irq: set {msi_domain,syscore}_ops as __ro_after_init

Marked syscore_ops structs as __ro_after_init when register_syscore_ops was called only during init. Most of the caller functions were already annotated as __init.
unregister_syscore_ops() was never called on these ops.
This protects the data structure from accidental corruption.

Suggested-by Kees Cook <[email protected]>

Signed-off-by Jess Frazelle <[email protected]>

Acked-by Rik van Riel <[email protected]>

Quoted 6 lines · Jess Frazelle

Marked syscore_ops structs as __ro_after_init when register_syscore_ops was called only during init. Most of the caller functions were already annotated as __init.
unregister_syscore_ops() was never called on these ops.
This protects the data structure from accidental corruption.

Quoted 3 lines

Suggested-by Kees Cook <[email protected]>

Signed-off-by Jess Frazelle <[email protected]>

Acked-by Rik van Riel <[email protected]>

Thanks for sending this out. Looks reasonable to me. I'll queue it for testing, targeting for 4.12.

-----Original Message-----
From: Jess Frazelle [mailto:[email protected]]
Sent: Friday, February 10, 2017 5:38 PM
To: KY Srinivasan <[email protected]>; Haiyang Zhang <[email protected]>; Stephen Hemminger <[email protected]>; Bjorn Helgaas <[email protected]>; Keith Busch <[email protected]>; open list:Hyper-V CORE AND DRIVERS <[email protected]>; open list:PCI SUBSYSTEM <linux- [email protected]>; open list <[email protected]>
Cc: [email protected]; Jess Frazelle <[email protected]>
Subject: [PATCH v2 3/5] pci: set msi_domain_ops as __ro_after_init

Marked msi_domain_ops structs as __ro_after_init when called only during init.
This protects the data structure from accidental corruption.

Suggested-by Kees Cook <[email protected]>

Signed-off-by Jess Frazelle <[email protected]>

---
 drivers/pci/host/pci-hyperv.c | 2 +-
 drivers/pci/host/vmd.c        | 2 +-
 drivers/pci/msi.c             | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

drivers/pci/host/pci-hyperv.c +1 -1

index 3efcc7bdc5fb..f05b93689d8f 100644
@@ -958,7 +958,7 @@ static irq_hw_number_t
 hv_msi_domain_ops_get_hwirq(struct msi_domain_info *info,
 	return arg->msi_hwirq;
 }
 
-static struct msi_domain_ops hv_msi_ops = {
+static struct msi_domain_ops hv_msi_ops __ro_after_init = {
 	.get_hwirq	= hv_msi_domain_ops_get_hwirq,
 	.msi_prepare	= pci_msi_prepare,

drivers/pci/host/pci-hyperv.c +0 -0

 	.set_desc	= pci_msi_set_desc,

drivers/pci/host/vmd.c +1 -1

index 18ef1a93c10a..152c461538e4 100644
@@ -253,7 +253,7 @@ static void vmd_set_desc(msi_alloc_info_t *arg,
 struct msi_desc *desc)
 	arg->desc = desc;
 }
 
-static struct msi_domain_ops vmd_msi_domain_ops = {
+static struct msi_domain_ops vmd_msi_domain_ops __ro_after_init = {
 	.get_hwirq	= vmd_get_hwirq,
 	.msi_init	= vmd_msi_init,

drivers/pci/host/vmd.c +0 -0

 	.msi_free	= vmd_msi_free,

drivers/pci/msi.c +1 -1

index 50c5003295ca..93141d5e2d1c 100644
@@ -1413,7 +1413,7 @@ static void
 pci_msi_domain_set_desc(msi_alloc_info_t *arg,
 #define pci_msi_domain_set_desc		NULL
 #endif
 
-static struct msi_domain_ops pci_msi_domain_ops_default = {
+static struct msi_domain_ops pci_msi_domain_ops_default __ro_after_init
 = {
 	.set_desc	= pci_msi_domain_set_desc,

drivers/pci/msi.c +0 -1

 	.msi_check	= pci_msi_domain_check_cap,
 	.handle_error	= pci_msi_domain_handle_error,
--

2.11.0

Marked msi_domain_ops structs as __ro_after_init when called only during init. This protects the data structure from accidental corruption.

Suggested-by Kees Cook <[email protected]>

Signed-off-by Jess Frazelle <[email protected]>

 drivers/pci/host/pci-hyperv.c | 2 +-
 drivers/pci/host/vmd.c        | 2 +-

 drivers/pci/msi.c             | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

Marked msi_domain_ops structs as __ro_after_init when called only during init. This protects the data structure from accidental corruption.

Suggested-by Kees Cook <[email protected]>

Signed-off-by Jess Frazelle <[email protected]>

---
 drivers/pci/host/pci-hyperv.c | 2 +-
 drivers/pci/host/vmd.c        | 2 +-
 drivers/pci/msi.c             | 2 +-

 3 files changed, 3 insertions(+), 3 deletions(-)

drivers/pci/host/pci-hyperv.c +1 -1

index 3efcc7bdc5fb..f05b93689d8f 100644
@@ -958,7 +958,7 @@ static irq_hw_number_t hv_msi_domain_ops_get_hwirq(struct msi_domain_info *info,
 	return arg->msi_hwirq;
 }
 
-static struct msi_domain_ops hv_msi_ops = {
+static struct msi_domain_ops hv_msi_ops __ro_after_init = {
 	.get_hwirq	= hv_msi_domain_ops_get_hwirq,
 	.msi_prepare	= pci_msi_prepare,
 	.set_desc	= pci_msi_set_desc,

drivers/pci/host/vmd.c +1 -1

index 18ef1a93c10a..152c461538e4 100644
@@ -253,7 +253,7 @@ static void vmd_set_desc(msi_alloc_info_t *arg, struct msi_desc *desc)
 	arg->desc = desc;
 }
 
-static struct msi_domain_ops vmd_msi_domain_ops = {
+static struct msi_domain_ops vmd_msi_domain_ops __ro_after_init = {
 	.get_hwirq	= vmd_get_hwirq,
 	.msi_init	= vmd_msi_init,
 	.msi_free	= vmd_msi_free,

drivers/pci/msi.c +1 -2

index 50c5003295ca..93141d5e2d1c 100644
@@ -1413,7 +1413,7 @@ static void pci_msi_domain_set_desc(msi_alloc_info_t *arg,
 #define pci_msi_domain_set_desc		NULL
 #endif
 
-static struct msi_domain_ops pci_msi_domain_ops_default = {
+static struct msi_domain_ops pci_msi_domain_ops_default __ro_after_init = {
 	.set_desc	= pci_msi_domain_set_desc,
 	.msi_check	= pci_msi_domain_check_cap,
 	.handle_error	= pci_msi_domain_handle_error,
--

2.11.0

[+cc Kees, Thomas, Marc]

Hi Jess,

Thanks for the patch!

Quoted 9 lines · Jess Frazelle

Marked msi_domain_ops structs as __ro_after_init when called only during init. This protects the data structure from accidental corruption.

Suggested-by Kees Cook <[email protected]>

Signed-off-by Jess Frazelle <[email protected]>

---
 drivers/pci/host/pci-hyperv.c | 2 +-
 drivers/pci/host/vmd.c        | 2 +-
 drivers/pci/msi.c             | 2 +-

I understand the value of __ro_after_init, but I'm not certain about sprinkling it around in seemingly random places because it's hard to know where to put it and whether we put it in all the right places.

How did you choose these three files to change? There are other instances of struct msi_domain_ops that use MSI_FLAG_USE_DEF_DOM_OPS. Should they be changed, too? If not, is there a rule to figure out which ones should be made __ro_after_init?

I wonder if adding __ro_after_init is really the best solution. I looked at VMD to see how vmd_msi_domain_ops is updated. Here are the definitions:

  static struct msi_domain_ops vmd_msi_domain_ops = {
    .get_hwirq = vmd_get_hwirq,
    .msi_init  = vmd_msi_init,
    ...
  };

  static struct msi_domain_info vmd_msi_domain_info = {
    .flags = MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS |
             MSI_FLAG_PCI_MSIX,
    .ops = &vmd_msi_domain_ops,
    ...
  };

Both vmd_msi_domain_ops and vmd_msi_domain_info are statically initialized, but not completely. Then we pass a pointer to pci_msi_create_irq_domain(), which fills in defaults for some of the function pointers that weren't statically initialized:

vmd_enable_domain()

    pci_msi_create_irq_domain(NULL, &vmd_msi_domain_info, ...)
      if (info->flags & MSI_FLAG_USE_DEF_DOM_OPS)
        pci_msi_domain_update_dom_ops(info)
          if (ops->set_desc == NULL)
            ops->msi_check = pci_msi_domain_check_cap

We know at build-time what all the function pointers will be, so in principle we should be able to make the struct const, which would be even better than __ro_after_init.

For example, we could require that callers set every function pointer before calling pci_msi_create_irq_domain(), using the default ones (pci_msi_domain_set_desc, pci_msi_domain_check_cap, pci_msi_domain_handle_error) if it doesn't need to override them, e.g.,

  static struct msi_domain_ops vmd_msi_domain_ops = {
    .get_hwirq = vmd_get_hwirq,
    .msi_check = pci_msi_domain_check_cap,
  };

Or we could leave NULL pointers in the structure and have the code that calls through the function pointers check for NULL and call the default itself, e.g.,

if (ops->msi_check)

    ops->msi_check(...)
  else
    pci_msi_domain_check_cap(...)

It looks like the "USE_DEF_OPS" framework was added by Jiang Liu with the commits below. I would CC: him for his thoughts, but I don't have a current email address.

aeeb59657c35 ("genirq: Provide default callbacks for msi_domain_ops") 3878eaefb89a ("PCI/MSI: Enhance core to support hierarchy irqdomain")

We know at build-time what all the function pointers will be, so in principle we should be able to make the struct const, which would be even better than __ro_after_init.

For example, we could require that callers set every function pointer before calling pci_msi_create_irq_domain(), using the default ones (pci_msi_domain_set_desc, pci_msi_domain_check_cap, pci_msi_domain_handle_error) if it doesn't need to override them, e.g.,

  static struct msi_domain_ops vmd_msi_domain_ops = {
    .get_hwirq = vmd_get_hwirq,
    .msi_check = pci_msi_domain_check_cap,
  };

Or we could leave NULL pointers in the structure and have the code that calls through the function pointers check for NULL and call the default itself, e.g.,

if (ops->msi_check)

    ops->msi_check(...)
  else
    pci_msi_domain_check_cap(...)

It looks like the "USE_DEF_OPS" framework was added by Jiang Liu with the commits below. I would CC: him for his thoughts, but I don't have a current email address.

I think I suggested to Jiang to do that 'update with default functions' to

- avoid exporting the world and some more

- have the flexibility to add new functions to the ops w/o updating a gazillion of existing usage sites, which has saved us lots of chaising in the last years

- avoid the if (ops->ptr) ops->ptr(); else default_fn(); constructs all over the place.

I admit I did not think about the fact that this makes the structs non const.

Mopping that up by exporting the default functions and setting all the function pointers is tedious and requires a full tree sweep when we add new stuff. There's also code shared between PCI/platform/DT based stuff, so that becomes interesting.

Doing the if (ops->ptr) ops->ptr() else default_fn(); dance should be simpler to pull off. There are not that many sites to look at, but then we have some of the GICv3 code using the domain ops out of core.

For now doing the __ro_after_init is definitely the simplest and fastest solution to tighten these statically allocated structures.

Quoted 11 lines · Thomas Gleixner

I think I suggested to Jiang to do that 'update with default functions' to

- avoid exporting the world and some more

- have the flexibility to add new functions to the ops w/o updating a gazillion of existing usage sites, which has saved us lots of chaising in the last years

- avoid the if (ops->ptr) ops->ptr(); else default_fn(); constructs all over the place.

Quoted 7 lines

I admit I did not think about the fact that this makes the structs non const.

Mopping that up by exporting the default functions and setting all the function pointers is tedious and requires a full tree sweep when we add new stuff. There's also code shared between PCI/platform/DT based stuff, so that becomes interesting.

It's legal to initialize a field multiple times, and the last one takes precedence, so doing this might at least avoid the full tree sweeps:

  static struct msi_domain_ops vmd_msi_domain_ops = {
    MSI_DOMAIN_DEFAULT_OPS,
    .get_hwirq = vmd_get_hwirq,
  };

The functions referenced by MSI_DOMAIN_DEFAULT_OPS would still have to be exported, though.

Quoted 6 lines

Doing the if (ops->ptr) ops->ptr() else default_fn(); dance should be simpler to pull off. There are not that many sites to look at, but then we have some of the GICv3 code using the domain ops out of core.

For now doing the __ro_after_init is definitely the simplest and fastest solution to tighten these statically allocated structures.

I'm OK with __ro_after_init, at least as an interim solution.

I do think it would be good to audit all the uses of MSI_FLAG_USE_DEF_DOM_OPS and MSI_FLAG_USE_DEF_CHIP_OPS, since they seem to be the primary indicator of when the struct might be modified. I suspect we could add __ro_after_init to more than just pci-hyperv.c, vmd.c, and msi.c

Quoted 25 lines · Bjorn Helgaas

Quoted 11 lines · Thomas Gleixner

I think I suggested to Jiang to do that 'update with default functions' to

- avoid exporting the world and some more

- have the flexibility to add new functions to the ops w/o updating a gazillion of existing usage sites, which has saved us lots of chaising in the last years

- avoid the if (ops->ptr) ops->ptr(); else default_fn(); constructs all over the place.

Quoted 7 lines

I admit I did not think about the fact that this makes the structs non const.

Mopping that up by exporting the default functions and setting all the function pointers is tedious and requires a full tree sweep when we add new stuff. There's also code shared between PCI/platform/DT based stuff, so that becomes interesting.

It's legal to initialize a field multiple times, and the last one takes precedence, so doing this might at least avoid the full tree sweeps:

Quoted 7 lines

  static struct msi_domain_ops vmd_msi_domain_ops = {
    MSI_DOMAIN_DEFAULT_OPS,
    .get_hwirq = vmd_get_hwirq,
  };

The functions referenced by MSI_DOMAIN_DEFAULT_OPS would still have to be exported, though.

Hmm, that'd work. Though it will fall apart for those pieces where we share code across backends. But I did not yet go through all the places and check them.

Quoted 9 lines

Quoted 6 lines

Doing the if (ops->ptr) ops->ptr() else default_fn(); dance should be simpler to pull off. There are not that many sites to look at, but then we have some of the GICv3 code using the domain ops out of core.

For now doing the __ro_after_init is definitely the simplest and fastest solution to tighten these statically allocated structures.

I'm OK with __ro_after_init, at least as an interim solution.

Quoted 5 lines

I do think it would be good to audit all the uses of MSI_FLAG_USE_DEF_DOM_OPS and MSI_FLAG_USE_DEF_CHIP_OPS, since they seem to be the primary indicator of when the struct might be modified. I suspect we could add __ro_after_init to more than just pci-hyperv.c, vmd.c, and msi.c

Agreed. I have it on my radar.

Quoted 47 lines · Thomas Gleixner

Quoted 25 lines · Bjorn Helgaas

Quoted 11 lines · Thomas Gleixner

I think I suggested to Jiang to do that 'update with default functions' to

- avoid exporting the world and some more

- have the flexibility to add new functions to the ops w/o updating a gazillion of existing usage sites, which has saved us lots of chaising in the last years

- avoid the if (ops->ptr) ops->ptr(); else default_fn(); constructs all over the place.

Quoted 7 lines

I admit I did not think about the fact that this makes the structs non const.

Mopping that up by exporting the default functions and setting all the function pointers is tedious and requires a full tree sweep when we add new stuff. There's also code shared between PCI/platform/DT based stuff, so that becomes interesting.

It's legal to initialize a field multiple times, and the last one takes precedence, so doing this might at least avoid the full tree sweeps:

Quoted 7 lines

  static struct msi_domain_ops vmd_msi_domain_ops = {
    MSI_DOMAIN_DEFAULT_OPS,
    .get_hwirq = vmd_get_hwirq,
  };

The functions referenced by MSI_DOMAIN_DEFAULT_OPS would still have to be exported, though.

Hmm, that'd work. Though it will fall apart for those pieces where we share code across backends. But I did not yet go through all the places and check them.

Quoted 9 lines

Quoted 6 lines

Doing the if (ops->ptr) ops->ptr() else default_fn(); dance should be simpler to pull off. There are not that many sites to look at, but then we have some of the GICv3 code using the domain ops out of core.

For now doing the __ro_after_init is definitely the simplest and fastest solution to tighten these statically allocated structures.

I'm OK with __ro_after_init, at least as an interim solution.

Quoted 7 lines

Quoted 5 lines

I do think it would be good to audit all the uses of MSI_FLAG_USE_DEF_DOM_OPS and MSI_FLAG_USE_DEF_CHIP_OPS, since they seem to be the primary indicator of when the struct might be modified. I suspect we could add __ro_after_init to more than just pci-hyperv.c, vmd.c, and msi.c

Agreed. I have it on my radar.

This seems like a worthwhile change, so I don't want to just drop this patch. But if we're going to do something, I'd like to do it everywhere that it makes sense, all at the same time.

It looks like the v2 series was split up by subsystem, which is fine with me. I'll happily apply the PCI parts (or ack them, since it might make sense to apply all of them via the same non-PCI tree).

But I *would* like to include the following users of MSI_FLAG_USE_DEF_DOM_OPS and MSI_FLAG_USE_DEF_CHIP_OPS at the same time (or explain why __ro_after_init won't work for them):

pci-xgene-msi.c
pcie-altera-msi.c
pcie-iproc-msi.c
pcie-xilinx-nwl.c

Bjorn

I can update the patch series, sorry haven't had much time to devote to this the past few weeks, but will update in the next day.

Marked msi_domain_ops structs as __ro_after_init when called only during init. Marked syscore_ops structs as __ro_after_init when register_syscore_ops was called only during init. Most of the caller functions were already annotated as __init.
unregister_syscore_ops() was never called on these syscore_ops. This protects the data structure from accidental corruption.

Quoted 6 lines · Jess Frazelle

Marked msi_domain_ops structs as __ro_after_init when called only during init. Marked syscore_ops structs as __ro_after_init when register_syscore_ops was called only during init. Most of the caller functions were already annotated as __init.
unregister_syscore_ops() was never called on these syscore_ops. This protects the data structure from accidental corruption.

Please be more careful with your changelogs. They should not start with telling WHAT you have done. The WHAT we can see from the patch.

The interesting information which belongs into the changelog is: WHY and which problem does it solve or which enhancement this is. Let me give you an example:

Function pointers are a target for attacks especially when they are located in statically allocated data structures. Some of these data structures are only modified during init and therefor can be made read only after init.

struct msi_domain_ops can be made read only after init because they are only updated in the registration case.

struct syscore_ops can be made read only after init when they are only registered, but never unregistered.

So this would be a proper change log explaning the patch.

Emphasis on WOULD, See below.

kernel/irq/generic-chip.c static void irq_gc_shutdown(void) · line 629

Quoted 5 lines

kernel/irq/generic-chip.c +1 -1

-static struct syscore_ops irq_gc_syscore_ops = {
+static struct syscore_ops irq_gc_syscore_ops __ro_after_init = {
 	.suspend = irq_gc_suspend,
 	.resume = irq_gc_resume,
 	.shutdown = irq_gc_shutdown,

I seriously doubt that syscore_ops can be made __ro_after_init at all.

Assume the following:

last_init_function()
register_syscore_ops(&a_ops)

    list_add(&a_ops->node, list);

apply_ro_after_init()
// a_ops are now read only

cpuhotplug happens
register_syscore_ops(&b_ops)

    list_add(&b_ops->node, list);

    ===> Kernel crashes with a write access on RO memory because it tries
    	 to link b_ops to a_ops.

The same is true for cpuhotunplug operations.

Quoted 1 line · Jess Frazelle

Marked msi_domain_ops structs as __ro_after_init when called only

during init.

Quoted 1 line

Marked syscore_ops structs as __ro_after_init when

register_syscore_ops was

Quoted 1 line

called only during init. Most of the caller functions were already

annotated as

Quoted 3 lines

__init.
unregister_syscore_ops() was never called on these syscore_ops. This protects the data structure from accidental corruption.

Please be more careful with your changelogs. They should not start with telling WHAT you have done. The WHAT we can see from the patch.

The interesting information which belongs into the changelog is: WHY and
which problem does it solve or which enhancement this is. Let me give you
an example:

Function pointers are a target for attacks especially when they are located in statically allocated data structures. Some of these data
structures are only modified during init and therefor can be made read
only after init.

struct msi_domain_ops can be made read only after init because they are
only updated in the registration case.

struct syscore_ops can be made read only after init when they are only
registered, but never unregistered.

So this would be a proper change log explaning the patch.

Emphasis on WOULD, See below.

kernel/irq/generic-chip.c static void irq_gc_shutdown(void) · line 629

Quoted 5 lines

kernel/irq/generic-chip.c +1 -1

-static struct syscore_ops irq_gc_syscore_ops = {
+static struct syscore_ops irq_gc_syscore_ops __ro_after_init = {
 	.suspend = irq_gc_suspend,
 	.resume = irq_gc_resume,
 	.shutdown = irq_gc_shutdown,

I seriously doubt that syscore_ops can be made __ro_after_init at all.

Assume the following:

last_init_function()
register_syscore_ops(&a_ops)
list_add(&a_ops->node, list);

apply_ro_after_init()
// a_ops are now read only

cpuhotplug happens
register_syscore_ops(&b_ops)
list_add(&b_ops->node, list);

===> Kernel crashes with a write access on RO memory because it tries
to link b_ops to a_ops.

The same is true for cpuhotunplug operations.

Review

Quoted 3 lines

(quoted diff) +1 -1

-static struct msi_domain_ops msi_domain_ops_default = {
+static struct msi_domain_ops msi_domain_ops_default __ro_after_init

= {

This is pointless and just tells me that you did a mechanical search for
these ops and then blindly added __ro_after_init instead of analysing how
msi_domain_ops_default is used.

msi_domain_ops_default are never ever modified, so they should be made 'const' and not __ro_after_init. It's not that hard to figure that out from
the code.

Thanks,

tglx

Quoted 1 line · Thomas Gleixner

The same is true for cpuhotunplug operations.

This makes sense. Will remove.

Quoted 4 lines · Jess Frazelle

Quoted 1 line · Thomas Gleixner

The same is true for cpuhotunplug operations.

This makes sense. Will remove.

That's true for all other patches touching sysops as well. But instead of giving up I'd recommend to look into the following:

Go through all callsites which use un/register_syscore_ops() and figure out how many of them are possibly called post init. From a quick grep I can only find the KVM module, but there might be more.

Lets assume it's KVM only. So you could do the following:

Put something like this into virt/kvm/kvm_main.c, which is a builtin file

static struct syscore_ops ops __ro_after_init = {
       ....
};

int __init foo()

{
    register_ops(&ops);
}

and because we know that kvm is single instance you can just have:

static struct syscore_ops *kvm_ops;

void kvm_set_sysop(*vmx_ops)

{
        kvm_ops = ops;
}

and then have the kvm_syscore callbacks:

static callback()

{
        if (kvm_ops)
           kvm_ops->callback()
}

Sanity checks and serialization omitted. Then switch kvm_exit/init over to it.

After that you can make all syscore_ops __ro_after_init, remove the export from (un)register_syscore_ops() and make that __init.

Not much of an effort and probably worth the trouble.

Thanks,

tglx