module: fix symbol waiting when module fails before init

The original module-init-tools module loader used a fnctl lock on the .ko file to avoid attempts to simultaneously load a module. Unfortunately, you can't get an exclusive fcntl lock on a read-only fd, making this not work for read-only mounted filesystems. module-init-tools has a hacky sleep-and-loop for this now.

It's not that hard to wait in the kernel, and only return -EEXIST once the first module has finished loading (or continue loading the module if the first one failed to initialize for some reason). It's also consistent with what we do for dependent modules which are still loading.

Suggested-by Lucas De Marchi <[email protected]>

Signed-off-by Rusty Russell <[email protected]>

---
 kernel/module.c |   28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

kernel/module.c +3 -0

@@ -2845,6 +2845,20 @@ static int post_relocation(struct module
        return module_finalize(info->hdr, info->sechdrs, mod);
 }
 
+/* Is this module of this name done loading?  No locks held. */
+static bool finished_loading(const char *name)
+{

kernel/module.c +3 -1

+
 /* Allocate and load the module: note that size of section 0 is always
    zero, and we rely on this for optional sections. */
 static struct module *load_module(void __user *umod,

@@ -2852,7 +2866,7 @@ static struct module *load_module(void _
                                  const char __user *uargs)
 {
        struct load_info info = { NULL, };
-       struct module *mod;
+       struct module *mod, *old;
        long err;
 
        pr_debug("load_module: umod=%p, len=%lu, uargs=%p\n",

@@ -2918,8 +2932,18 @@ static struct module *load_module(void _
         * function to insert in a way safe to concurrent readers.
         * The mutex protects against concurrent writers.
         */
+again:
        mutex_lock(&module_mutex);

kernel/module.c static struct module *load_module(void _ · line 2945

Quoted 10 lines

kernel/module.c +9 -1

-       if (find_module(mod->name)) {
+       if ((old = find_module(mod->name)) != NULL) {
+               if (old->state == MODULE_STATE_COMING) {
+                       /* Wait in case it fails to load. */
+                       mutex_unlock(&module_mutex);
+                       err = wait_event_interruptible(module_wq,
+                                              finished_loading(mod->name));
+                       if (err)
+                               goto free_arch_cleanup;
+                       goto again;

I wonder if we should indeed retry in case the module failed to load or if we should just skip straight to returning the error code. We don't have the return code for the failed load, but maybe we can fabricate one here.

Thoughts?

Quoted 16 lines · Lucas De Marchi

kernel/module.c static struct module *load_module(void _ · line 2945

Quoted 10 lines

kernel/module.c +9 -1

-       if (find_module(mod->name)) {
+       if ((old = find_module(mod->name)) != NULL) {
+               if (old->state == MODULE_STATE_COMING) {
+                       /* Wait in case it fails to load. */
+                       mutex_unlock(&module_mutex);
+                       err = wait_event_interruptible(module_wq,
+                                              finished_loading(mod->name));
+                       if (err)
+                               goto free_arch_cleanup;
+                       goto again;

I wonder if we should indeed retry in case the module failed to load or if we should just skip straight to returning the error code. We don't have the return code for the failed load, but maybe we can fabricate one here.

Quoted 1 line

Thoughts?

Could have different cmdline parameters, or other randomness like out-of-memory. I think this is safest.

We use resolve_symbol_wait(), which blocks if the module containing the symbol is still loading. However:

1) The module_wq we use is only woken after calling the modules' init function, but there are other failure paths after the module is placed in the linked list where we need to do the same thing.

2) wake_up() only wakes one waiter, and our waitqueue is shared by all modules, so we need to wake them all.

3) wake_up_all() doesn't imply a memory barrier: I feel happier calling it after we've grabbed and dropped the module_mutex, not just after the state assignment.

Signed-off-by Rusty Russell <[email protected]>

---
 kernel/module.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

kernel/module.c +3 -4

@@ -2959,7 +2959,7 @@ static struct module *load_module(void _
        /* Unlink carefully: kallsyms could be walking list. */
        list_del_rcu(&mod->list);
        module_bug_cleanup(mod);
-
+       wake_up_all(&module_wq);
  ddebug:
        dynamic_debug_remove(info.debug);
  unlock:

@@ -3034,7 +3034,7 @@ SYSCALL_DEFINE3(init_module, void __user
                blocking_notifier_call_chain(&module_notify_list,
                                             MODULE_STATE_GOING, mod);
                free_module(mod);
-               wake_up(&module_wq);
+               wake_up_all(&module_wq);
                return ret;
        }
        if (ret > 0) {

@@ -3046,9 +3046,8 @@ SYSCALL_DEFINE3(init_module, void __user
                dump_stack();
        }
 
-       /* Now it's a first class citizen!  Wake up anyone waiting for it. */
+       /* Now it's a first class citizen! */
        mod->state = MODULE_STATE_LIVE;
-       wake_up(&module_wq);
        blocking_notifier_call_chain(&module_notify_list,
                                     MODULE_STATE_LIVE, mod);