Skip to contentSkip to conversation

kernel/kcov: unproxify debugfs file's fops

PATCH Superseded Nicolai Stange 2 participants 3 messages May 23, 2016 – May 24, 2016 KCOV

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 kernel/kcov: unproxify debugfs file's fops

Since commit 49d200deaa68 ("debugfs: prevent access to removed files' private data"), a debugfs file's file_operations methods get proxied through lifetime aware wrappers.

However, only a certain subset of the file_operations members is supported by debugfs and ->mmap isn't among them -- it appears to be NULL from the VFS layer's perspective.

This behaviour breaks the /sys/kernel/debug/kcov file introduced concurrently with commit 5c9a8750a640 ("kernel: add kcov code coverage").

Since that file never gets removed, there is no file removal race and thus, a lifetime checking proxy isn't needed.

Avoid the proxying for /sys/kernel/debug/kcov by creating it via debugfs_create_file_unsafe() rather than debugfs_create_file().

Fixes 49d200deaa68 ("debugfs: prevent access to removed files' private
                      data")
Fixes 5c9a8750a640 ("kernel: add kcov code coverage")

---
Applicable to linux-next 20160523.
In particular, it depends on
- c64688081490 ("debugfs: add support for self-protecting attribute file

                  fops")

- 5c9a8750a640 ("kernel: add kcov code coverage")

This issue has been debugged and reported by
Sasha Levin <[email protected]>:
http://lkml.kernel.org/g/[email protected]

 kernel/kcov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kcov.c +1 -1
index a02f2dd..4c349dd 100644
@@ -264,7 +264,7 @@ static const struct file_operations kcov_fops = {
 
 static int __init kcov_init(void)
 {
-	if (!debugfs_create_file("kcov", 0600, NULL, NULL, &kcov_fops)) {
+	if (!debugfs_create_file_unsafe("kcov", 0600, NULL, NULL, &kcov_fops)) {
 		pr_err("failed to create kcov in debugfs\n");
 		return -ENOMEM;
 	}
Signature · 1 line
2.8.2
#1 lore raw
Quoted 40 lines · Nicolai Stange

Since commit 49d200deaa68 ("debugfs: prevent access to removed files' private data"), a debugfs file's file_operations methods get proxied through lifetime aware wrappers.

However, only a certain subset of the file_operations members is supported by debugfs and ->mmap isn't among them -- it appears to be NULL from the VFS layer's perspective.

This behaviour breaks the /sys/kernel/debug/kcov file introduced concurrently with commit 5c9a8750a640 ("kernel: add kcov code coverage").

Since that file never gets removed, there is no file removal race and thus, a lifetime checking proxy isn't needed.

Avoid the proxying for /sys/kernel/debug/kcov by creating it via debugfs_create_file_unsafe() rather than debugfs_create_file().

Fixes 49d200deaa68 ("debugfs: prevent access to removed files' private
                      data")
Fixes 5c9a8750a640 ("kernel: add kcov code coverage")

---
Applicable to linux-next 20160523.
In particular, it depends on
- c64688081490 ("debugfs: add support for self-protecting attribute file

                  fops")

- 5c9a8750a640 ("kernel: add kcov code coverage")

This issue has been debugged and reported by
Sasha Levin <[email protected]>:
http://lkml.kernel.org/g/[email protected]

 kernel/kcov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kcov.c +0 -0
index a02f2dd..4c349dd 100644

kernel/kcov.c static const struct file_operations kcov_fops = { · line 267

Quoted 5 lines
kernel/kcov.c +1 -1
@@ -264,7 +264,7 @@ static const struct file_operations kcov_fops = {
 
 static int __init kcov_init(void)
 {
-       if (!debugfs_create_file("kcov", 0600, NULL, NULL, &kcov_fops)) {
+       if (!debugfs_create_file_unsafe("kcov", 0600, NULL, NULL, &kcov_fops)) {

It might make sense to add a comment above this to describe why "unsafe" is not unsafe in this case.

-Kees

Quoted 6 lines
kernel/kcov.c +0 -1
                pr_err("failed to create kcov in debugfs\n");
                return -ENOMEM;
        }
--

2.8.2

Signature · 2 lines
Kees Cook
Chrome OS & Brillo Security
#2 lore raw
Quoted 42 lines · Kees Cook
Quoted 41 lines · Nicolai Stange

Since commit 49d200deaa68 ("debugfs: prevent access to removed files' private data"), a debugfs file's file_operations methods get proxied through lifetime aware wrappers.

However, only a certain subset of the file_operations members is supported by debugfs and ->mmap isn't among them -- it appears to be NULL from the VFS layer's perspective.

This behaviour breaks the /sys/kernel/debug/kcov file introduced concurrently with commit 5c9a8750a640 ("kernel: add kcov code coverage").

Since that file never gets removed, there is no file removal race and thus, a lifetime checking proxy isn't needed.

Avoid the proxying for /sys/kernel/debug/kcov by creating it via debugfs_create_file_unsafe() rather than debugfs_create_file().

Fixes 49d200deaa68 ("debugfs: prevent access to removed files' private
                      data")
Fixes 5c9a8750a640 ("kernel: add kcov code coverage")

---
Applicable to linux-next 20160523.
In particular, it depends on
- c64688081490 ("debugfs: add support for self-protecting attribute file

                  fops")

- 5c9a8750a640 ("kernel: add kcov code coverage")

This issue has been debugged and reported by
Sasha Levin <[email protected]>:
http://lkml.kernel.org/g/[email protected]

 kernel/kcov.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kcov.c +0 -0
index a02f2dd..4c349dd 100644
@@ -264,7 +264,7 @@ static const struct file_operations kcov_fops = {
 
Quoted 7 lines

kernel/kcov.c static const struct file_operations kcov_fops = { · line 267

Quoted 4 lines
kernel/kcov.c +1 -1
 static int __init kcov_init(void)
 {
-       if (!debugfs_create_file("kcov", 0600, NULL, NULL, &kcov_fops)) {
+       if (!debugfs_create_file_unsafe("kcov", 0600, NULL, NULL, &kcov_fops)) {

It might make sense to add a comment above this to describe why "unsafe" is not unsafe in this case.

Done. v2 can be found at
http://lkml.kernel.org/g/[email protected]

Thanks,

Nicolai

Quoted 9 lines

-Kees

Quoted 6 lines
kernel/kcov.c +0 -1
                pr_err("failed to create kcov in debugfs\n");
                return -ENOMEM;
        }
--

2.8.2