LXR linux/samples/livepatch/livepatch-shadow-fix1.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * Copyright (C) 2017 Joe Lawrence <joe.lawrence@redhat.com>
   4 */
   5
   6/*
   7 * livepatch-shadow-fix1.c - Shadow variables, livepatch demo
   8 *
   9 * Purpose
  10 * -------
  11 *
  12 * Fixes the memory leak introduced in livepatch-shadow-mod through the
  13 * use of a shadow variable.  This fix demonstrates the "extending" of
  14 * short-lived data structures by patching its allocation and release
  15 * functions.
  16 *
  17 *
  18 * Usage
  19 * -----
  20 *
  21 * This module is not intended to be standalone.  See the "Usage"
  22 * section of livepatch-shadow-mod.c.
  23 */
  24
  25#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  26
  27#include <linux/module.h>
  28#include <linux/kernel.h>
  29#include <linux/livepatch.h>
  30#include <linux/slab.h>
  31
  32/* Shadow variable enums */
  33#define SV_LEAK         1
  34
  35/* Allocate new dummies every second */
  36#define ALLOC_PERIOD    1
  37/* Check for expired dummies after a few new ones have been allocated */
  38#define CLEANUP_PERIOD  (3 * ALLOC_PERIOD)
  39/* Dummies expire after a few cleanup instances */
  40#define EXPIRE_PERIOD   (4 * CLEANUP_PERIOD)
  41
  42struct dummy {
  43        struct list_head list;
  44        unsigned long jiffies_expire;
  45};
  46
  47/*
  48 * The constructor makes more sense together with klp_shadow_get_or_alloc().
  49 * In this example, it would be safe to assign the pointer also to the shadow
  50 * variable returned by klp_shadow_alloc().  But we wanted to show the more
  51 * complicated use of the API.
  52 */
  53static int shadow_leak_ctor(void *obj, void *shadow_data, void *ctor_data)
  54{
  55        int **shadow_leak = shadow_data;
  56        int **leak = ctor_data;
  57
  58        if (!ctor_data)
  59                return -EINVAL;
  60
  61        *shadow_leak = *leak;
  62        return 0;
  63}
  64
  65static struct dummy *livepatch_fix1_dummy_alloc(void)
  66{
  67        struct dummy *d;
  68        int *leak;
  69        int **shadow_leak;
  70
  71        d = kzalloc(sizeof(*d), GFP_KERNEL);
  72        if (!d)
  73                return NULL;
  74
  75        d->jiffies_expire = jiffies +
  76                msecs_to_jiffies(1000 * EXPIRE_PERIOD);
  77
  78        /*
  79         * Patch: save the extra memory location into a SV_LEAK shadow
  80         * variable.  A patched dummy_free routine can later fetch this
  81         * pointer to handle resource release.
  82         */
  83        leak = kzalloc(sizeof(*leak), GFP_KERNEL);
  84        if (!leak)
  85                goto err_leak;
  86
  87        shadow_leak = klp_shadow_alloc(d, SV_LEAK, sizeof(leak), GFP_KERNEL,
  88                                       shadow_leak_ctor, &leak);
  89        if (!shadow_leak) {
  90                pr_err("%s: failed to allocate shadow variable for the leaking pointer: dummy @ %p, leak @ %p\n",
  91                       __func__, d, leak);
  92                goto err_shadow;
  93        }
  94
  95        pr_info("%s: dummy @ %p, expires @ %lx\n",
  96                __func__, d, d->jiffies_expire);
  97
  98        return d;
  99
 100err_shadow:
 101        kfree(leak);
 102err_leak:
 103        kfree(d);
 104        return NULL;
 105}
 106
 107static void livepatch_fix1_dummy_leak_dtor(void *obj, void *shadow_data)
 108{
 109        void *d = obj;
 110        int **shadow_leak = shadow_data;
 111
 112        kfree(*shadow_leak);
 113        pr_info("%s: dummy @ %p, prevented leak @ %p\n",
 114                         __func__, d, *shadow_leak);
 115}
 116
 117static void livepatch_fix1_dummy_free(struct dummy *d)
 118{
 119        int **shadow_leak;
 120
 121        /*
 122         * Patch: fetch the saved SV_LEAK shadow variable, detach and
 123         * free it.  Note: handle cases where this shadow variable does
 124         * not exist (ie, dummy structures allocated before this livepatch
 125         * was loaded.)
 126         */
 127        shadow_leak = klp_shadow_get(d, SV_LEAK);
 128        if (shadow_leak)
 129                klp_shadow_free(d, SV_LEAK, livepatch_fix1_dummy_leak_dtor);
 130        else
 131                pr_info("%s: dummy @ %p leaked!\n", __func__, d);
 132
 133        kfree(d);
 134}
 135
 136static struct klp_func funcs[] = {
 137        {
 138                .old_name = "dummy_alloc",
 139                .new_func = livepatch_fix1_dummy_alloc,
 140        },
 141        {
 142                .old_name = "dummy_free",
 143                .new_func = livepatch_fix1_dummy_free,
 144        }, { }
 145};
 146
 147static struct klp_object objs[] = {
 148        {
 149                .name = "livepatch_shadow_mod",
 150                .funcs = funcs,
 151        }, { }
 152};
 153
 154static struct klp_patch patch = {
 155        .mod = THIS_MODULE,
 156        .objs = objs,
 157};
 158
 159static int livepatch_shadow_fix1_init(void)
 160{
 161        return klp_enable_patch(&patch);
 162}
 163
 164static void livepatch_shadow_fix1_exit(void)
 165{
 166        /* Cleanup any existing SV_LEAK shadow variables */
 167        klp_shadow_free_all(SV_LEAK, livepatch_fix1_dummy_leak_dtor);
 168}
 169
 170module_init(livepatch_shadow_fix1_init);
 171module_exit(livepatch_shadow_fix1_exit);
 172MODULE_LICENSE("GPL");
 173MODULE_INFO(livepatch, "Y");
 174