lib: code tagging module support

Add support for code tagging from dynamically loaded modules.

Link: https://lkml.kernel.org/r/20240321163705.3067592-12-surenb@google.com
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Co-developed-by: Kent Overstreet <kent.overstreet@linux.dev>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
Tested-by: Kees Cook <keescook@chromium.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Alex Gaynor <alex.gaynor@gmail.com>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Andreas Hindborg <a.hindborg@samsung.com>
Cc: Benno Lossin <benno.lossin@proton.me>
Cc: "Björn Roy Baron" <bjorn3_gh@protonmail.com>
Cc: Boqun Feng <boqun.feng@gmail.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Gary Guo <gary@garyguo.net>
Cc: Miguel Ojeda <ojeda@kernel.org>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Wedson Almeida Filho <wedsonaf@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/include/linux/codetag.h b/include/linux/codetag.h
index 7734269cdb63f9bc8dd21ce39bed60cb1e195881..c44f5b83f24d6a2cc690a19106f530e9caf169a6 100644 (file)
--- a/include/linux/codetag.h
+++ b/include/linux/codetag.h
@@ -33,6 +33,10 @@ union codetag_ref {
 struct codetag_type_desc {
        const char *section;
        size_t tag_size;
+       void (*module_load)(struct codetag_type *cttype,
+                           struct codetag_module *cmod);
+       void (*module_unload)(struct codetag_type *cttype,
+                             struct codetag_module *cmod);
 };
 
 struct codetag_iterator {
@@ -65,4 +69,12 @@ void codetag_to_text(struct seq_buf *out, struct codetag *ct);
 struct codetag_type *
 codetag_register_type(const struct codetag_type_desc *desc);
 
+#if defined(CONFIG_CODE_TAGGING) && defined(CONFIG_MODULES)
+void codetag_load_module(struct module *mod);
+void codetag_unload_module(struct module *mod);
+#else
+static inline void codetag_load_module(struct module *mod) {}
+static inline void codetag_unload_module(struct module *mod) {}
+#endif
+
 #endif /* _LINUX_CODETAG_H */

diff --git a/kernel/module/main.c b/kernel/module/main.c
index e1e8a7a9d6c193c092b02239446750c3ec4e8f10..ffa6b3e9cb43bccf5107ce56d5fa15fd98f4aa5d 100644 (file)
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -56,6 +56,7 @@
 #include <linux/dynamic_debug.h>
 #include <linux/audit.h>
 #include <linux/cfi.h>
+#include <linux/codetag.h>
 #include <linux/debugfs.h>
 #include <uapi/linux/module.h>
 #include "internal.h"
@@ -1242,6 +1243,7 @@ static void free_module(struct module *mod)
 {
        trace_module_free(mod);
 
+       codetag_unload_module(mod);
        mod_sysfs_teardown(mod);
 
        /*
@@ -2995,6 +2997,8 @@ static int load_module(struct load_info *info, const char __user *uargs,
        /* Get rid of temporary copy. */
        free_copy(info, flags);
 
+       codetag_load_module(mod);
+
        /* Done! */
        trace_module_load(mod);
 

diff --git a/lib/codetag.c b/lib/codetag.c
index 8b5b89ad508dfaa1dbb9ae0b7e96e4576bac452e..54d2828eba25667bf89636c94f31095f149a1833 100644 (file)
--- a/lib/codetag.c
+++ b/lib/codetag.c
@@ -124,15 +124,20 @@ static void *get_symbol(struct module *mod, const char *prefix, const char *name
 {
        DECLARE_SEQ_BUF(sb, KSYM_NAME_LEN);
        const char *buf;
+       void *ret;
 
        seq_buf_printf(&sb, "%s%s", prefix, name);
        if (seq_buf_has_overflowed(&sb))
                return NULL;
 
        buf = seq_buf_str(&sb);
-       return mod ?
+       preempt_disable();
+       ret = mod ?
                (void *)find_kallsyms_symbol_value(mod, buf) :
                (void *)kallsyms_lookup_name(buf);
+       preempt_enable();
+
+       return ret;
 }
 
 static struct codetag_range get_section_range(struct module *mod,
@@ -173,8 +178,11 @@ static int codetag_module_init(struct codetag_type *cttype, struct module *mod)
 
        down_write(&cttype->mod_lock);
        err = idr_alloc(&cttype->mod_idr, cmod, 0, 0, GFP_KERNEL);
-       if (err >= 0)
+       if (err >= 0) {
                cttype->count += range_size(cttype, &range);
+               if (cttype->desc.module_load)
+                       cttype->desc.module_load(cttype, cmod);
+       }
        up_write(&cttype->mod_lock);
 
        if (err < 0) {
@@ -185,6 +193,52 @@ static int codetag_module_init(struct codetag_type *cttype, struct module *mod)
        return 0;
 }
 
+void codetag_load_module(struct module *mod)
+{
+       struct codetag_type *cttype;
+
+       if (!mod)
+               return;
+
+       mutex_lock(&codetag_lock);
+       list_for_each_entry(cttype, &codetag_types, link)
+               codetag_module_init(cttype, mod);
+       mutex_unlock(&codetag_lock);
+}
+
+void codetag_unload_module(struct module *mod)
+{
+       struct codetag_type *cttype;
+
+       if (!mod)
+               return;
+
+       mutex_lock(&codetag_lock);
+       list_for_each_entry(cttype, &codetag_types, link) {
+               struct codetag_module *found = NULL;
+               struct codetag_module *cmod;
+               unsigned long mod_id, tmp;
+
+               down_write(&cttype->mod_lock);
+               idr_for_each_entry_ul(&cttype->mod_idr, cmod, tmp, mod_id) {
+                       if (cmod->mod && cmod->mod == mod) {
+                               found = cmod;
+                               break;
+                       }
+               }
+               if (found) {
+                       if (cttype->desc.module_unload)
+                               cttype->desc.module_unload(cttype, cmod);
+
+                       cttype->count -= range_size(cttype, &cmod->range);
+                       idr_remove(&cttype->mod_idr, mod_id);
+                       kfree(cmod);
+               }
+               up_write(&cttype->mod_lock);
+       }
+       mutex_unlock(&codetag_lock);
+}
+
 #else /* CONFIG_MODULES */
 static int codetag_module_init(struct codetag_type *cttype, struct module *mod) { return 0; }
 #endif /* CONFIG_MODULES */