Loading...
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * core.c - Kernel Live Patching Core
4 *
5 * Copyright (C) 2014 Seth Jennings <sjenning@redhat.com>
6 * Copyright (C) 2014 SUSE
7 */
8
9#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10
11#include <linux/module.h>
12#include <linux/kernel.h>
13#include <linux/mutex.h>
14#include <linux/slab.h>
15#include <linux/list.h>
16#include <linux/kallsyms.h>
17#include <linux/livepatch.h>
18#include <linux/elf.h>
19#include <linux/moduleloader.h>
20#include <linux/completion.h>
21#include <linux/memory.h>
22#include <linux/rcupdate.h>
23#include <asm/cacheflush.h>
24#include "core.h"
25#include "patch.h"
26#include "state.h"
27#include "transition.h"
28
29/*
30 * klp_mutex is a coarse lock which serializes access to klp data. All
31 * accesses to klp-related variables and structures must have mutex protection,
32 * except within the following functions which carefully avoid the need for it:
33 *
34 * - klp_ftrace_handler()
35 * - klp_update_patch_state()
36 * - __klp_sched_try_switch()
37 */
38DEFINE_MUTEX(klp_mutex);
39
40/*
41 * Actively used patches: enabled or in transition. Note that replaced
42 * or disabled patches are not listed even though the related kernel
43 * module still can be loaded.
44 */
45LIST_HEAD(klp_patches);
46
47static struct kobject *klp_root_kobj;
48
49static bool klp_is_module(struct klp_object *obj)
50{
51 return obj->name;
52}
53
54/* sets obj->mod if object is not vmlinux and module is found */
55static void klp_find_object_module(struct klp_object *obj)
56{
57 struct module *mod;
58
59 if (!klp_is_module(obj))
60 return;
61
62 rcu_read_lock_sched();
63 /*
64 * We do not want to block removal of patched modules and therefore
65 * we do not take a reference here. The patches are removed by
66 * klp_module_going() instead.
67 */
68 mod = find_module(obj->name);
69 /*
70 * Do not mess work of klp_module_coming() and klp_module_going().
71 * Note that the patch might still be needed before klp_module_going()
72 * is called. Module functions can be called even in the GOING state
73 * until mod->exit() finishes. This is especially important for
74 * patches that modify semantic of the functions.
75 */
76 if (mod && mod->klp_alive)
77 obj->mod = mod;
78
79 rcu_read_unlock_sched();
80}
81
82static bool klp_initialized(void)
83{
84 return !!klp_root_kobj;
85}
86
87static struct klp_func *klp_find_func(struct klp_object *obj,
88 struct klp_func *old_func)
89{
90 struct klp_func *func;
91
92 klp_for_each_func(obj, func) {
93 if ((strcmp(old_func->old_name, func->old_name) == 0) &&
94 (old_func->old_sympos == func->old_sympos)) {
95 return func;
96 }
97 }
98
99 return NULL;
100}
101
102static struct klp_object *klp_find_object(struct klp_patch *patch,
103 struct klp_object *old_obj)
104{
105 struct klp_object *obj;
106
107 klp_for_each_object(patch, obj) {
108 if (klp_is_module(old_obj)) {
109 if (klp_is_module(obj) &&
110 strcmp(old_obj->name, obj->name) == 0) {
111 return obj;
112 }
113 } else if (!klp_is_module(obj)) {
114 return obj;
115 }
116 }
117
118 return NULL;
119}
120
121struct klp_find_arg {
122 const char *name;
123 unsigned long addr;
124 unsigned long count;
125 unsigned long pos;
126};
127
128static int klp_match_callback(void *data, unsigned long addr)
129{
130 struct klp_find_arg *args = data;
131
132 args->addr = addr;
133 args->count++;
134
135 /*
136 * Finish the search when the symbol is found for the desired position
137 * or the position is not defined for a non-unique symbol.
138 */
139 if ((args->pos && (args->count == args->pos)) ||
140 (!args->pos && (args->count > 1)))
141 return 1;
142
143 return 0;
144}
145
146static int klp_find_callback(void *data, const char *name, unsigned long addr)
147{
148 struct klp_find_arg *args = data;
149
150 if (strcmp(args->name, name))
151 return 0;
152
153 return klp_match_callback(data, addr);
154}
155
156static int klp_find_object_symbol(const char *objname, const char *name,
157 unsigned long sympos, unsigned long *addr)
158{
159 struct klp_find_arg args = {
160 .name = name,
161 .addr = 0,
162 .count = 0,
163 .pos = sympos,
164 };
165
166 if (objname)
167 module_kallsyms_on_each_symbol(objname, klp_find_callback, &args);
168 else
169 kallsyms_on_each_match_symbol(klp_match_callback, name, &args);
170
171 /*
172 * Ensure an address was found. If sympos is 0, ensure symbol is unique;
173 * otherwise ensure the symbol position count matches sympos.
174 */
175 if (args.addr == 0)
176 pr_err("symbol '%s' not found in symbol table\n", name);
177 else if (args.count > 1 && sympos == 0) {
178 pr_err("unresolvable ambiguity for symbol '%s' in object '%s'\n",
179 name, objname);
180 } else if (sympos != args.count && sympos > 0) {
181 pr_err("symbol position %lu for symbol '%s' in object '%s' not found\n",
182 sympos, name, objname ? objname : "vmlinux");
183 } else {
184 *addr = args.addr;
185 return 0;
186 }
187
188 *addr = 0;
189 return -EINVAL;
190}
191
192static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab,
193 unsigned int symndx, Elf_Shdr *relasec,
194 const char *sec_objname)
195{
196 int i, cnt, ret;
197 char sym_objname[MODULE_NAME_LEN];
198 char sym_name[KSYM_NAME_LEN];
199 Elf_Rela *relas;
200 Elf_Sym *sym;
201 unsigned long sympos, addr;
202 bool sym_vmlinux;
203 bool sec_vmlinux = !strcmp(sec_objname, "vmlinux");
204
205 /*
206 * Since the field widths for sym_objname and sym_name in the sscanf()
207 * call are hard-coded and correspond to MODULE_NAME_LEN and
208 * KSYM_NAME_LEN respectively, we must make sure that MODULE_NAME_LEN
209 * and KSYM_NAME_LEN have the values we expect them to have.
210 *
211 * Because the value of MODULE_NAME_LEN can differ among architectures,
212 * we use the smallest/strictest upper bound possible (56, based on
213 * the current definition of MODULE_NAME_LEN) to prevent overflows.
214 */
215 BUILD_BUG_ON(MODULE_NAME_LEN < 56 || KSYM_NAME_LEN != 512);
216
217 relas = (Elf_Rela *) relasec->sh_addr;
218 /* For each rela in this klp relocation section */
219 for (i = 0; i < relasec->sh_size / sizeof(Elf_Rela); i++) {
220 sym = (Elf_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info);
221 if (sym->st_shndx != SHN_LIVEPATCH) {
222 pr_err("symbol %s is not marked as a livepatch symbol\n",
223 strtab + sym->st_name);
224 return -EINVAL;
225 }
226
227 /* Format: .klp.sym.sym_objname.sym_name,sympos */
228 cnt = sscanf(strtab + sym->st_name,
229 ".klp.sym.%55[^.].%511[^,],%lu",
230 sym_objname, sym_name, &sympos);
231 if (cnt != 3) {
232 pr_err("symbol %s has an incorrectly formatted name\n",
233 strtab + sym->st_name);
234 return -EINVAL;
235 }
236
237 sym_vmlinux = !strcmp(sym_objname, "vmlinux");
238
239 /*
240 * Prevent module-specific KLP rela sections from referencing
241 * vmlinux symbols. This helps prevent ordering issues with
242 * module special section initializations. Presumably such
243 * symbols are exported and normal relas can be used instead.
244 */
245 if (!sec_vmlinux && sym_vmlinux) {
246 pr_err("invalid access to vmlinux symbol '%s' from module-specific livepatch relocation section\n",
247 sym_name);
248 return -EINVAL;
249 }
250
251 /* klp_find_object_symbol() treats a NULL objname as vmlinux */
252 ret = klp_find_object_symbol(sym_vmlinux ? NULL : sym_objname,
253 sym_name, sympos, &addr);
254 if (ret)
255 return ret;
256
257 sym->st_value = addr;
258 }
259
260 return 0;
261}
262
263void __weak clear_relocate_add(Elf_Shdr *sechdrs,
264 const char *strtab,
265 unsigned int symindex,
266 unsigned int relsec,
267 struct module *me)
268{
269}
270
271/*
272 * At a high-level, there are two types of klp relocation sections: those which
273 * reference symbols which live in vmlinux; and those which reference symbols
274 * which live in other modules. This function is called for both types:
275 *
276 * 1) When a klp module itself loads, the module code calls this function to
277 * write vmlinux-specific klp relocations (.klp.rela.vmlinux.* sections).
278 * These relocations are written to the klp module text to allow the patched
279 * code/data to reference unexported vmlinux symbols. They're written as
280 * early as possible to ensure that other module init code (.e.g.,
281 * jump_label_apply_nops) can access any unexported vmlinux symbols which
282 * might be referenced by the klp module's special sections.
283 *
284 * 2) When a to-be-patched module loads -- or is already loaded when a
285 * corresponding klp module loads -- klp code calls this function to write
286 * module-specific klp relocations (.klp.rela.{module}.* sections). These
287 * are written to the klp module text to allow the patched code/data to
288 * reference symbols which live in the to-be-patched module or one of its
289 * module dependencies. Exported symbols are supported, in addition to
290 * unexported symbols, in order to enable late module patching, which allows
291 * the to-be-patched module to be loaded and patched sometime *after* the
292 * klp module is loaded.
293 */
294static int klp_write_section_relocs(struct module *pmod, Elf_Shdr *sechdrs,
295 const char *shstrtab, const char *strtab,
296 unsigned int symndx, unsigned int secndx,
297 const char *objname, bool apply)
298{
299 int cnt, ret;
300 char sec_objname[MODULE_NAME_LEN];
301 Elf_Shdr *sec = sechdrs + secndx;
302
303 /*
304 * Format: .klp.rela.sec_objname.section_name
305 * See comment in klp_resolve_symbols() for an explanation
306 * of the selected field width value.
307 */
308 cnt = sscanf(shstrtab + sec->sh_name, ".klp.rela.%55[^.]",
309 sec_objname);
310 if (cnt != 1) {
311 pr_err("section %s has an incorrectly formatted name\n",
312 shstrtab + sec->sh_name);
313 return -EINVAL;
314 }
315
316 if (strcmp(objname ? objname : "vmlinux", sec_objname))
317 return 0;
318
319 if (apply) {
320 ret = klp_resolve_symbols(sechdrs, strtab, symndx,
321 sec, sec_objname);
322 if (ret)
323 return ret;
324
325 return apply_relocate_add(sechdrs, strtab, symndx, secndx, pmod);
326 }
327
328 clear_relocate_add(sechdrs, strtab, symndx, secndx, pmod);
329 return 0;
330}
331
332int klp_apply_section_relocs(struct module *pmod, Elf_Shdr *sechdrs,
333 const char *shstrtab, const char *strtab,
334 unsigned int symndx, unsigned int secndx,
335 const char *objname)
336{
337 return klp_write_section_relocs(pmod, sechdrs, shstrtab, strtab, symndx,
338 secndx, objname, true);
339}
340
341/*
342 * Sysfs Interface
343 *
344 * /sys/kernel/livepatch
345 * /sys/kernel/livepatch/<patch>
346 * /sys/kernel/livepatch/<patch>/enabled
347 * /sys/kernel/livepatch/<patch>/transition
348 * /sys/kernel/livepatch/<patch>/force
349 * /sys/kernel/livepatch/<patch>/replace
350 * /sys/kernel/livepatch/<patch>/<object>
351 * /sys/kernel/livepatch/<patch>/<object>/patched
352 * /sys/kernel/livepatch/<patch>/<object>/<function,sympos>
353 */
354static int __klp_disable_patch(struct klp_patch *patch);
355
356static ssize_t enabled_store(struct kobject *kobj, struct kobj_attribute *attr,
357 const char *buf, size_t count)
358{
359 struct klp_patch *patch;
360 int ret;
361 bool enabled;
362
363 ret = kstrtobool(buf, &enabled);
364 if (ret)
365 return ret;
366
367 patch = container_of(kobj, struct klp_patch, kobj);
368
369 mutex_lock(&klp_mutex);
370
371 if (patch->enabled == enabled) {
372 /* already in requested state */
373 ret = -EINVAL;
374 goto out;
375 }
376
377 /*
378 * Allow to reverse a pending transition in both ways. It might be
379 * necessary to complete the transition without forcing and breaking
380 * the system integrity.
381 *
382 * Do not allow to re-enable a disabled patch.
383 */
384 if (patch == klp_transition_patch)
385 klp_reverse_transition();
386 else if (!enabled)
387 ret = __klp_disable_patch(patch);
388 else
389 ret = -EINVAL;
390
391out:
392 mutex_unlock(&klp_mutex);
393
394 if (ret)
395 return ret;
396 return count;
397}
398
399static ssize_t enabled_show(struct kobject *kobj,
400 struct kobj_attribute *attr, char *buf)
401{
402 struct klp_patch *patch;
403
404 patch = container_of(kobj, struct klp_patch, kobj);
405 return sysfs_emit(buf, "%d\n", patch->enabled);
406}
407
408static ssize_t transition_show(struct kobject *kobj,
409 struct kobj_attribute *attr, char *buf)
410{
411 struct klp_patch *patch;
412
413 patch = container_of(kobj, struct klp_patch, kobj);
414 return sysfs_emit(buf, "%d\n", patch == klp_transition_patch);
415}
416
417static ssize_t force_store(struct kobject *kobj, struct kobj_attribute *attr,
418 const char *buf, size_t count)
419{
420 struct klp_patch *patch;
421 int ret;
422 bool val;
423
424 ret = kstrtobool(buf, &val);
425 if (ret)
426 return ret;
427
428 if (!val)
429 return count;
430
431 mutex_lock(&klp_mutex);
432
433 patch = container_of(kobj, struct klp_patch, kobj);
434 if (patch != klp_transition_patch) {
435 mutex_unlock(&klp_mutex);
436 return -EINVAL;
437 }
438
439 klp_force_transition();
440
441 mutex_unlock(&klp_mutex);
442
443 return count;
444}
445
446static ssize_t replace_show(struct kobject *kobj,
447 struct kobj_attribute *attr, char *buf)
448{
449 struct klp_patch *patch;
450
451 patch = container_of(kobj, struct klp_patch, kobj);
452 return sysfs_emit(buf, "%d\n", patch->replace);
453}
454
455static struct kobj_attribute enabled_kobj_attr = __ATTR_RW(enabled);
456static struct kobj_attribute transition_kobj_attr = __ATTR_RO(transition);
457static struct kobj_attribute force_kobj_attr = __ATTR_WO(force);
458static struct kobj_attribute replace_kobj_attr = __ATTR_RO(replace);
459static struct attribute *klp_patch_attrs[] = {
460 &enabled_kobj_attr.attr,
461 &transition_kobj_attr.attr,
462 &force_kobj_attr.attr,
463 &replace_kobj_attr.attr,
464 NULL
465};
466ATTRIBUTE_GROUPS(klp_patch);
467
468static ssize_t patched_show(struct kobject *kobj,
469 struct kobj_attribute *attr, char *buf)
470{
471 struct klp_object *obj;
472
473 obj = container_of(kobj, struct klp_object, kobj);
474 return sysfs_emit(buf, "%d\n", obj->patched);
475}
476
477static struct kobj_attribute patched_kobj_attr = __ATTR_RO(patched);
478static struct attribute *klp_object_attrs[] = {
479 &patched_kobj_attr.attr,
480 NULL,
481};
482ATTRIBUTE_GROUPS(klp_object);
483
484static void klp_free_object_dynamic(struct klp_object *obj)
485{
486 kfree(obj->name);
487 kfree(obj);
488}
489
490static void klp_init_func_early(struct klp_object *obj,
491 struct klp_func *func);
492static void klp_init_object_early(struct klp_patch *patch,
493 struct klp_object *obj);
494
495static struct klp_object *klp_alloc_object_dynamic(const char *name,
496 struct klp_patch *patch)
497{
498 struct klp_object *obj;
499
500 obj = kzalloc(sizeof(*obj), GFP_KERNEL);
501 if (!obj)
502 return NULL;
503
504 if (name) {
505 obj->name = kstrdup(name, GFP_KERNEL);
506 if (!obj->name) {
507 kfree(obj);
508 return NULL;
509 }
510 }
511
512 klp_init_object_early(patch, obj);
513 obj->dynamic = true;
514
515 return obj;
516}
517
518static void klp_free_func_nop(struct klp_func *func)
519{
520 kfree(func->old_name);
521 kfree(func);
522}
523
524static struct klp_func *klp_alloc_func_nop(struct klp_func *old_func,
525 struct klp_object *obj)
526{
527 struct klp_func *func;
528
529 func = kzalloc(sizeof(*func), GFP_KERNEL);
530 if (!func)
531 return NULL;
532
533 if (old_func->old_name) {
534 func->old_name = kstrdup(old_func->old_name, GFP_KERNEL);
535 if (!func->old_name) {
536 kfree(func);
537 return NULL;
538 }
539 }
540
541 klp_init_func_early(obj, func);
542 /*
543 * func->new_func is same as func->old_func. These addresses are
544 * set when the object is loaded, see klp_init_object_loaded().
545 */
546 func->old_sympos = old_func->old_sympos;
547 func->nop = true;
548
549 return func;
550}
551
552static int klp_add_object_nops(struct klp_patch *patch,
553 struct klp_object *old_obj)
554{
555 struct klp_object *obj;
556 struct klp_func *func, *old_func;
557
558 obj = klp_find_object(patch, old_obj);
559
560 if (!obj) {
561 obj = klp_alloc_object_dynamic(old_obj->name, patch);
562 if (!obj)
563 return -ENOMEM;
564 }
565
566 klp_for_each_func(old_obj, old_func) {
567 func = klp_find_func(obj, old_func);
568 if (func)
569 continue;
570
571 func = klp_alloc_func_nop(old_func, obj);
572 if (!func)
573 return -ENOMEM;
574 }
575
576 return 0;
577}
578
579/*
580 * Add 'nop' functions which simply return to the caller to run
581 * the original function. The 'nop' functions are added to a
582 * patch to facilitate a 'replace' mode.
583 */
584static int klp_add_nops(struct klp_patch *patch)
585{
586 struct klp_patch *old_patch;
587 struct klp_object *old_obj;
588
589 klp_for_each_patch(old_patch) {
590 klp_for_each_object(old_patch, old_obj) {
591 int err;
592
593 err = klp_add_object_nops(patch, old_obj);
594 if (err)
595 return err;
596 }
597 }
598
599 return 0;
600}
601
602static void klp_kobj_release_patch(struct kobject *kobj)
603{
604 struct klp_patch *patch;
605
606 patch = container_of(kobj, struct klp_patch, kobj);
607 complete(&patch->finish);
608}
609
610static const struct kobj_type klp_ktype_patch = {
611 .release = klp_kobj_release_patch,
612 .sysfs_ops = &kobj_sysfs_ops,
613 .default_groups = klp_patch_groups,
614};
615
616static void klp_kobj_release_object(struct kobject *kobj)
617{
618 struct klp_object *obj;
619
620 obj = container_of(kobj, struct klp_object, kobj);
621
622 if (obj->dynamic)
623 klp_free_object_dynamic(obj);
624}
625
626static const struct kobj_type klp_ktype_object = {
627 .release = klp_kobj_release_object,
628 .sysfs_ops = &kobj_sysfs_ops,
629 .default_groups = klp_object_groups,
630};
631
632static void klp_kobj_release_func(struct kobject *kobj)
633{
634 struct klp_func *func;
635
636 func = container_of(kobj, struct klp_func, kobj);
637
638 if (func->nop)
639 klp_free_func_nop(func);
640}
641
642static const struct kobj_type klp_ktype_func = {
643 .release = klp_kobj_release_func,
644 .sysfs_ops = &kobj_sysfs_ops,
645};
646
647static void __klp_free_funcs(struct klp_object *obj, bool nops_only)
648{
649 struct klp_func *func, *tmp_func;
650
651 klp_for_each_func_safe(obj, func, tmp_func) {
652 if (nops_only && !func->nop)
653 continue;
654
655 list_del(&func->node);
656 kobject_put(&func->kobj);
657 }
658}
659
660/* Clean up when a patched object is unloaded */
661static void klp_free_object_loaded(struct klp_object *obj)
662{
663 struct klp_func *func;
664
665 obj->mod = NULL;
666
667 klp_for_each_func(obj, func) {
668 func->old_func = NULL;
669
670 if (func->nop)
671 func->new_func = NULL;
672 }
673}
674
675static void __klp_free_objects(struct klp_patch *patch, bool nops_only)
676{
677 struct klp_object *obj, *tmp_obj;
678
679 klp_for_each_object_safe(patch, obj, tmp_obj) {
680 __klp_free_funcs(obj, nops_only);
681
682 if (nops_only && !obj->dynamic)
683 continue;
684
685 list_del(&obj->node);
686 kobject_put(&obj->kobj);
687 }
688}
689
690static void klp_free_objects(struct klp_patch *patch)
691{
692 __klp_free_objects(patch, false);
693}
694
695static void klp_free_objects_dynamic(struct klp_patch *patch)
696{
697 __klp_free_objects(patch, true);
698}
699
700/*
701 * This function implements the free operations that can be called safely
702 * under klp_mutex.
703 *
704 * The operation must be completed by calling klp_free_patch_finish()
705 * outside klp_mutex.
706 */
707static void klp_free_patch_start(struct klp_patch *patch)
708{
709 if (!list_empty(&patch->list))
710 list_del(&patch->list);
711
712 klp_free_objects(patch);
713}
714
715/*
716 * This function implements the free part that must be called outside
717 * klp_mutex.
718 *
719 * It must be called after klp_free_patch_start(). And it has to be
720 * the last function accessing the livepatch structures when the patch
721 * gets disabled.
722 */
723static void klp_free_patch_finish(struct klp_patch *patch)
724{
725 /*
726 * Avoid deadlock with enabled_store() sysfs callback by
727 * calling this outside klp_mutex. It is safe because
728 * this is called when the patch gets disabled and it
729 * cannot get enabled again.
730 */
731 kobject_put(&patch->kobj);
732 wait_for_completion(&patch->finish);
733
734 /* Put the module after the last access to struct klp_patch. */
735 if (!patch->forced)
736 module_put(patch->mod);
737}
738
739/*
740 * The livepatch might be freed from sysfs interface created by the patch.
741 * This work allows to wait until the interface is destroyed in a separate
742 * context.
743 */
744static void klp_free_patch_work_fn(struct work_struct *work)
745{
746 struct klp_patch *patch =
747 container_of(work, struct klp_patch, free_work);
748
749 klp_free_patch_finish(patch);
750}
751
752void klp_free_patch_async(struct klp_patch *patch)
753{
754 klp_free_patch_start(patch);
755 schedule_work(&patch->free_work);
756}
757
758void klp_free_replaced_patches_async(struct klp_patch *new_patch)
759{
760 struct klp_patch *old_patch, *tmp_patch;
761
762 klp_for_each_patch_safe(old_patch, tmp_patch) {
763 if (old_patch == new_patch)
764 return;
765 klp_free_patch_async(old_patch);
766 }
767}
768
769static int klp_init_func(struct klp_object *obj, struct klp_func *func)
770{
771 if (!func->old_name)
772 return -EINVAL;
773
774 /*
775 * NOPs get the address later. The patched module must be loaded,
776 * see klp_init_object_loaded().
777 */
778 if (!func->new_func && !func->nop)
779 return -EINVAL;
780
781 if (strlen(func->old_name) >= KSYM_NAME_LEN)
782 return -EINVAL;
783
784 INIT_LIST_HEAD(&func->stack_node);
785 func->patched = false;
786 func->transition = false;
787
788 /* The format for the sysfs directory is <function,sympos> where sympos
789 * is the nth occurrence of this symbol in kallsyms for the patched
790 * object. If the user selects 0 for old_sympos, then 1 will be used
791 * since a unique symbol will be the first occurrence.
792 */
793 return kobject_add(&func->kobj, &obj->kobj, "%s,%lu",
794 func->old_name,
795 func->old_sympos ? func->old_sympos : 1);
796}
797
798static int klp_write_object_relocs(struct klp_patch *patch,
799 struct klp_object *obj,
800 bool apply)
801{
802 int i, ret;
803 struct klp_modinfo *info = patch->mod->klp_info;
804
805 for (i = 1; i < info->hdr.e_shnum; i++) {
806 Elf_Shdr *sec = info->sechdrs + i;
807
808 if (!(sec->sh_flags & SHF_RELA_LIVEPATCH))
809 continue;
810
811 ret = klp_write_section_relocs(patch->mod, info->sechdrs,
812 info->secstrings,
813 patch->mod->core_kallsyms.strtab,
814 info->symndx, i, obj->name, apply);
815 if (ret)
816 return ret;
817 }
818
819 return 0;
820}
821
822static int klp_apply_object_relocs(struct klp_patch *patch,
823 struct klp_object *obj)
824{
825 return klp_write_object_relocs(patch, obj, true);
826}
827
828static void klp_clear_object_relocs(struct klp_patch *patch,
829 struct klp_object *obj)
830{
831 klp_write_object_relocs(patch, obj, false);
832}
833
834/* parts of the initialization that is done only when the object is loaded */
835static int klp_init_object_loaded(struct klp_patch *patch,
836 struct klp_object *obj)
837{
838 struct klp_func *func;
839 int ret;
840
841 if (klp_is_module(obj)) {
842 /*
843 * Only write module-specific relocations here
844 * (.klp.rela.{module}.*). vmlinux-specific relocations were
845 * written earlier during the initialization of the klp module
846 * itself.
847 */
848 ret = klp_apply_object_relocs(patch, obj);
849 if (ret)
850 return ret;
851 }
852
853 klp_for_each_func(obj, func) {
854 ret = klp_find_object_symbol(obj->name, func->old_name,
855 func->old_sympos,
856 (unsigned long *)&func->old_func);
857 if (ret)
858 return ret;
859
860 ret = kallsyms_lookup_size_offset((unsigned long)func->old_func,
861 &func->old_size, NULL);
862 if (!ret) {
863 pr_err("kallsyms size lookup failed for '%s'\n",
864 func->old_name);
865 return -ENOENT;
866 }
867
868 if (func->nop)
869 func->new_func = func->old_func;
870
871 ret = kallsyms_lookup_size_offset((unsigned long)func->new_func,
872 &func->new_size, NULL);
873 if (!ret) {
874 pr_err("kallsyms size lookup failed for '%s' replacement\n",
875 func->old_name);
876 return -ENOENT;
877 }
878 }
879
880 return 0;
881}
882
883static int klp_init_object(struct klp_patch *patch, struct klp_object *obj)
884{
885 struct klp_func *func;
886 int ret;
887 const char *name;
888
889 if (klp_is_module(obj) && strlen(obj->name) >= MODULE_NAME_LEN)
890 return -EINVAL;
891
892 obj->patched = false;
893 obj->mod = NULL;
894
895 klp_find_object_module(obj);
896
897 name = klp_is_module(obj) ? obj->name : "vmlinux";
898 ret = kobject_add(&obj->kobj, &patch->kobj, "%s", name);
899 if (ret)
900 return ret;
901
902 klp_for_each_func(obj, func) {
903 ret = klp_init_func(obj, func);
904 if (ret)
905 return ret;
906 }
907
908 if (klp_is_object_loaded(obj))
909 ret = klp_init_object_loaded(patch, obj);
910
911 return ret;
912}
913
914static void klp_init_func_early(struct klp_object *obj,
915 struct klp_func *func)
916{
917 kobject_init(&func->kobj, &klp_ktype_func);
918 list_add_tail(&func->node, &obj->func_list);
919}
920
921static void klp_init_object_early(struct klp_patch *patch,
922 struct klp_object *obj)
923{
924 INIT_LIST_HEAD(&obj->func_list);
925 kobject_init(&obj->kobj, &klp_ktype_object);
926 list_add_tail(&obj->node, &patch->obj_list);
927}
928
929static void klp_init_patch_early(struct klp_patch *patch)
930{
931 struct klp_object *obj;
932 struct klp_func *func;
933
934 INIT_LIST_HEAD(&patch->list);
935 INIT_LIST_HEAD(&patch->obj_list);
936 kobject_init(&patch->kobj, &klp_ktype_patch);
937 patch->enabled = false;
938 patch->forced = false;
939 INIT_WORK(&patch->free_work, klp_free_patch_work_fn);
940 init_completion(&patch->finish);
941
942 klp_for_each_object_static(patch, obj) {
943 klp_init_object_early(patch, obj);
944
945 klp_for_each_func_static(obj, func) {
946 klp_init_func_early(obj, func);
947 }
948 }
949}
950
951static int klp_init_patch(struct klp_patch *patch)
952{
953 struct klp_object *obj;
954 int ret;
955
956 ret = kobject_add(&patch->kobj, klp_root_kobj, "%s", patch->mod->name);
957 if (ret)
958 return ret;
959
960 if (patch->replace) {
961 ret = klp_add_nops(patch);
962 if (ret)
963 return ret;
964 }
965
966 klp_for_each_object(patch, obj) {
967 ret = klp_init_object(patch, obj);
968 if (ret)
969 return ret;
970 }
971
972 list_add_tail(&patch->list, &klp_patches);
973
974 return 0;
975}
976
977static int __klp_disable_patch(struct klp_patch *patch)
978{
979 struct klp_object *obj;
980
981 if (WARN_ON(!patch->enabled))
982 return -EINVAL;
983
984 if (klp_transition_patch)
985 return -EBUSY;
986
987 klp_init_transition(patch, KLP_TRANSITION_UNPATCHED);
988
989 klp_for_each_object(patch, obj)
990 if (obj->patched)
991 klp_pre_unpatch_callback(obj);
992
993 /*
994 * Enforce the order of the func->transition writes in
995 * klp_init_transition() and the TIF_PATCH_PENDING writes in
996 * klp_start_transition(). In the rare case where klp_ftrace_handler()
997 * is called shortly after klp_update_patch_state() switches the task,
998 * this ensures the handler sees that func->transition is set.
999 */
1000 smp_wmb();
1001
1002 klp_start_transition();
1003 patch->enabled = false;
1004 klp_try_complete_transition();
1005
1006 return 0;
1007}
1008
1009static int __klp_enable_patch(struct klp_patch *patch)
1010{
1011 struct klp_object *obj;
1012 int ret;
1013
1014 if (klp_transition_patch)
1015 return -EBUSY;
1016
1017 if (WARN_ON(patch->enabled))
1018 return -EINVAL;
1019
1020 pr_notice("enabling patch '%s'\n", patch->mod->name);
1021
1022 klp_init_transition(patch, KLP_TRANSITION_PATCHED);
1023
1024 /*
1025 * Enforce the order of the func->transition writes in
1026 * klp_init_transition() and the ops->func_stack writes in
1027 * klp_patch_object(), so that klp_ftrace_handler() will see the
1028 * func->transition updates before the handler is registered and the
1029 * new funcs become visible to the handler.
1030 */
1031 smp_wmb();
1032
1033 klp_for_each_object(patch, obj) {
1034 if (!klp_is_object_loaded(obj))
1035 continue;
1036
1037 ret = klp_pre_patch_callback(obj);
1038 if (ret) {
1039 pr_warn("pre-patch callback failed for object '%s'\n",
1040 klp_is_module(obj) ? obj->name : "vmlinux");
1041 goto err;
1042 }
1043
1044 ret = klp_patch_object(obj);
1045 if (ret) {
1046 pr_warn("failed to patch object '%s'\n",
1047 klp_is_module(obj) ? obj->name : "vmlinux");
1048 goto err;
1049 }
1050 }
1051
1052 klp_start_transition();
1053 patch->enabled = true;
1054 klp_try_complete_transition();
1055
1056 return 0;
1057err:
1058 pr_warn("failed to enable patch '%s'\n", patch->mod->name);
1059
1060 klp_cancel_transition();
1061 return ret;
1062}
1063
1064/**
1065 * klp_enable_patch() - enable the livepatch
1066 * @patch: patch to be enabled
1067 *
1068 * Initializes the data structure associated with the patch, creates the sysfs
1069 * interface, performs the needed symbol lookups and code relocations,
1070 * registers the patched functions with ftrace.
1071 *
1072 * This function is supposed to be called from the livepatch module_init()
1073 * callback.
1074 *
1075 * Return: 0 on success, otherwise error
1076 */
1077int klp_enable_patch(struct klp_patch *patch)
1078{
1079 int ret;
1080 struct klp_object *obj;
1081
1082 if (!patch || !patch->mod || !patch->objs)
1083 return -EINVAL;
1084
1085 klp_for_each_object_static(patch, obj) {
1086 if (!obj->funcs)
1087 return -EINVAL;
1088 }
1089
1090
1091 if (!is_livepatch_module(patch->mod)) {
1092 pr_err("module %s is not marked as a livepatch module\n",
1093 patch->mod->name);
1094 return -EINVAL;
1095 }
1096
1097 if (!klp_initialized())
1098 return -ENODEV;
1099
1100 if (!klp_have_reliable_stack()) {
1101 pr_warn("This architecture doesn't have support for the livepatch consistency model.\n");
1102 pr_warn("The livepatch transition may never complete.\n");
1103 }
1104
1105 mutex_lock(&klp_mutex);
1106
1107 if (!klp_is_patch_compatible(patch)) {
1108 pr_err("Livepatch patch (%s) is not compatible with the already installed livepatches.\n",
1109 patch->mod->name);
1110 mutex_unlock(&klp_mutex);
1111 return -EINVAL;
1112 }
1113
1114 if (!try_module_get(patch->mod)) {
1115 mutex_unlock(&klp_mutex);
1116 return -ENODEV;
1117 }
1118
1119 klp_init_patch_early(patch);
1120
1121 ret = klp_init_patch(patch);
1122 if (ret)
1123 goto err;
1124
1125 ret = __klp_enable_patch(patch);
1126 if (ret)
1127 goto err;
1128
1129 mutex_unlock(&klp_mutex);
1130
1131 return 0;
1132
1133err:
1134 klp_free_patch_start(patch);
1135
1136 mutex_unlock(&klp_mutex);
1137
1138 klp_free_patch_finish(patch);
1139
1140 return ret;
1141}
1142EXPORT_SYMBOL_GPL(klp_enable_patch);
1143
1144/*
1145 * This function unpatches objects from the replaced livepatches.
1146 *
1147 * We could be pretty aggressive here. It is called in the situation where
1148 * these structures are no longer accessed from the ftrace handler.
1149 * All functions are redirected by the klp_transition_patch. They
1150 * use either a new code or they are in the original code because
1151 * of the special nop function patches.
1152 *
1153 * The only exception is when the transition was forced. In this case,
1154 * klp_ftrace_handler() might still see the replaced patch on the stack.
1155 * Fortunately, it is carefully designed to work with removed functions
1156 * thanks to RCU. We only have to keep the patches on the system. Also
1157 * this is handled transparently by patch->module_put.
1158 */
1159void klp_unpatch_replaced_patches(struct klp_patch *new_patch)
1160{
1161 struct klp_patch *old_patch;
1162
1163 klp_for_each_patch(old_patch) {
1164 if (old_patch == new_patch)
1165 return;
1166
1167 old_patch->enabled = false;
1168 klp_unpatch_objects(old_patch);
1169 }
1170}
1171
1172/*
1173 * This function removes the dynamically allocated 'nop' functions.
1174 *
1175 * We could be pretty aggressive. NOPs do not change the existing
1176 * behavior except for adding unnecessary delay by the ftrace handler.
1177 *
1178 * It is safe even when the transition was forced. The ftrace handler
1179 * will see a valid ops->func_stack entry thanks to RCU.
1180 *
1181 * We could even free the NOPs structures. They must be the last entry
1182 * in ops->func_stack. Therefore unregister_ftrace_function() is called.
1183 * It does the same as klp_synchronize_transition() to make sure that
1184 * nobody is inside the ftrace handler once the operation finishes.
1185 *
1186 * IMPORTANT: It must be called right after removing the replaced patches!
1187 */
1188void klp_discard_nops(struct klp_patch *new_patch)
1189{
1190 klp_unpatch_objects_dynamic(klp_transition_patch);
1191 klp_free_objects_dynamic(klp_transition_patch);
1192}
1193
1194/*
1195 * Remove parts of patches that touch a given kernel module. The list of
1196 * patches processed might be limited. When limit is NULL, all patches
1197 * will be handled.
1198 */
1199static void klp_cleanup_module_patches_limited(struct module *mod,
1200 struct klp_patch *limit)
1201{
1202 struct klp_patch *patch;
1203 struct klp_object *obj;
1204
1205 klp_for_each_patch(patch) {
1206 if (patch == limit)
1207 break;
1208
1209 klp_for_each_object(patch, obj) {
1210 if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
1211 continue;
1212
1213 if (patch != klp_transition_patch)
1214 klp_pre_unpatch_callback(obj);
1215
1216 pr_notice("reverting patch '%s' on unloading module '%s'\n",
1217 patch->mod->name, obj->mod->name);
1218 klp_unpatch_object(obj);
1219
1220 klp_post_unpatch_callback(obj);
1221 klp_clear_object_relocs(patch, obj);
1222 klp_free_object_loaded(obj);
1223 break;
1224 }
1225 }
1226}
1227
1228int klp_module_coming(struct module *mod)
1229{
1230 int ret;
1231 struct klp_patch *patch;
1232 struct klp_object *obj;
1233
1234 if (WARN_ON(mod->state != MODULE_STATE_COMING))
1235 return -EINVAL;
1236
1237 if (!strcmp(mod->name, "vmlinux")) {
1238 pr_err("vmlinux.ko: invalid module name\n");
1239 return -EINVAL;
1240 }
1241
1242 mutex_lock(&klp_mutex);
1243 /*
1244 * Each module has to know that klp_module_coming()
1245 * has been called. We never know what module will
1246 * get patched by a new patch.
1247 */
1248 mod->klp_alive = true;
1249
1250 klp_for_each_patch(patch) {
1251 klp_for_each_object(patch, obj) {
1252 if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
1253 continue;
1254
1255 obj->mod = mod;
1256
1257 ret = klp_init_object_loaded(patch, obj);
1258 if (ret) {
1259 pr_warn("failed to initialize patch '%s' for module '%s' (%d)\n",
1260 patch->mod->name, obj->mod->name, ret);
1261 goto err;
1262 }
1263
1264 pr_notice("applying patch '%s' to loading module '%s'\n",
1265 patch->mod->name, obj->mod->name);
1266
1267 ret = klp_pre_patch_callback(obj);
1268 if (ret) {
1269 pr_warn("pre-patch callback failed for object '%s'\n",
1270 obj->name);
1271 goto err;
1272 }
1273
1274 ret = klp_patch_object(obj);
1275 if (ret) {
1276 pr_warn("failed to apply patch '%s' to module '%s' (%d)\n",
1277 patch->mod->name, obj->mod->name, ret);
1278
1279 klp_post_unpatch_callback(obj);
1280 goto err;
1281 }
1282
1283 if (patch != klp_transition_patch)
1284 klp_post_patch_callback(obj);
1285
1286 break;
1287 }
1288 }
1289
1290 mutex_unlock(&klp_mutex);
1291
1292 return 0;
1293
1294err:
1295 /*
1296 * If a patch is unsuccessfully applied, return
1297 * error to the module loader.
1298 */
1299 pr_warn("patch '%s' failed for module '%s', refusing to load module '%s'\n",
1300 patch->mod->name, obj->mod->name, obj->mod->name);
1301 mod->klp_alive = false;
1302 obj->mod = NULL;
1303 klp_cleanup_module_patches_limited(mod, patch);
1304 mutex_unlock(&klp_mutex);
1305
1306 return ret;
1307}
1308
1309void klp_module_going(struct module *mod)
1310{
1311 if (WARN_ON(mod->state != MODULE_STATE_GOING &&
1312 mod->state != MODULE_STATE_COMING))
1313 return;
1314
1315 mutex_lock(&klp_mutex);
1316 /*
1317 * Each module has to know that klp_module_going()
1318 * has been called. We never know what module will
1319 * get patched by a new patch.
1320 */
1321 mod->klp_alive = false;
1322
1323 klp_cleanup_module_patches_limited(mod, NULL);
1324
1325 mutex_unlock(&klp_mutex);
1326}
1327
1328static int __init klp_init(void)
1329{
1330 klp_root_kobj = kobject_create_and_add("livepatch", kernel_kobj);
1331 if (!klp_root_kobj)
1332 return -ENOMEM;
1333
1334 return 0;
1335}
1336
1337module_init(klp_init);
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * core.c - Kernel Live Patching Core
4 *
5 * Copyright (C) 2014 Seth Jennings <sjenning@redhat.com>
6 * Copyright (C) 2014 SUSE
7 */
8
9#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10
11#include <linux/module.h>
12#include <linux/kernel.h>
13#include <linux/mutex.h>
14#include <linux/slab.h>
15#include <linux/list.h>
16#include <linux/kallsyms.h>
17#include <linux/livepatch.h>
18#include <linux/elf.h>
19#include <linux/moduleloader.h>
20#include <linux/completion.h>
21#include <linux/memory.h>
22#include <linux/rcupdate.h>
23#include <asm/cacheflush.h>
24#include "core.h"
25#include "patch.h"
26#include "state.h"
27#include "transition.h"
28
29/*
30 * klp_mutex is a coarse lock which serializes access to klp data. All
31 * accesses to klp-related variables and structures must have mutex protection,
32 * except within the following functions which carefully avoid the need for it:
33 *
34 * - klp_ftrace_handler()
35 * - klp_update_patch_state()
36 */
37DEFINE_MUTEX(klp_mutex);
38
39/*
40 * Actively used patches: enabled or in transition. Note that replaced
41 * or disabled patches are not listed even though the related kernel
42 * module still can be loaded.
43 */
44LIST_HEAD(klp_patches);
45
46static struct kobject *klp_root_kobj;
47
48static bool klp_is_module(struct klp_object *obj)
49{
50 return obj->name;
51}
52
53/* sets obj->mod if object is not vmlinux and module is found */
54static void klp_find_object_module(struct klp_object *obj)
55{
56 struct module *mod;
57
58 if (!klp_is_module(obj))
59 return;
60
61 rcu_read_lock_sched();
62 /*
63 * We do not want to block removal of patched modules and therefore
64 * we do not take a reference here. The patches are removed by
65 * klp_module_going() instead.
66 */
67 mod = find_module(obj->name);
68 /*
69 * Do not mess work of klp_module_coming() and klp_module_going().
70 * Note that the patch might still be needed before klp_module_going()
71 * is called. Module functions can be called even in the GOING state
72 * until mod->exit() finishes. This is especially important for
73 * patches that modify semantic of the functions.
74 */
75 if (mod && mod->klp_alive)
76 obj->mod = mod;
77
78 rcu_read_unlock_sched();
79}
80
81static bool klp_initialized(void)
82{
83 return !!klp_root_kobj;
84}
85
86static struct klp_func *klp_find_func(struct klp_object *obj,
87 struct klp_func *old_func)
88{
89 struct klp_func *func;
90
91 klp_for_each_func(obj, func) {
92 if ((strcmp(old_func->old_name, func->old_name) == 0) &&
93 (old_func->old_sympos == func->old_sympos)) {
94 return func;
95 }
96 }
97
98 return NULL;
99}
100
101static struct klp_object *klp_find_object(struct klp_patch *patch,
102 struct klp_object *old_obj)
103{
104 struct klp_object *obj;
105
106 klp_for_each_object(patch, obj) {
107 if (klp_is_module(old_obj)) {
108 if (klp_is_module(obj) &&
109 strcmp(old_obj->name, obj->name) == 0) {
110 return obj;
111 }
112 } else if (!klp_is_module(obj)) {
113 return obj;
114 }
115 }
116
117 return NULL;
118}
119
120struct klp_find_arg {
121 const char *objname;
122 const char *name;
123 unsigned long addr;
124 unsigned long count;
125 unsigned long pos;
126};
127
128static int klp_find_callback(void *data, const char *name,
129 struct module *mod, unsigned long addr)
130{
131 struct klp_find_arg *args = data;
132
133 if ((mod && !args->objname) || (!mod && args->objname))
134 return 0;
135
136 if (strcmp(args->name, name))
137 return 0;
138
139 if (args->objname && strcmp(args->objname, mod->name))
140 return 0;
141
142 args->addr = addr;
143 args->count++;
144
145 /*
146 * Finish the search when the symbol is found for the desired position
147 * or the position is not defined for a non-unique symbol.
148 */
149 if ((args->pos && (args->count == args->pos)) ||
150 (!args->pos && (args->count > 1)))
151 return 1;
152
153 return 0;
154}
155
156static int klp_find_object_symbol(const char *objname, const char *name,
157 unsigned long sympos, unsigned long *addr)
158{
159 struct klp_find_arg args = {
160 .objname = objname,
161 .name = name,
162 .addr = 0,
163 .count = 0,
164 .pos = sympos,
165 };
166
167 if (objname)
168 module_kallsyms_on_each_symbol(klp_find_callback, &args);
169 else
170 kallsyms_on_each_symbol(klp_find_callback, &args);
171
172 /*
173 * Ensure an address was found. If sympos is 0, ensure symbol is unique;
174 * otherwise ensure the symbol position count matches sympos.
175 */
176 if (args.addr == 0)
177 pr_err("symbol '%s' not found in symbol table\n", name);
178 else if (args.count > 1 && sympos == 0) {
179 pr_err("unresolvable ambiguity for symbol '%s' in object '%s'\n",
180 name, objname);
181 } else if (sympos != args.count && sympos > 0) {
182 pr_err("symbol position %lu for symbol '%s' in object '%s' not found\n",
183 sympos, name, objname ? objname : "vmlinux");
184 } else {
185 *addr = args.addr;
186 return 0;
187 }
188
189 *addr = 0;
190 return -EINVAL;
191}
192
193static int klp_resolve_symbols(Elf64_Shdr *sechdrs, const char *strtab,
194 unsigned int symndx, Elf_Shdr *relasec,
195 const char *sec_objname)
196{
197 int i, cnt, ret;
198 char sym_objname[MODULE_NAME_LEN];
199 char sym_name[KSYM_NAME_LEN];
200 Elf_Rela *relas;
201 Elf_Sym *sym;
202 unsigned long sympos, addr;
203 bool sym_vmlinux;
204 bool sec_vmlinux = !strcmp(sec_objname, "vmlinux");
205
206 /*
207 * Since the field widths for sym_objname and sym_name in the sscanf()
208 * call are hard-coded and correspond to MODULE_NAME_LEN and
209 * KSYM_NAME_LEN respectively, we must make sure that MODULE_NAME_LEN
210 * and KSYM_NAME_LEN have the values we expect them to have.
211 *
212 * Because the value of MODULE_NAME_LEN can differ among architectures,
213 * we use the smallest/strictest upper bound possible (56, based on
214 * the current definition of MODULE_NAME_LEN) to prevent overflows.
215 */
216 BUILD_BUG_ON(MODULE_NAME_LEN < 56 || KSYM_NAME_LEN != 128);
217
218 relas = (Elf_Rela *) relasec->sh_addr;
219 /* For each rela in this klp relocation section */
220 for (i = 0; i < relasec->sh_size / sizeof(Elf_Rela); i++) {
221 sym = (Elf64_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info);
222 if (sym->st_shndx != SHN_LIVEPATCH) {
223 pr_err("symbol %s is not marked as a livepatch symbol\n",
224 strtab + sym->st_name);
225 return -EINVAL;
226 }
227
228 /* Format: .klp.sym.sym_objname.sym_name,sympos */
229 cnt = sscanf(strtab + sym->st_name,
230 ".klp.sym.%55[^.].%127[^,],%lu",
231 sym_objname, sym_name, &sympos);
232 if (cnt != 3) {
233 pr_err("symbol %s has an incorrectly formatted name\n",
234 strtab + sym->st_name);
235 return -EINVAL;
236 }
237
238 sym_vmlinux = !strcmp(sym_objname, "vmlinux");
239
240 /*
241 * Prevent module-specific KLP rela sections from referencing
242 * vmlinux symbols. This helps prevent ordering issues with
243 * module special section initializations. Presumably such
244 * symbols are exported and normal relas can be used instead.
245 */
246 if (!sec_vmlinux && sym_vmlinux) {
247 pr_err("invalid access to vmlinux symbol '%s' from module-specific livepatch relocation section",
248 sym_name);
249 return -EINVAL;
250 }
251
252 /* klp_find_object_symbol() treats a NULL objname as vmlinux */
253 ret = klp_find_object_symbol(sym_vmlinux ? NULL : sym_objname,
254 sym_name, sympos, &addr);
255 if (ret)
256 return ret;
257
258 sym->st_value = addr;
259 }
260
261 return 0;
262}
263
264/*
265 * At a high-level, there are two types of klp relocation sections: those which
266 * reference symbols which live in vmlinux; and those which reference symbols
267 * which live in other modules. This function is called for both types:
268 *
269 * 1) When a klp module itself loads, the module code calls this function to
270 * write vmlinux-specific klp relocations (.klp.rela.vmlinux.* sections).
271 * These relocations are written to the klp module text to allow the patched
272 * code/data to reference unexported vmlinux symbols. They're written as
273 * early as possible to ensure that other module init code (.e.g.,
274 * jump_label_apply_nops) can access any unexported vmlinux symbols which
275 * might be referenced by the klp module's special sections.
276 *
277 * 2) When a to-be-patched module loads -- or is already loaded when a
278 * corresponding klp module loads -- klp code calls this function to write
279 * module-specific klp relocations (.klp.rela.{module}.* sections). These
280 * are written to the klp module text to allow the patched code/data to
281 * reference symbols which live in the to-be-patched module or one of its
282 * module dependencies. Exported symbols are supported, in addition to
283 * unexported symbols, in order to enable late module patching, which allows
284 * the to-be-patched module to be loaded and patched sometime *after* the
285 * klp module is loaded.
286 */
287int klp_apply_section_relocs(struct module *pmod, Elf_Shdr *sechdrs,
288 const char *shstrtab, const char *strtab,
289 unsigned int symndx, unsigned int secndx,
290 const char *objname)
291{
292 int cnt, ret;
293 char sec_objname[MODULE_NAME_LEN];
294 Elf_Shdr *sec = sechdrs + secndx;
295
296 /*
297 * Format: .klp.rela.sec_objname.section_name
298 * See comment in klp_resolve_symbols() for an explanation
299 * of the selected field width value.
300 */
301 cnt = sscanf(shstrtab + sec->sh_name, ".klp.rela.%55[^.]",
302 sec_objname);
303 if (cnt != 1) {
304 pr_err("section %s has an incorrectly formatted name\n",
305 shstrtab + sec->sh_name);
306 return -EINVAL;
307 }
308
309 if (strcmp(objname ? objname : "vmlinux", sec_objname))
310 return 0;
311
312 ret = klp_resolve_symbols(sechdrs, strtab, symndx, sec, sec_objname);
313 if (ret)
314 return ret;
315
316 return apply_relocate_add(sechdrs, strtab, symndx, secndx, pmod);
317}
318
319/*
320 * Sysfs Interface
321 *
322 * /sys/kernel/livepatch
323 * /sys/kernel/livepatch/<patch>
324 * /sys/kernel/livepatch/<patch>/enabled
325 * /sys/kernel/livepatch/<patch>/transition
326 * /sys/kernel/livepatch/<patch>/force
327 * /sys/kernel/livepatch/<patch>/<object>
328 * /sys/kernel/livepatch/<patch>/<object>/<function,sympos>
329 */
330static int __klp_disable_patch(struct klp_patch *patch);
331
332static ssize_t enabled_store(struct kobject *kobj, struct kobj_attribute *attr,
333 const char *buf, size_t count)
334{
335 struct klp_patch *patch;
336 int ret;
337 bool enabled;
338
339 ret = kstrtobool(buf, &enabled);
340 if (ret)
341 return ret;
342
343 patch = container_of(kobj, struct klp_patch, kobj);
344
345 mutex_lock(&klp_mutex);
346
347 if (patch->enabled == enabled) {
348 /* already in requested state */
349 ret = -EINVAL;
350 goto out;
351 }
352
353 /*
354 * Allow to reverse a pending transition in both ways. It might be
355 * necessary to complete the transition without forcing and breaking
356 * the system integrity.
357 *
358 * Do not allow to re-enable a disabled patch.
359 */
360 if (patch == klp_transition_patch)
361 klp_reverse_transition();
362 else if (!enabled)
363 ret = __klp_disable_patch(patch);
364 else
365 ret = -EINVAL;
366
367out:
368 mutex_unlock(&klp_mutex);
369
370 if (ret)
371 return ret;
372 return count;
373}
374
375static ssize_t enabled_show(struct kobject *kobj,
376 struct kobj_attribute *attr, char *buf)
377{
378 struct klp_patch *patch;
379
380 patch = container_of(kobj, struct klp_patch, kobj);
381 return snprintf(buf, PAGE_SIZE-1, "%d\n", patch->enabled);
382}
383
384static ssize_t transition_show(struct kobject *kobj,
385 struct kobj_attribute *attr, char *buf)
386{
387 struct klp_patch *patch;
388
389 patch = container_of(kobj, struct klp_patch, kobj);
390 return snprintf(buf, PAGE_SIZE-1, "%d\n",
391 patch == klp_transition_patch);
392}
393
394static ssize_t force_store(struct kobject *kobj, struct kobj_attribute *attr,
395 const char *buf, size_t count)
396{
397 struct klp_patch *patch;
398 int ret;
399 bool val;
400
401 ret = kstrtobool(buf, &val);
402 if (ret)
403 return ret;
404
405 if (!val)
406 return count;
407
408 mutex_lock(&klp_mutex);
409
410 patch = container_of(kobj, struct klp_patch, kobj);
411 if (patch != klp_transition_patch) {
412 mutex_unlock(&klp_mutex);
413 return -EINVAL;
414 }
415
416 klp_force_transition();
417
418 mutex_unlock(&klp_mutex);
419
420 return count;
421}
422
423static struct kobj_attribute enabled_kobj_attr = __ATTR_RW(enabled);
424static struct kobj_attribute transition_kobj_attr = __ATTR_RO(transition);
425static struct kobj_attribute force_kobj_attr = __ATTR_WO(force);
426static struct attribute *klp_patch_attrs[] = {
427 &enabled_kobj_attr.attr,
428 &transition_kobj_attr.attr,
429 &force_kobj_attr.attr,
430 NULL
431};
432ATTRIBUTE_GROUPS(klp_patch);
433
434static void klp_free_object_dynamic(struct klp_object *obj)
435{
436 kfree(obj->name);
437 kfree(obj);
438}
439
440static void klp_init_func_early(struct klp_object *obj,
441 struct klp_func *func);
442static void klp_init_object_early(struct klp_patch *patch,
443 struct klp_object *obj);
444
445static struct klp_object *klp_alloc_object_dynamic(const char *name,
446 struct klp_patch *patch)
447{
448 struct klp_object *obj;
449
450 obj = kzalloc(sizeof(*obj), GFP_KERNEL);
451 if (!obj)
452 return NULL;
453
454 if (name) {
455 obj->name = kstrdup(name, GFP_KERNEL);
456 if (!obj->name) {
457 kfree(obj);
458 return NULL;
459 }
460 }
461
462 klp_init_object_early(patch, obj);
463 obj->dynamic = true;
464
465 return obj;
466}
467
468static void klp_free_func_nop(struct klp_func *func)
469{
470 kfree(func->old_name);
471 kfree(func);
472}
473
474static struct klp_func *klp_alloc_func_nop(struct klp_func *old_func,
475 struct klp_object *obj)
476{
477 struct klp_func *func;
478
479 func = kzalloc(sizeof(*func), GFP_KERNEL);
480 if (!func)
481 return NULL;
482
483 if (old_func->old_name) {
484 func->old_name = kstrdup(old_func->old_name, GFP_KERNEL);
485 if (!func->old_name) {
486 kfree(func);
487 return NULL;
488 }
489 }
490
491 klp_init_func_early(obj, func);
492 /*
493 * func->new_func is same as func->old_func. These addresses are
494 * set when the object is loaded, see klp_init_object_loaded().
495 */
496 func->old_sympos = old_func->old_sympos;
497 func->nop = true;
498
499 return func;
500}
501
502static int klp_add_object_nops(struct klp_patch *patch,
503 struct klp_object *old_obj)
504{
505 struct klp_object *obj;
506 struct klp_func *func, *old_func;
507
508 obj = klp_find_object(patch, old_obj);
509
510 if (!obj) {
511 obj = klp_alloc_object_dynamic(old_obj->name, patch);
512 if (!obj)
513 return -ENOMEM;
514 }
515
516 klp_for_each_func(old_obj, old_func) {
517 func = klp_find_func(obj, old_func);
518 if (func)
519 continue;
520
521 func = klp_alloc_func_nop(old_func, obj);
522 if (!func)
523 return -ENOMEM;
524 }
525
526 return 0;
527}
528
529/*
530 * Add 'nop' functions which simply return to the caller to run
531 * the original function. The 'nop' functions are added to a
532 * patch to facilitate a 'replace' mode.
533 */
534static int klp_add_nops(struct klp_patch *patch)
535{
536 struct klp_patch *old_patch;
537 struct klp_object *old_obj;
538
539 klp_for_each_patch(old_patch) {
540 klp_for_each_object(old_patch, old_obj) {
541 int err;
542
543 err = klp_add_object_nops(patch, old_obj);
544 if (err)
545 return err;
546 }
547 }
548
549 return 0;
550}
551
552static void klp_kobj_release_patch(struct kobject *kobj)
553{
554 struct klp_patch *patch;
555
556 patch = container_of(kobj, struct klp_patch, kobj);
557 complete(&patch->finish);
558}
559
560static struct kobj_type klp_ktype_patch = {
561 .release = klp_kobj_release_patch,
562 .sysfs_ops = &kobj_sysfs_ops,
563 .default_groups = klp_patch_groups,
564};
565
566static void klp_kobj_release_object(struct kobject *kobj)
567{
568 struct klp_object *obj;
569
570 obj = container_of(kobj, struct klp_object, kobj);
571
572 if (obj->dynamic)
573 klp_free_object_dynamic(obj);
574}
575
576static struct kobj_type klp_ktype_object = {
577 .release = klp_kobj_release_object,
578 .sysfs_ops = &kobj_sysfs_ops,
579};
580
581static void klp_kobj_release_func(struct kobject *kobj)
582{
583 struct klp_func *func;
584
585 func = container_of(kobj, struct klp_func, kobj);
586
587 if (func->nop)
588 klp_free_func_nop(func);
589}
590
591static struct kobj_type klp_ktype_func = {
592 .release = klp_kobj_release_func,
593 .sysfs_ops = &kobj_sysfs_ops,
594};
595
596static void __klp_free_funcs(struct klp_object *obj, bool nops_only)
597{
598 struct klp_func *func, *tmp_func;
599
600 klp_for_each_func_safe(obj, func, tmp_func) {
601 if (nops_only && !func->nop)
602 continue;
603
604 list_del(&func->node);
605 kobject_put(&func->kobj);
606 }
607}
608
609/* Clean up when a patched object is unloaded */
610static void klp_free_object_loaded(struct klp_object *obj)
611{
612 struct klp_func *func;
613
614 obj->mod = NULL;
615
616 klp_for_each_func(obj, func) {
617 func->old_func = NULL;
618
619 if (func->nop)
620 func->new_func = NULL;
621 }
622}
623
624static void __klp_free_objects(struct klp_patch *patch, bool nops_only)
625{
626 struct klp_object *obj, *tmp_obj;
627
628 klp_for_each_object_safe(patch, obj, tmp_obj) {
629 __klp_free_funcs(obj, nops_only);
630
631 if (nops_only && !obj->dynamic)
632 continue;
633
634 list_del(&obj->node);
635 kobject_put(&obj->kobj);
636 }
637}
638
639static void klp_free_objects(struct klp_patch *patch)
640{
641 __klp_free_objects(patch, false);
642}
643
644static void klp_free_objects_dynamic(struct klp_patch *patch)
645{
646 __klp_free_objects(patch, true);
647}
648
649/*
650 * This function implements the free operations that can be called safely
651 * under klp_mutex.
652 *
653 * The operation must be completed by calling klp_free_patch_finish()
654 * outside klp_mutex.
655 */
656static void klp_free_patch_start(struct klp_patch *patch)
657{
658 if (!list_empty(&patch->list))
659 list_del(&patch->list);
660
661 klp_free_objects(patch);
662}
663
664/*
665 * This function implements the free part that must be called outside
666 * klp_mutex.
667 *
668 * It must be called after klp_free_patch_start(). And it has to be
669 * the last function accessing the livepatch structures when the patch
670 * gets disabled.
671 */
672static void klp_free_patch_finish(struct klp_patch *patch)
673{
674 /*
675 * Avoid deadlock with enabled_store() sysfs callback by
676 * calling this outside klp_mutex. It is safe because
677 * this is called when the patch gets disabled and it
678 * cannot get enabled again.
679 */
680 kobject_put(&patch->kobj);
681 wait_for_completion(&patch->finish);
682
683 /* Put the module after the last access to struct klp_patch. */
684 if (!patch->forced)
685 module_put(patch->mod);
686}
687
688/*
689 * The livepatch might be freed from sysfs interface created by the patch.
690 * This work allows to wait until the interface is destroyed in a separate
691 * context.
692 */
693static void klp_free_patch_work_fn(struct work_struct *work)
694{
695 struct klp_patch *patch =
696 container_of(work, struct klp_patch, free_work);
697
698 klp_free_patch_finish(patch);
699}
700
701void klp_free_patch_async(struct klp_patch *patch)
702{
703 klp_free_patch_start(patch);
704 schedule_work(&patch->free_work);
705}
706
707void klp_free_replaced_patches_async(struct klp_patch *new_patch)
708{
709 struct klp_patch *old_patch, *tmp_patch;
710
711 klp_for_each_patch_safe(old_patch, tmp_patch) {
712 if (old_patch == new_patch)
713 return;
714 klp_free_patch_async(old_patch);
715 }
716}
717
718static int klp_init_func(struct klp_object *obj, struct klp_func *func)
719{
720 if (!func->old_name)
721 return -EINVAL;
722
723 /*
724 * NOPs get the address later. The patched module must be loaded,
725 * see klp_init_object_loaded().
726 */
727 if (!func->new_func && !func->nop)
728 return -EINVAL;
729
730 if (strlen(func->old_name) >= KSYM_NAME_LEN)
731 return -EINVAL;
732
733 INIT_LIST_HEAD(&func->stack_node);
734 func->patched = false;
735 func->transition = false;
736
737 /* The format for the sysfs directory is <function,sympos> where sympos
738 * is the nth occurrence of this symbol in kallsyms for the patched
739 * object. If the user selects 0 for old_sympos, then 1 will be used
740 * since a unique symbol will be the first occurrence.
741 */
742 return kobject_add(&func->kobj, &obj->kobj, "%s,%lu",
743 func->old_name,
744 func->old_sympos ? func->old_sympos : 1);
745}
746
747static int klp_apply_object_relocs(struct klp_patch *patch,
748 struct klp_object *obj)
749{
750 int i, ret;
751 struct klp_modinfo *info = patch->mod->klp_info;
752
753 for (i = 1; i < info->hdr.e_shnum; i++) {
754 Elf_Shdr *sec = info->sechdrs + i;
755
756 if (!(sec->sh_flags & SHF_RELA_LIVEPATCH))
757 continue;
758
759 ret = klp_apply_section_relocs(patch->mod, info->sechdrs,
760 info->secstrings,
761 patch->mod->core_kallsyms.strtab,
762 info->symndx, i, obj->name);
763 if (ret)
764 return ret;
765 }
766
767 return 0;
768}
769
770/* parts of the initialization that is done only when the object is loaded */
771static int klp_init_object_loaded(struct klp_patch *patch,
772 struct klp_object *obj)
773{
774 struct klp_func *func;
775 int ret;
776
777 if (klp_is_module(obj)) {
778 /*
779 * Only write module-specific relocations here
780 * (.klp.rela.{module}.*). vmlinux-specific relocations were
781 * written earlier during the initialization of the klp module
782 * itself.
783 */
784 ret = klp_apply_object_relocs(patch, obj);
785 if (ret)
786 return ret;
787 }
788
789 klp_for_each_func(obj, func) {
790 ret = klp_find_object_symbol(obj->name, func->old_name,
791 func->old_sympos,
792 (unsigned long *)&func->old_func);
793 if (ret)
794 return ret;
795
796 ret = kallsyms_lookup_size_offset((unsigned long)func->old_func,
797 &func->old_size, NULL);
798 if (!ret) {
799 pr_err("kallsyms size lookup failed for '%s'\n",
800 func->old_name);
801 return -ENOENT;
802 }
803
804 if (func->nop)
805 func->new_func = func->old_func;
806
807 ret = kallsyms_lookup_size_offset((unsigned long)func->new_func,
808 &func->new_size, NULL);
809 if (!ret) {
810 pr_err("kallsyms size lookup failed for '%s' replacement\n",
811 func->old_name);
812 return -ENOENT;
813 }
814 }
815
816 return 0;
817}
818
819static int klp_init_object(struct klp_patch *patch, struct klp_object *obj)
820{
821 struct klp_func *func;
822 int ret;
823 const char *name;
824
825 if (klp_is_module(obj) && strlen(obj->name) >= MODULE_NAME_LEN)
826 return -EINVAL;
827
828 obj->patched = false;
829 obj->mod = NULL;
830
831 klp_find_object_module(obj);
832
833 name = klp_is_module(obj) ? obj->name : "vmlinux";
834 ret = kobject_add(&obj->kobj, &patch->kobj, "%s", name);
835 if (ret)
836 return ret;
837
838 klp_for_each_func(obj, func) {
839 ret = klp_init_func(obj, func);
840 if (ret)
841 return ret;
842 }
843
844 if (klp_is_object_loaded(obj))
845 ret = klp_init_object_loaded(patch, obj);
846
847 return ret;
848}
849
850static void klp_init_func_early(struct klp_object *obj,
851 struct klp_func *func)
852{
853 kobject_init(&func->kobj, &klp_ktype_func);
854 list_add_tail(&func->node, &obj->func_list);
855}
856
857static void klp_init_object_early(struct klp_patch *patch,
858 struct klp_object *obj)
859{
860 INIT_LIST_HEAD(&obj->func_list);
861 kobject_init(&obj->kobj, &klp_ktype_object);
862 list_add_tail(&obj->node, &patch->obj_list);
863}
864
865static int klp_init_patch_early(struct klp_patch *patch)
866{
867 struct klp_object *obj;
868 struct klp_func *func;
869
870 if (!patch->objs)
871 return -EINVAL;
872
873 INIT_LIST_HEAD(&patch->list);
874 INIT_LIST_HEAD(&patch->obj_list);
875 kobject_init(&patch->kobj, &klp_ktype_patch);
876 patch->enabled = false;
877 patch->forced = false;
878 INIT_WORK(&patch->free_work, klp_free_patch_work_fn);
879 init_completion(&patch->finish);
880
881 klp_for_each_object_static(patch, obj) {
882 if (!obj->funcs)
883 return -EINVAL;
884
885 klp_init_object_early(patch, obj);
886
887 klp_for_each_func_static(obj, func) {
888 klp_init_func_early(obj, func);
889 }
890 }
891
892 if (!try_module_get(patch->mod))
893 return -ENODEV;
894
895 return 0;
896}
897
898static int klp_init_patch(struct klp_patch *patch)
899{
900 struct klp_object *obj;
901 int ret;
902
903 ret = kobject_add(&patch->kobj, klp_root_kobj, "%s", patch->mod->name);
904 if (ret)
905 return ret;
906
907 if (patch->replace) {
908 ret = klp_add_nops(patch);
909 if (ret)
910 return ret;
911 }
912
913 klp_for_each_object(patch, obj) {
914 ret = klp_init_object(patch, obj);
915 if (ret)
916 return ret;
917 }
918
919 list_add_tail(&patch->list, &klp_patches);
920
921 return 0;
922}
923
924static int __klp_disable_patch(struct klp_patch *patch)
925{
926 struct klp_object *obj;
927
928 if (WARN_ON(!patch->enabled))
929 return -EINVAL;
930
931 if (klp_transition_patch)
932 return -EBUSY;
933
934 klp_init_transition(patch, KLP_UNPATCHED);
935
936 klp_for_each_object(patch, obj)
937 if (obj->patched)
938 klp_pre_unpatch_callback(obj);
939
940 /*
941 * Enforce the order of the func->transition writes in
942 * klp_init_transition() and the TIF_PATCH_PENDING writes in
943 * klp_start_transition(). In the rare case where klp_ftrace_handler()
944 * is called shortly after klp_update_patch_state() switches the task,
945 * this ensures the handler sees that func->transition is set.
946 */
947 smp_wmb();
948
949 klp_start_transition();
950 patch->enabled = false;
951 klp_try_complete_transition();
952
953 return 0;
954}
955
956static int __klp_enable_patch(struct klp_patch *patch)
957{
958 struct klp_object *obj;
959 int ret;
960
961 if (klp_transition_patch)
962 return -EBUSY;
963
964 if (WARN_ON(patch->enabled))
965 return -EINVAL;
966
967 pr_notice("enabling patch '%s'\n", patch->mod->name);
968
969 klp_init_transition(patch, KLP_PATCHED);
970
971 /*
972 * Enforce the order of the func->transition writes in
973 * klp_init_transition() and the ops->func_stack writes in
974 * klp_patch_object(), so that klp_ftrace_handler() will see the
975 * func->transition updates before the handler is registered and the
976 * new funcs become visible to the handler.
977 */
978 smp_wmb();
979
980 klp_for_each_object(patch, obj) {
981 if (!klp_is_object_loaded(obj))
982 continue;
983
984 ret = klp_pre_patch_callback(obj);
985 if (ret) {
986 pr_warn("pre-patch callback failed for object '%s'\n",
987 klp_is_module(obj) ? obj->name : "vmlinux");
988 goto err;
989 }
990
991 ret = klp_patch_object(obj);
992 if (ret) {
993 pr_warn("failed to patch object '%s'\n",
994 klp_is_module(obj) ? obj->name : "vmlinux");
995 goto err;
996 }
997 }
998
999 klp_start_transition();
1000 patch->enabled = true;
1001 klp_try_complete_transition();
1002
1003 return 0;
1004err:
1005 pr_warn("failed to enable patch '%s'\n", patch->mod->name);
1006
1007 klp_cancel_transition();
1008 return ret;
1009}
1010
1011/**
1012 * klp_enable_patch() - enable the livepatch
1013 * @patch: patch to be enabled
1014 *
1015 * Initializes the data structure associated with the patch, creates the sysfs
1016 * interface, performs the needed symbol lookups and code relocations,
1017 * registers the patched functions with ftrace.
1018 *
1019 * This function is supposed to be called from the livepatch module_init()
1020 * callback.
1021 *
1022 * Return: 0 on success, otherwise error
1023 */
1024int klp_enable_patch(struct klp_patch *patch)
1025{
1026 int ret;
1027
1028 if (!patch || !patch->mod)
1029 return -EINVAL;
1030
1031 if (!is_livepatch_module(patch->mod)) {
1032 pr_err("module %s is not marked as a livepatch module\n",
1033 patch->mod->name);
1034 return -EINVAL;
1035 }
1036
1037 if (!klp_initialized())
1038 return -ENODEV;
1039
1040 if (!klp_have_reliable_stack()) {
1041 pr_warn("This architecture doesn't have support for the livepatch consistency model.\n");
1042 pr_warn("The livepatch transition may never complete.\n");
1043 }
1044
1045 mutex_lock(&klp_mutex);
1046
1047 if (!klp_is_patch_compatible(patch)) {
1048 pr_err("Livepatch patch (%s) is not compatible with the already installed livepatches.\n",
1049 patch->mod->name);
1050 mutex_unlock(&klp_mutex);
1051 return -EINVAL;
1052 }
1053
1054 ret = klp_init_patch_early(patch);
1055 if (ret) {
1056 mutex_unlock(&klp_mutex);
1057 return ret;
1058 }
1059
1060 ret = klp_init_patch(patch);
1061 if (ret)
1062 goto err;
1063
1064 ret = __klp_enable_patch(patch);
1065 if (ret)
1066 goto err;
1067
1068 mutex_unlock(&klp_mutex);
1069
1070 return 0;
1071
1072err:
1073 klp_free_patch_start(patch);
1074
1075 mutex_unlock(&klp_mutex);
1076
1077 klp_free_patch_finish(patch);
1078
1079 return ret;
1080}
1081EXPORT_SYMBOL_GPL(klp_enable_patch);
1082
1083/*
1084 * This function unpatches objects from the replaced livepatches.
1085 *
1086 * We could be pretty aggressive here. It is called in the situation where
1087 * these structures are no longer accessed from the ftrace handler.
1088 * All functions are redirected by the klp_transition_patch. They
1089 * use either a new code or they are in the original code because
1090 * of the special nop function patches.
1091 *
1092 * The only exception is when the transition was forced. In this case,
1093 * klp_ftrace_handler() might still see the replaced patch on the stack.
1094 * Fortunately, it is carefully designed to work with removed functions
1095 * thanks to RCU. We only have to keep the patches on the system. Also
1096 * this is handled transparently by patch->module_put.
1097 */
1098void klp_unpatch_replaced_patches(struct klp_patch *new_patch)
1099{
1100 struct klp_patch *old_patch;
1101
1102 klp_for_each_patch(old_patch) {
1103 if (old_patch == new_patch)
1104 return;
1105
1106 old_patch->enabled = false;
1107 klp_unpatch_objects(old_patch);
1108 }
1109}
1110
1111/*
1112 * This function removes the dynamically allocated 'nop' functions.
1113 *
1114 * We could be pretty aggressive. NOPs do not change the existing
1115 * behavior except for adding unnecessary delay by the ftrace handler.
1116 *
1117 * It is safe even when the transition was forced. The ftrace handler
1118 * will see a valid ops->func_stack entry thanks to RCU.
1119 *
1120 * We could even free the NOPs structures. They must be the last entry
1121 * in ops->func_stack. Therefore unregister_ftrace_function() is called.
1122 * It does the same as klp_synchronize_transition() to make sure that
1123 * nobody is inside the ftrace handler once the operation finishes.
1124 *
1125 * IMPORTANT: It must be called right after removing the replaced patches!
1126 */
1127void klp_discard_nops(struct klp_patch *new_patch)
1128{
1129 klp_unpatch_objects_dynamic(klp_transition_patch);
1130 klp_free_objects_dynamic(klp_transition_patch);
1131}
1132
1133/*
1134 * Remove parts of patches that touch a given kernel module. The list of
1135 * patches processed might be limited. When limit is NULL, all patches
1136 * will be handled.
1137 */
1138static void klp_cleanup_module_patches_limited(struct module *mod,
1139 struct klp_patch *limit)
1140{
1141 struct klp_patch *patch;
1142 struct klp_object *obj;
1143
1144 klp_for_each_patch(patch) {
1145 if (patch == limit)
1146 break;
1147
1148 klp_for_each_object(patch, obj) {
1149 if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
1150 continue;
1151
1152 if (patch != klp_transition_patch)
1153 klp_pre_unpatch_callback(obj);
1154
1155 pr_notice("reverting patch '%s' on unloading module '%s'\n",
1156 patch->mod->name, obj->mod->name);
1157 klp_unpatch_object(obj);
1158
1159 klp_post_unpatch_callback(obj);
1160
1161 klp_free_object_loaded(obj);
1162 break;
1163 }
1164 }
1165}
1166
1167int klp_module_coming(struct module *mod)
1168{
1169 int ret;
1170 struct klp_patch *patch;
1171 struct klp_object *obj;
1172
1173 if (WARN_ON(mod->state != MODULE_STATE_COMING))
1174 return -EINVAL;
1175
1176 if (!strcmp(mod->name, "vmlinux")) {
1177 pr_err("vmlinux.ko: invalid module name");
1178 return -EINVAL;
1179 }
1180
1181 mutex_lock(&klp_mutex);
1182 /*
1183 * Each module has to know that klp_module_coming()
1184 * has been called. We never know what module will
1185 * get patched by a new patch.
1186 */
1187 mod->klp_alive = true;
1188
1189 klp_for_each_patch(patch) {
1190 klp_for_each_object(patch, obj) {
1191 if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
1192 continue;
1193
1194 obj->mod = mod;
1195
1196 ret = klp_init_object_loaded(patch, obj);
1197 if (ret) {
1198 pr_warn("failed to initialize patch '%s' for module '%s' (%d)\n",
1199 patch->mod->name, obj->mod->name, ret);
1200 goto err;
1201 }
1202
1203 pr_notice("applying patch '%s' to loading module '%s'\n",
1204 patch->mod->name, obj->mod->name);
1205
1206 ret = klp_pre_patch_callback(obj);
1207 if (ret) {
1208 pr_warn("pre-patch callback failed for object '%s'\n",
1209 obj->name);
1210 goto err;
1211 }
1212
1213 ret = klp_patch_object(obj);
1214 if (ret) {
1215 pr_warn("failed to apply patch '%s' to module '%s' (%d)\n",
1216 patch->mod->name, obj->mod->name, ret);
1217
1218 klp_post_unpatch_callback(obj);
1219 goto err;
1220 }
1221
1222 if (patch != klp_transition_patch)
1223 klp_post_patch_callback(obj);
1224
1225 break;
1226 }
1227 }
1228
1229 mutex_unlock(&klp_mutex);
1230
1231 return 0;
1232
1233err:
1234 /*
1235 * If a patch is unsuccessfully applied, return
1236 * error to the module loader.
1237 */
1238 pr_warn("patch '%s' failed for module '%s', refusing to load module '%s'\n",
1239 patch->mod->name, obj->mod->name, obj->mod->name);
1240 mod->klp_alive = false;
1241 obj->mod = NULL;
1242 klp_cleanup_module_patches_limited(mod, patch);
1243 mutex_unlock(&klp_mutex);
1244
1245 return ret;
1246}
1247
1248void klp_module_going(struct module *mod)
1249{
1250 if (WARN_ON(mod->state != MODULE_STATE_GOING &&
1251 mod->state != MODULE_STATE_COMING))
1252 return;
1253
1254 mutex_lock(&klp_mutex);
1255 /*
1256 * Each module has to know that klp_module_going()
1257 * has been called. We never know what module will
1258 * get patched by a new patch.
1259 */
1260 mod->klp_alive = false;
1261
1262 klp_cleanup_module_patches_limited(mod, NULL);
1263
1264 mutex_unlock(&klp_mutex);
1265}
1266
1267static int __init klp_init(void)
1268{
1269 klp_root_kobj = kobject_create_and_add("livepatch", kernel_kobj);
1270 if (!klp_root_kobj)
1271 return -ENOMEM;
1272
1273 return 0;
1274}
1275
1276module_init(klp_init);