos, addr; /* * Since the field widths for objname and symname in the sscanf() * call are hard-coded and correspond to MODULE_NAME_LEN and * KSYM_NAME_LEN respectively, we must make sure that MODULE_NAME_LEN * and KSYM_NAME_LEN have the values we expect them to have. * * Because the value of MODULE_NAME_LEN can differ among architectures, * we use the smallest/strictest upper bound possible (56, based on * the current definition of MODULE_NAME_LEN) to prevent overflows. */ BUILD_BUG_ON(MODULE_NAME_LEN < 56 || KSYM_NAME_LEN != 128); relas = (Elf_Rela *) relasec->sh_addr; /* For each rela in this klp relocation section */ for (i = 0; i < relasec->sh_size / sizeof(Elf_Rela); i++) { sym = pmod->core_kallsyms.symtab + ELF_R_SYM(relas[i].r_info); if (sym->st_shndx != SHN_LIVEPATCH) { pr_err("symbol %s is not marked as a livepatch symbol\n", strtab + sym->st_name); return -EINVAL; } /* Format: .klp.sym.objname.symname,sympos */ cnt = sscanf(strtab + sym->st_name, ".klp.sym.%55[^.].%127[^,],%lu", objname, symname, &sympos); if (cnt != 3) { pr_err("symbol %s has an incorrectly formatted name\n", strtab + sym->st_name); return -EINVAL; } /* klp_find_object_symbol() treats a NULL objname as vmlinux */ vmlinux = !strcmp(objname, "vmlinux"); ret = klp_find_object_symbol(vmlinux ? NULL : objname, symname, sympos, &addr); if (ret) return ret; sym->st_value = addr; } return 0;} static int klp_write_object_relocations(struct module *pmod, struct klp_object *obj){ int i, cnt, ret = 0; const char *objname, *secname; char sec_objname[MODULE_NAME_LEN]; Elf_Shdr *sec; if (WARN_ON(!klp_is_object_loaded(obj))) return -EINVAL; objname = klp_is_module(obj) ? obj->name : "vmlinux"; /* For each klp relocation section */ for (i = 1; i < pmod->klp_info->hdr.e_shnum; i++) { sec = pmod->klp_info->sechdrs + i; secname = pmod->klp_info->secstrings + sec->sh_name; if (!(sec->sh_flags & SHF_RELA_LIVEPATCH)) continue; /* * Format: .klp.rela.sec_objname.section_name * See comment in klp_resolve_symbols() for an explanation * of the selected field width value. */ cnt = sscanf(secname, ".klp.rela.%55[^.]", sec_objname); if (cnt != 1) { pr_err("section %s has an incorrectly formatted name\n", secname); ret = -EINVAL; break; } if (strcmp(objname, sec_objname)) continue; ret = klp_resolve_symbols(sec, pmod); if (ret) break; ret = apply_relocate_add(pmod->klp_info->sechdrs, pmod->core_kallsyms.strtab, pmod->klp_info->symndx, i, pmod); if (ret) break; } return ret;} /* * Sysfs Interface * * /sys/kernel/livepatch * /sys/kernel/livepatch/<patch> * /sys/kernel/livepatch/<patch>/enabled * /sys/kernel/livepatch/<patch>/transition * /sys/kernel/livepatch/<patch>/force * /sys/kernel/livepatch/<patch>/<object> * /sys/kernel/livepatch/<patch>/<object>/<function,sympos> */static int __klp_disable_patch(struct klp_patch *patch); static ssize_t enabled_store(struct kobject *kobj, struct kobj_attribute *attr, const char *buf, size_t count){ struct klp_patch *patch; int ret; bool enabled; ret = kstrtobool(buf, &enabled); if (ret) return ret; patch = container_of(kobj, struct klp_patch, kobj); mutex_lock(&klp_mutex); if (patch->enabled == enabled) { /* already in requested state */ ret = -EINVAL; goto out; } /* * Allow to reverse a pending transition in both ways. It might be * necessary to complete the transition without forcing and breaking * the system integrity. * * Do not allow to re-enable a disabled patch. */ if (patch == klp_transition_patch) klp_reverse_transition(); else if (!enabled) ret = __klp_disable_patch(patch); else ret = -EINVAL; out: mutex_unlock(&klp_mutex); if (ret) return ret; return count;} static ssize_t enabled_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf){ struct klp_patch *patch; patch = container_of(kobj, struct klp_patch, kobj); return snprintf(buf, PAGE_SIZE-1, "%d\n", patch->enabled);} static ssize_t transition_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf){ struct klp_patch *patch; patch = container_of(kobj, struct klp_patch, kobj); return snprintf(buf, PAGE_SIZE-1, "%d\n", patch == klp_transition_patch);} static ssize_t force_store(struct kobject *kobj, struct kobj_attribute *attr, const char *buf, size_t count){ struct klp_patch *patch; int ret; bool val; ret = kstrtobool(buf, &val); if (ret) return ret; if (!val) return count; mutex_lock(&klp_mutex); patch = container_of(kobj, struct klp_patch, kobj); if (patch != klp_transition_patch) { mutex_unlock(&klp_mutex); return -EINVAL; } klp_force_transition(); mutex_unlock(&klp_mutex); return count;} static struct kobj_attribute enabled_kobj_attr = __ATTR_RW(enabled);static struct kobj_attribute transition_kobj_attr = __ATTR_RO(transition);static struct kobj_attribute force_kobj_attr = __ATTR_WO(force);static struct attribute *klp_patch_attrs[] = { &enabled_kobj_attr.attr, &transition_kobj_attr.attr, &force_kobj_attr.attr, NULL};ATTRIBUTE_GROUPS(klp_patch); static void klp_free_object_dynamic(struct klp_object *obj){ kfree(obj->name); kfree(obj);} static void klp_init_func_early(struct klp_object *obj, struct klp_func *func);static void klp_init_object_early(struct klp_patch *patch, struct klp_object *obj); static struct klp_object *klp_alloc_object_dynamic(const char *name, struct klp_patch *patch){ struct klp_object *obj; obj = kzalloc(sizeof(*obj), GFP_KERNEL); if (!obj) return NULL; if (name) { obj->name = kstrdup(name, GFP_KERNEL); if (!obj->name) { kfree(obj); return NULL; } } klp_init_object_early(patch, obj); obj->dynamic = true; return obj;} static void klp_free_func_nop(struct klp_func *func){ kfree(func->old_name); kfree(func);} static struct klp_func *klp_alloc_func_nop(struct klp_func *old_func, struct klp_object *obj){ struct klp_func *func; func = kzalloc(sizeof(*func), GFP_KERNEL); if (!func) return NULL; if (old_func->old_name) { func->old_name = kstrdup(old_func->old_name, GFP_KERNEL); if (!func->old_name) { kfree(func); return NULL; } } klp_init_func_early(obj, func); /* * func->new_func is same as func->old_func. These addresses are * set when the object is loaded, see klp_init_object_loaded(). */ func->old_sympos = old_func->old_sympos; func->nop = true; return func;} static int klp_add_object_nops(struct klp_patch *patch, struct klp_object *old_obj){ struct klp_object *obj; struct klp_func *func, *old_func; obj = klp_find_object(patch, old_obj); if (!obj) {Lines 1–500 of 1218. Load more
/* * core.c - Kernel Live Patching Core * * Copyright (C) 2014 Seth Jennings <sjenning@redhat.com> * Copyright (C) 2014 SUSE * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, see <http://www.gnu.org/licenses/>. */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <linux/module.h> #include <linux/kernel.h> #include <linux/mutex.h> #include <linux/slab.h> #include <linux/list.h> #include <linux/kallsyms.h> #include <linux/livepatch.h> #include <linux/elf.h> #include <linux/moduleloader.h> #include <linux/completion.h> #include <asm/cacheflush.h> #include "core.h" #include "patch.h" #include "transition.h" /* * klp_mutex is a coarse lock which serializes access to klp data. All * accesses to klp-related variables and structures must have mutex protection, * except within the following functions which carefully avoid the need for it: * * - klp_ftrace_handler() * - klp_update_patch_state() */ DEFINE_MUTEX(klp_mutex); /* * Actively used patches: enabled or in transition. Note that replaced * or disabled patches are not listed even though the related kernel * module still can be loaded. */ LIST_HEAD(klp_patches); static struct kobject *klp_root_kobj; static bool klp_is_module(struct klp_object *obj) { return obj->name; } /* sets obj->mod if object is not vmlinux and module is found */ static void klp_find_object_module(struct klp_object *obj) { struct module *mod; if (!klp_is_module(obj)) return; mutex_lock(&module_mutex); /* * We do not want to block removal of patched modules and therefore * we do not take a reference here. The patches are removed by * klp_module_going() instead. */ mod = find_module(obj->name); /* * Do not mess work of klp_module_coming() and klp_module_going(). * Note that the patch might still be needed before klp_module_going() * is called. Module functions can be called even in the GOING state * until mod->exit() finishes. This is especially important for * patches that modify semantic of the functions. */ if (mod && mod->klp_alive) obj->mod = mod; mutex_unlock(&module_mutex); } static bool klp_initialized(void) { return !!klp_root_kobj; } static struct klp_func *klp_find_func(struct klp_object *obj, struct klp_func *old_func) { struct klp_func *func; klp_for_each_func(obj, func) { if ((strcmp(old_func->old_name, func->old_name) == 0) && (old_func->old_sympos == func->old_sympos)) { return func; } } return NULL; } static struct klp_object *klp_find_object(struct klp_patch *patch, struct klp_object *old_obj) { struct klp_object *obj; klp_for_each_object(patch, obj) { if (klp_is_module(old_obj)) { if (klp_is_module(obj) && strcmp(old_obj->name, obj->name) == 0) { return obj; } } else if (!klp_is_module(obj)) { return obj; } } return NULL; } struct klp_find_arg { const char *objname; const char *name; unsigned long addr; unsigned long count; unsigned long pos; }; static int klp_find_callback(void *data, const char *name, struct module *mod, unsigned long addr) { struct klp_find_arg *args = data; if ((mod && !args->objname) || (!mod && args->objname)) return 0; if (strcmp(args->name, name)) return 0; if (args->objname && strcmp(args->objname, mod->name)) return 0; args->addr = addr; args->count++; /* * Finish the search when the symbol is found for the desired position * or the position is not defined for a non-unique symbol. */ if ((args->pos && (args->count == args->pos)) || (!args->pos && (args->count > 1))) return 1; return 0; } static int klp_find_object_symbol(const char *objname, const char *name, unsigned long sympos, unsigned long *addr) { struct klp_find_arg args = { .objname = objname, .name = name, .addr = 0, .count = 0, .pos = sympos, }; mutex_lock(&module_mutex); if (objname) module_kallsyms_on_each_symbol(klp_find_callback, &args); else kallsyms_on_each_symbol(klp_find_callback, &args); mutex_unlock(&module_mutex); /* * Ensure an address was found. If sympos is 0, ensure symbol is unique; * otherwise ensure the symbol position count matches sympos. */ if (args.addr == 0) pr_err("symbol '%s' not found in symbol table\n", name); else if (args.count > 1 && sympos == 0) { pr_err("unresolvable ambiguity for symbol '%s' in object '%s'\n", name, objname); } else if (sympos != args.count && sympos > 0) { pr_err("symbol position %lu for symbol '%s' in object '%s' not found\n", sympos, name, objname ? objname : "vmlinux"); } else { *addr = args.addr; return 0; } *addr = 0; return -EINVAL; } static int klp_resolve_symbols(Elf_Shdr *relasec, struct module *pmod) { int i, cnt, vmlinux, ret; char objname[MODULE_NAME_LEN]; char symname[KSYM_NAME_LEN]; char *strtab = pmod->core_kallsyms.strtab; Elf_Rela *relas; Elf_Sym *sym; unsigned long sympos, addr; /* * Since the field widths for objname and symname in the sscanf() * call are hard-coded and correspond to MODULE_NAME_LEN and * KSYM_NAME_LEN respectively, we must make sure that MODULE_NAME_LEN * and KSYM_NAME_LEN have the values we expect them to have. * * Because the value of MODULE_NAME_LEN can differ among architectures, * we use the smallest/strictest upper bound possible (56, based on * the current definition of MODULE_NAME_LEN) to prevent overflows. */ BUILD_BUG_ON(MODULE_NAME_LEN < 56 || KSYM_NAME_LEN != 128); relas = (Elf_Rela *) relasec->sh_addr; /* For each rela in this klp relocation section */ for (i = 0; i < relasec->sh_size / sizeof(Elf_Rela); i++) { sym = pmod->core_kallsyms.symtab + ELF_R_SYM(relas[i].r_info); if (sym->st_shndx != SHN_LIVEPATCH) { pr_err("symbol %s is not marked as a livepatch symbol\n", strtab + sym->st_name); return -EINVAL; } /* Format: .klp.sym.objname.symname,sympos */ cnt = sscanf(strtab + sym->st_name, ".klp.sym.%55[^.].%127[^,],%lu", objname, symname, &sympos); if (cnt != 3) { pr_err("symbol %s has an incorrectly formatted name\n", strtab + sym->st_name); return -EINVAL; } /* klp_find_object_symbol() treats a NULL objname as vmlinux */ vmlinux = !strcmp(objname, "vmlinux"); ret = klp_find_object_symbol(vmlinux ? NULL : objname, symname, sympos, &addr); if (ret) return ret; sym->st_value = addr; } return 0; } static int klp_write_object_relocations(struct module *pmod, struct klp_object *obj) { int i, cnt, ret = 0; const char *objname, *secname; char sec_objname[MODULE_NAME_LEN]; Elf_Shdr *sec; if (WARN_ON(!klp_is_object_loaded(obj))) return -EINVAL; objname = klp_is_module(obj) ? obj->name : "vmlinux"; /* For each klp relocation section */ for (i = 1; i < pmod->klp_info->hdr.e_shnum; i++) { sec = pmod->klp_info->sechdrs + i; secname = pmod->klp_info->secstrings + sec->sh_name; if (!(sec->sh_flags & SHF_RELA_LIVEPATCH)) continue; /* * Format: .klp.rela.sec_objname.section_name * See comment in klp_resolve_symbols() for an explanation * of the selected field width value. */ cnt = sscanf(secname, ".klp.rela.%55[^.]", sec_objname); if (cnt != 1) { pr_err("section %s has an incorrectly formatted name\n", secname); ret = -EINVAL; break; } if (strcmp(objname, sec_objname)) continue; ret = klp_resolve_symbols(sec, pmod); if (ret) break; ret = apply_relocate_add(pmod->klp_info->sechdrs, pmod->core_kallsyms.strtab, pmod->klp_info->symndx, i, pmod); if (ret) break; } return ret; } /* * Sysfs Interface * * /sys/kernel/livepatch * /sys/kernel/livepatch/<patch> * /sys/kernel/livepatch/<patch>/enabled * /sys/kernel/livepatch/<patch>/transition * /sys/kernel/livepatch/<patch>/force * /sys/kernel/livepatch/<patch>/<object> * /sys/kernel/livepatch/<patch>/<object>/<function,sympos> */ static int __klp_disable_patch(struct klp_patch *patch); static ssize_t enabled_store(struct kobject *kobj, struct kobj_attribute *attr, const char *buf, size_t count) { struct klp_patch *patch; int ret; bool enabled; ret = kstrtobool(buf, &enabled); if (ret) return ret; patch = container_of(kobj, struct klp_patch, kobj); mutex_lock(&klp_mutex); if (patch->enabled == enabled) { /* already in requested state */ ret = -EINVAL; goto out; } /* * Allow to reverse a pending transition in both ways. It might be * necessary to complete the transition without forcing and breaking * the system integrity. * * Do not allow to re-enable a disabled patch. */ if (patch == klp_transition_patch) klp_reverse_transition(); else if (!enabled) ret = __klp_disable_patch(patch); else ret = -EINVAL; out: mutex_unlock(&klp_mutex); if (ret) return ret; return count; } static ssize_t enabled_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) { struct klp_patch *patch; patch = container_of(kobj, struct klp_patch, kobj); return snprintf(buf, PAGE_SIZE-1, "%d\n", patch->enabled); } static ssize_t transition_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) { struct klp_patch *patch; patch = container_of(kobj, struct klp_patch, kobj); return snprintf(buf, PAGE_SIZE-1, "%d\n", patch == klp_transition_patch); } static ssize_t force_store(struct kobject *kobj, struct kobj_attribute *attr, const char *buf, size_t count) { struct klp_patch *patch; int ret; bool val; ret = kstrtobool(buf, &val); if (ret) return ret; if (!val) return count; mutex_lock(&klp_mutex); patch = container_of(kobj, struct klp_patch, kobj); if (patch != klp_transition_patch) { mutex_unlock(&klp_mutex); return -EINVAL; } klp_force_transition(); mutex_unlock(&klp_mutex); return count; } static struct kobj_attribute enabled_kobj_attr = __ATTR_RW(enabled); static struct kobj_attribute transition_kobj_attr = __ATTR_RO(transition); static struct kobj_attribute force_kobj_attr = __ATTR_WO(force); static struct attribute *klp_patch_attrs[] = { &enabled_kobj_attr.attr, &transition_kobj_attr.attr, &force_kobj_attr.attr, NULL }; ATTRIBUTE_GROUPS(klp_patch); static void klp_free_object_dynamic(struct klp_object *obj) { kfree(obj->name); kfree(obj); } static void klp_init_func_early(struct klp_object *obj, struct klp_func *func); static void klp_init_object_early(struct klp_patch *patch, struct klp_object *obj); static struct klp_object *klp_alloc_object_dynamic(const char *name, struct klp_patch *patch) { struct klp_object *obj; obj = kzalloc(sizeof(*obj), GFP_KERNEL); if (!obj) return NULL; if (name) { obj->name = kstrdup(name, GFP_KERNEL); if (!obj->name) { kfree(obj); return NULL; } } klp_init_object_early(patch, obj); obj->dynamic = true; return obj; } static void klp_free_func_nop(struct klp_func *func) { kfree(func->old_name); kfree(func); } static struct klp_func *klp_alloc_func_nop(struct klp_func *old_func, struct klp_object *obj) { struct klp_func *func; func = kzalloc(sizeof(*func), GFP_KERNEL); if (!func) return NULL; if (old_func->old_name) { func->old_name = kstrdup(old_func->old_name, GFP_KERNEL); if (!func->old_name) { kfree(func); return NULL; } } klp_init_func_early(obj, func); /* * func->new_func is same as func->old_func. These addresses are * set when the object is loaded, see klp_init_object_loaded(). */ func->old_sympos = old_func->old_sympos; func->nop = true; return func; } static int klp_add_object_nops(struct klp_patch *patch, struct klp_object *old_obj) { struct klp_object *obj; struct klp_func *func, *old_func; obj = klp_find_object(patch, old_obj); if (!obj) {