// SPDX-License-Identifier: GPL-2.0-or-later /* * Copyright ( C ) 2002 Richard Henderson * Copyright ( C ) 2001 Rusty Russell , 2002 , 2010 Rusty Russell IBM . * Copyright ( C ) 2023 Luis Chamberlain < mcgrof @ kernel . org > #define INCLUDE_VERMAGIC#include <linux/export.h>#include <linux/extable.h>#include <linux/moduleloader.h>#include <linux/module_signature.h>#include <linux/trace_events.h>#include <linux/init.h>#include <linux/kallsyms.h>#include <linux/buildid.h>#include <linux/fs.h>#include <linux/kernel.h>#include <linux/kernel_read_file.h>#include <linux/kstrtox.h>#include <linux/slab.h>#include <linux/vmalloc.h>#include <linux/elf.h>#include <linux/seq_file.h>#include <linux/syscalls.h>#include <linux/fcntl.h>#include <linux/rcupdate.h>#include <linux/capability.h>#include <linux/cpu.h>#include <linux/moduleparam.h>#include <linux/errno.h>#include <linux/err.h>#include <linux/vermagic.h>#include <linux/notifier.h>#include <linux/sched.h>#include <linux/device.h>#include <linux/string.h>#include <linux/mutex.h>#include <linux/rculist.h>#include <linux/uaccess.h>#include <asm /cacheflush.h>#include <linux/set_memory.h>#include <asm /mmu_context.h>#include <linux/license.h>#include <asm /sections.h>#include <linux/tracepoint.h>#include <linux/ftrace.h>#include <linux/livepatch.h>#include <linux/async.h>#include <linux/percpu.h>#include <linux/kmemleak.h>#include <linux/jump_label.h>#include <linux/pfn.h>#include <linux/bsearch.h>#include <linux/dynamic_debug.h>#include <linux/audit.h>#include <linux/cfi.h>#include <linux/codetag.h>#include <linux/debugfs.h>#include <linux/execmem.h>#include <uapi/linux/module.h>#include "internal.h" #define CREATE_TRACE_POINTS#include <trace/events/module.h>/* * Mutex protects : * 1 ) List of modules ( also safely readable within RCU read section ) , * 2 ) module_use links , * 3 ) mod_tree . addr_min / mod_tree . addr_max . * ( delete and add uses RCU list operations ) . /* Work queue for freeing init sections in success case */ static void do_free_init(struct work_struct *w);static DECLARE_WORK(init_free_wq, do_free_init);static LLIST_HEAD(init_free_list);struct mod_tree_root mod_tree __cacheline_aligned = {1 UL,struct symsearch {const struct kernel_symbol *start, *stop;const u32 *crcs;enum mod_license license;/* * Bounds of module memory , for speeding up _ _ module_address . * Protected by module_mutex . static void __mod_update_bounds(enum mod_mem_type type __maybe_unused, void *base,unsigned int size, struct mod_tree_root *tree)unsigned long min = (unsigned long )base;unsigned long max = min + size;#ifdef CONFIG_ARCH_WANTS_MODULES_DATA_IN_VMALLOCif (mod_mem_type_is_core_data(type)) {if (min < tree->data_addr_min)if (max > tree->data_addr_max)return ;#endif if (min < tree->addr_min)if (max > tree->addr_max)static void mod_update_bounds(struct module *mod)struct module_memory *mod_mem = &mod->mem[type];if (mod_mem->size)/* Block module loading/unloading? */ static int modules_disabled;0 );static const struct ctl_table module_sysctl_table[] = {"modprobe" ,0644 ,"modules_disabled" ,sizeof (int ),0644 ,/* only handle a transition from default "0" to "1" */ static int __init init_module_sysctl(void )"kernel" , module_sysctl_table);return 0 ;/* Waiting for a module to finish initializing? */ static DECLARE_WAIT_QUEUE_HEAD(module_wq);static BLOCKING_NOTIFIER_HEAD(module_notify_list);int register_module_notifier(struct notifier_block *nb)return blocking_notifier_chain_register(&module_notify_list, nb);int unregister_module_notifier(struct notifier_block *nb)return blocking_notifier_chain_unregister(&module_notify_list, nb);/* * We require a truly strong try_module_get ( ) : 0 means success . * Otherwise an error is returned due to ongoing or failed * initialization etc . static inline int strong_try_module_get(struct module *mod)if (mod && mod->state == MODULE_STATE_COMING)return -EBUSY;if (try_module_get(mod))return 0 ;else return -ENOENT;static inline void add_taint_module(struct module *mod, unsigned flag,enum lockdep_ok lockdep_ok)/* * Like strncmp ( ) , except s / - / _ / g as per scripts / Makefile . lib : name - fix - token rule . static int mod_strncmp(const char *str_a, const char *str_b, size_t n)for (int i = 0 ; i < n; i++) {char a = str_a[i];char b = str_b[i];int d;if (a == '-' ) a = '_' ;if (b == '-' ) b = '_' ;if (d)return d;if (!a)break ;return 0 ;/* * A thread that wants to hold a reference to a module only while it * is running can call this to safely exit . void __noreturn __module_put_and_kthread_exit(struct module *mod, long code)/* Find a module section: 0 means not found. */ static unsigned int find_sec(const struct load_info *info, const char *name)unsigned int i;for (i = 1 ; i < info->hdr->e_shnum; i++) {/* Alloc bit cleared means "ignore it." */ if ((shdr->sh_flags & SHF_ALLOC)0 )return i;return 0 ;/** * find_any_unique_sec ( ) - Find a unique section index by name * @ info : Load info for the module to scan * @ name : Name of the section we ' re looking for * * Locates a unique section by name . Ignores SHF_ALLOC . * * Return : Section index if found uniquely , zero if absent , negative count * of total instances if multiple were found . static int find_any_unique_sec(const struct load_info *info, const char *name)unsigned int idx;unsigned int count = 0 ;int i;for (i = 1 ; i < info->hdr->e_shnum; i++) {if (strcmp(info->secstrings + info->sechdrs[i].sh_name,0 ) {if (count == 1 ) {return idx;else if (count == 0 ) {return 0 ;else {return -count;/* Find a module section, or NULL. */ static void *section_addr(const struct load_info *info, const char *name)/* Section 0 has sh_addr 0. */ return (void *)info->sechdrs[find_sec(info, name)].sh_addr;/* Find a module section, or NULL. Fill in number of "objects" in section. */ static void *section_objs(const struct load_info *info,const char *name,unsigned int *num)unsigned int sec = find_sec(info, name);/* Section 0 has sh_addr 0 and sh_size 0. */ return (void *)info->sechdrs[sec].sh_addr;/* Find a module section: 0 means not found. Ignores SHF_ALLOC flag. */ static unsigned int find_any_sec(const struct load_info *info, const char *name)unsigned int i;for (i = 1 ; i < info->hdr->e_shnum; i++) {if (strcmp(info->secstrings + shdr->sh_name, name) == 0 )return i;return 0 ;/* * Find a module section , or NULL . Fill in number of " objects " in section . * Ignores SHF_ALLOC flag . static __maybe_unused void *any_section_objs(const struct load_info *info,const char *name,unsigned int *num)unsigned int sec = find_any_sec(info, name);/* Section 0 has sh_addr 0 and sh_size 0. */ return (void *)info->sechdrs[sec].sh_addr;#ifndef CONFIG_MODVERSIONS#define symversion(base, idx) NULL#else #define symversion(base, idx) ((base != NULL) ? ((base) + (idx)) : NULL)#endif static const char *kernel_symbol_name(const struct kernel_symbol *sym)#ifdef CONFIG_HAVE_ARCH_PREL32_RELOCATIONSreturn offset_to_ptr(&sym->name_offset);#else return sym->name;#endif static const char *kernel_symbol_namespace(const struct kernel_symbol *sym)#ifdef CONFIG_HAVE_ARCH_PREL32_RELOCATIONSif (!sym->namespace_offset)return NULL;return offset_to_ptr(&sym->namespace_offset);#else return sym->namespace ;#endif int cmp_name(const void *name, const void *sym)return strcmp(name, kernel_symbol_name(sym));static bool find_exported_symbol_in_section(const struct symsearch *syms,struct module *owner,struct find_symbol_arg *fsa)struct kernel_symbol *sym;if (!fsa->gplok && syms->license == GPL_ONLY)return false ;sizeof (struct kernel_symbol), cmp_name);if (!sym)return false ;return true ;/* * Find an exported symbol and return it , along with , ( optional ) crc and * ( optional ) module which owns it . Needs RCU or module_mutex . bool find_symbol(struct find_symbol_arg *fsa)static const struct symsearch arr[] = {struct module *mod;unsigned int i;for (i = 0 ; i < ARRAY_SIZE(arr); i++)if (find_exported_symbol_in_section(&arr[i], NULL, fsa))return true ;struct symsearch arr[] = {if (mod->state == MODULE_STATE_UNFORMED)continue ;for (i = 0 ; i < ARRAY_SIZE(arr); i++)if (find_exported_symbol_in_section(&arr[i], mod, fsa))return true ;"Failed to find symbol %s\n" , fsa->name);return false ;/* * Search for module by name : must hold module_mutex ( or RCU for read - only * access ) . struct module *find_module_all(const char *name, size_t len,bool even_unformed)struct module *mod;if (!even_unformed && mod->state == MODULE_STATE_UNFORMED)continue ;if (strlen(mod->name) == len && !memcmp(mod->name, name, len))return mod;return NULL;struct module *find_module(const char *name)return find_module_all(name, strlen(name), false );#ifdef CONFIG_SMPstatic inline void __percpu *mod_percpu(struct module *mod)return mod->percpu;static int percpu_modalloc(struct module *mod, struct load_info *info)unsigned long align = pcpusec->sh_addralign;if (!pcpusec->sh_size)return 0 ;if (align > PAGE_SIZE) {"%s: per-cpu alignment %li > %li\n" ,if (!mod->percpu) {"%s: Could not allocate %lu bytes percpu data\n" ,unsigned long )pcpusec->sh_size);return -ENOMEM;return 0 ;static void percpu_modfree(struct module *mod)static unsigned int find_pcpusec(struct load_info *info)return find_sec(info, ".data..percpu" );static void percpu_modcopy(struct module *mod,const void *from, unsigned long size)int cpu;bool __is_module_percpu_address(unsigned long addr, unsigned long *can_addr)struct module *mod;unsigned int cpu;if (mod->state == MODULE_STATE_UNFORMED)continue ;if (!mod->percpu_size)continue ;void *start = per_cpu_ptr(mod->percpu, cpu);void *va = (void *)addr;if (va >= start && va < start + mod->percpu_size) {if (can_addr) {unsigned long ) (va - start);unsigned long )return true ;return false ;/** * is_module_percpu_address ( ) - test whether address is from module static percpu * @ addr : address to test * * Test whether @ addr belongs to module static percpu area . * * Return : % true if @ addr is from module static percpu area bool is_module_percpu_address(unsigned long addr)return __is_module_percpu_address(addr, NULL);#else /* ... !CONFIG_SMP */ static inline void __percpu *mod_percpu(struct module *mod)return NULL;static int percpu_modalloc(struct module *mod, struct load_info *info)/* UP modules shouldn't have this section: ENOMEM isn't quite right */ if (info->sechdrs[info->index.pcpu].sh_size != 0 )return -ENOMEM;return 0 ;static inline void percpu_modfree(struct module *mod)static unsigned int find_pcpusec(struct load_info *info)return 0 ;static inline void percpu_modcopy(struct module *mod,const void *from, unsigned long size)/* pcpusec should be 0, and size of that section should be 0. */ 0 );bool is_module_percpu_address(unsigned long addr)return false ;bool __is_module_percpu_address(unsigned long addr, unsigned long *can_addr)return false ;#endif /* CONFIG_SMP */ #define MODINFO_ATTR(field) \static void setup_modinfo_## field(struct module *mod, const char *s) \static ssize_t show_modinfo_## field(const struct module_attribute *mattr, \struct module_kobject *mk, char *buffer) \return scnprintf(buffer, PAGE_SIZE, "%s\n" , mk->mod->field); \static int modinfo_## field## _exists(struct module *mod) \return mod->field != NULL; \static void free_modinfo_## field(struct module *mod) \static const struct module_attribute modinfo_## field = { \0444 }, \## field, \## field, \## field## _exists, \## field, \static struct {char name[MODULE_NAME_LEN];char taints[MODULE_FLAGS_BUF_SIZE];#ifdef CONFIG_MODULE_UNLOAD/* MODULE_REF_BASE is the base reference count by kmodule loader. */ #define MODULE_REF_BASE 1 /* Init the unload section of the module. */ static int module_unload_init(struct module *mod)/* * Initialize reference counter to MODULE_REF_BASE . * refcnt = = 0 means module is going . /* Hold reference count during initialization. */ return 0 ;/* Does a already use b? */ static int already_uses(struct module *a, struct module *b)struct module_use *use;if (use->source == a)return 1 ;"%s does not use %s!\n" , a->name, b->name);return 0 ;/* * Module a uses b * - we add ' a ' as a " source " , ' b ' as a " target " of module use * - the module_use is added to the list of ' b ' sources ( so * ' b ' can walk the list to see who sourced them ) , and of ' a ' * targets ( so ' a ' can see what modules it targets ) . static int add_module_usage(struct module *a, struct module *b)struct module_use *use;"Allocating new usage for %s.\n" , a->name);sizeof (*use), GFP_ATOMIC);if (!use)return -ENOMEM;return 0 ;/* Module a uses b: caller needs module_mutex() */ static int ref_module(struct module *a, struct module *b)int err;if (b == NULL || already_uses(a, b))return 0 ;/* If module isn't available, we fail. */ if (err)return err;if (err) {return err;return 0 ;/* Clear the unload stuff of the module. */ static void module_unload_free(struct module *mod)struct module_use *use, *tmp;struct module *i = use->target;"%s unusing %s\n" , mod->name, i->name);#ifdef CONFIG_MODULE_FORCE_UNLOADstatic inline int try_force_unload(unsigned int flags)int ret = (flags & O_TRUNC);if (ret)return ret;#else static inline int try_force_unload(unsigned int flags)return 0 ;#endif /* CONFIG_MODULE_FORCE_UNLOAD */ /* Try to release refcount of module, 0 means success. */ static int try_release_module_ref(struct module *mod)int ret;/* Try to decrement refcnt which we set at loading */ 0 );if (ret)/* Someone can put this right now, recover with checking */ 0 );return ret;static int try_stop_module(struct module *mod, int flags, int *forced)/* If it's not unused, quit unless we're forcing. */ if (try_release_module_ref(mod) != 0 ) {if (!(*forced))return -EWOULDBLOCK;/* Mark it as dying. */ return 0 ;/** * module_refcount ( ) - return the refcount or - 1 if unloading * @ mod : the module we ' re checking * * Return : * - 1 if the module is in the process of unloading * otherwise the number of references in the kernel to the module int module_refcount(struct module *mod)return atomic_read(&mod->refcnt) - MODULE_REF_BASE;/* This exists whether we can unload or not */ static void free_module(struct module *mod);const char __user *, name_user,unsigned int , flags)struct module *mod;char name[MODULE_NAME_LEN];char buf[MODULE_FLAGS_BUF_SIZE];int ret, len, forced = 0 ;if (!capable(CAP_SYS_MODULE) || modules_disabled)return -EPERM;if (len == 0 || len == MODULE_NAME_LEN)return -ENOENT;if (len < 0 )return len;if (mutex_lock_interruptible(&module_mutex) != 0 )return -EINTR;if (!mod) {goto out;if (!list_empty(&mod->source_list)) {/* Other modules depend on us: get rid of them first. */ goto out;/* Doing init or already dying? */ if (mod->state != MODULE_STATE_LIVE) {/* FIXME: if (force), slam module count damn the torpedoes */ "%s already dying\n" , mod->name);goto out;/* If it has an init func, it must have an exit func to unload */ if (mod->init && !mod->exit ) {if (!forced) {/* This module can't be removed */ goto out;if (ret != 0 )goto out;/* Final destruction now no one is using it. */ if (mod->exit != NULL)exit ();/* Store the name and taints of the last unloaded module for diagnostic purposes */ false ));/* someone could wait for the module in add_unformed_module() */ return 0 ;return ret;void __symbol_put(const char *symbol)struct find_symbol_arg fsa = {true ,/* Note this assumes addr is a function, which it currently always is. */ void symbol_put_addr(void *addr)struct module *modaddr;unsigned long a = (unsigned long )dereference_function_descriptor(addr);if (core_kernel_text(a))return ;/* * Even though we hold a reference on the module ; we still need to * RCU read section in order to safely traverse the data structure . static ssize_t show_refcnt(const struct module_attribute *mattr,struct module_kobject *mk, char *buffer)return sprintf(buffer, "%i\n" , module_refcount(mk->mod));static const struct module_attribute modinfo_refcnt =0444 , show_refcnt, NULL);void __module_get(struct module *module)if (module) {bool try_module_get(struct module *module)bool ret = true ;if (module) {/* Note: here, we can fail to get a reference */ if (likely(module_is_live(module) &&0 ))else false ;return ret;void module_put(struct module *module)int ret;if (module) {0 ); /* Failed to put refcount */ #else /* !CONFIG_MODULE_UNLOAD */ static inline void module_unload_free(struct module *mod)static int ref_module(struct module *a, struct module *b)return strong_try_module_get(b);static inline int module_unload_init(struct module *mod)return 0 ;#endif /* CONFIG_MODULE_UNLOAD */ unsigned long taints, char *buf)0 ;int i;for (i = 0 ; i < TAINT_FLAGS_COUNT; i++) {if (taint_flags[i].module && test_bit(i, &taints))return l;static ssize_t show_initstate(const struct module_attribute *mattr,struct module_kobject *mk, char *buffer)const char *state = "unknown" ;switch (mk->mod->state) {case MODULE_STATE_LIVE:"live" ;break ;case MODULE_STATE_COMING:"coming" ;break ;case MODULE_STATE_GOING:"going" ;break ;default :return sprintf(buffer, "%s\n" , state);static const struct module_attribute modinfo_initstate =0444 , show_initstate, NULL);static ssize_t store_uevent(const struct module_attribute *mattr,struct module_kobject *mk,const char *buffer, size_t count)int rc;return rc ? rc : count;const struct module_attribute module_uevent =0200 , NULL, store_uevent);static ssize_t show_coresize(const struct module_attribute *mattr,struct module_kobject *mk, char *buffer)unsigned int size = mk->mod->mem[MOD_TEXT].size;if (!IS_ENABLED(CONFIG_ARCH_WANTS_MODULES_DATA_IN_VMALLOC)) {return sprintf(buffer, "%u\n" , size);static const struct module_attribute modinfo_coresize =0444 , show_coresize, NULL);#ifdef CONFIG_ARCH_WANTS_MODULES_DATA_IN_VMALLOCstatic ssize_t show_datasize(const struct module_attribute *mattr,struct module_kobject *mk, char *buffer)unsigned int size = 0 ;return sprintf(buffer, "%u\n" , size);static const struct module_attribute modinfo_datasize =0444 , show_datasize, NULL);#endif static ssize_t show_initsize(const struct module_attribute *mattr,struct module_kobject *mk, char *buffer)unsigned int size = 0 ;return sprintf(buffer, "%u\n" , size);static const struct module_attribute modinfo_initsize =0444 , show_initsize, NULL);static ssize_t show_taint(const struct module_attribute *mattr,struct module_kobject *mk, char *buffer)'\n' ;return l;static const struct module_attribute modinfo_taint =0444 , show_taint, NULL);const struct module_attribute *const modinfo_attrs[] = {#ifdef CONFIG_ARCH_WANTS_MODULES_DATA_IN_VMALLOC#endif #ifdef CONFIG_MODULE_UNLOAD#endif const size_t modinfo_attrs_count = ARRAY_SIZE(modinfo_attrs);static const char vermagic[] = VERMAGIC_STRING;int try_to_force_load(struct module *mod, const char *reason)#ifdef CONFIG_MODULE_FORCE_LOADif (!test_taint(TAINT_FORCED_MODULE))"%s: %s: kernel tainted.\n" , mod->name, reason);return 0 ;#else return -ENOEXEC;#endif /* Parse tag=value strings from .modinfo section */ char *module_next_tag_pair(char *string, unsigned long *secsize)/* Skip non-zero chars */ while (string[0 ]) {if ((*secsize)-- <= 1 )return NULL;/* Skip any zero padding. */ while (!string[0 ]) {if ((*secsize)-- <= 1 )return NULL;return string;static char *get_next_modinfo(const struct load_info *info, const char *tag,char *prev)char *p;unsigned int taglen = strlen(tag);unsigned long size = infosec->sh_size;/* * get_modinfo ( ) calls made before rewrite_section_headers ( ) * must use sh_offset , as sh_addr isn ' t set ! char *modinfo = (char *)info->hdr + infosec->sh_offset;if (prev) {for (p = modinfo; p; p = module_next_tag_pair(p, &size)) {if (strncmp(p, tag, taglen) == 0 && p[taglen] == '=' )return p + taglen + 1 ;return NULL;static char *get_modinfo(const struct load_info *info, const char *tag)return get_next_modinfo(info, tag, NULL);/** * verify_module_namespace ( ) - does @ modname have access to this symbol ' s @ namespace * @ namespace : export symbol namespace * @ modname : module name * * If @ namespace is prefixed with " module : " to indicate it is a module namespace * then test if @ modname matches any of the comma separated patterns . * * The patterns only support tail - glob . static bool verify_module_namespace(const char *namespace , const char *modname)const char *prefix = "module:" ;const char *sep;bool glob;if (!strstarts(namespace , prefix))return false ;for (namespace += strlen(prefix); *namespace ; namespace = sep) {namespace , ',' );namespace ;false ;if (sep[-1 ] == '*' ) {true ;if (*sep)if (mod_strncmp(namespace , modname, len) == 0 && (glob || len == modlen))return true ;return false ;static int verify_namespace_is_imported(const struct load_info *info,const struct kernel_symbol *sym,struct module *mod)const char *namespace ;char *imported_namespace;namespace = kernel_symbol_namespace(sym);if (namespace && namespace [0 ]) {if (verify_module_namespace(namespace , mod->name))return 0 ;"import_ns" ) {if (strcmp(namespace , imported_namespace) == 0 )return 0 ;#ifdef CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS#else #endif "%s: module uses symbol (%s) from namespace %s, but does not import it.\n" ,namespace );#ifndef CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTSreturn -EINVAL;#endif return 0 ;static bool inherit_taint(struct module *mod, struct module *owner, const char *name)if (!owner || !test_bit(TAINT_PROPRIETARY_MODULE, &owner->taints))return true ;if (mod->using_gplonly_symbols) {"%s: module using GPL-only symbols uses symbols %s from proprietary module %s.\n" ,return false ;if (!test_bit(TAINT_PROPRIETARY_MODULE, &mod->taints)) {"%s: module uses symbols %s from proprietary module %s, inheriting taint.\n" ,return true ;/* Resolve a symbol for this module. I.e. if we find one, record usage. */ static const struct kernel_symbol *resolve_symbol(struct module *mod,const struct load_info *info,const char *name,char ownername[])struct find_symbol_arg fsa = {1 << TAINT_PROPRIETARY_MODULE)),true ,int err;/* * The module_mutex should not be a heavily contended lock ; * if we get the occasional sleep here , we ' ll go an extra iteration * in the wait_event_interruptible ( ) , which is harmless . if (!find_symbol(&fsa))goto unlock;if (fsa.license == GPL_ONLY)true ;if (!inherit_taint(mod, fsa.owner, name)) {goto getname;if (!check_version(info, name, mod, fsa.crc)) {goto getname;if (err) {goto getname;if (err) {goto getname;/* We must make copy under the lock if we failed to get ref. */ return fsa.sym;static const struct kernel_symbol *struct module *mod,const struct load_info *info,const char *name)const struct kernel_symbol *ksym;char owner[MODULE_NAME_LEN];if (wait_event_interruptible_timeout(module_wq,30 * HZ) <= 0 ) {"%s: gave up waiting for init of module %s.\n" ,return ksym;void __weak module_arch_cleanup(struct module *mod)void __weak module_arch_freeing_init(struct module *mod)static int module_memory_alloc(struct module *mod, enum mod_mem_type type)unsigned int size = PAGE_ALIGN(mod->mem[type].size);enum execmem_type execmem_type;void *ptr;if (mod_mem_type_is_data(type))else if (!ptr)return -ENOMEM;/* * The pointer to these blocks of memory are stored on the module * structure and we keep that around so long as the module is * around . We only free that memory when we unload the module . * Just mark them as not being a leak then . The . init * ELF * sections * do * get freed after boot so we * could * treat them * slightly differently with kmemleak_ignore ( ) and only grey * them out as they work as typical memory allocations which * * do * eventually get freed , but let ' s just keep things simple * and avoid * any * false positives . if (!mod->mem[type].is_rox)0 , size);return 0 ;static void module_memory_restore_rox(struct module *mod)struct module_memory *mem = &mod->mem[type];if (mem->is_rox)static void module_memory_free(struct module *mod, enum mod_mem_type type)struct module_memory *mem = &mod->mem[type];static void free_mod_mem(struct module *mod)struct module_memory *mod_mem = &mod->mem[type];if (type == MOD_DATA)continue ;/* Free lock-classes; relies on the preceding sync_rcu(). */ if (mod_mem->size)/* MOD_DATA hosts mod, so free it at last */ /* Free a module, remove from lists, etc. */ static void free_module(struct module *mod)/* * We leave it in list to prevent duplicate loads , but make sure * that noone uses it while it ' s being deconstructed . /* Arch-specific cleanup. */ /* Module unload stuff */ /* Free any allocated parameters. */ if (is_livepatch_module(mod))/* Now we can delete it from the lists */ /* Unlink carefully: kallsyms could be walking list. */ /* Remove this module from bug list, this uses list_del_rcu */ /* Wait for RCU synchronizing before releasing mod->list and buglist. */ if (try_add_tainted_module(mod))"%s: adding tainted module to the unloaded tainted modules list failed.\n" ,/* This may be empty, but that's OK */ void *__symbol_get(const char *symbol)struct find_symbol_arg fsa = {true ,true ,if (!find_symbol(&fsa))return NULL;if (fsa.license != GPL_ONLY) {"failing symbol_get of non-GPLONLY symbol %s.\n" ,return NULL;if (strong_try_module_get(fsa.owner))return NULL;return (void *)kernel_symbol_value(fsa.sym);/* * Ensure that an exported symbol [ global namespace ] does not already exist * in the kernel or in some other module ' s exported symbol table . * * You must hold the module_mutex . static int verify_exported_symbols(struct module *mod)unsigned int i;const struct kernel_symbol *s;struct {const struct kernel_symbol *sym;unsigned int num;for (i = 0 ; i < ARRAY_SIZE(arr); i++) {for (s = arr[i].sym; s < arr[i].sym + arr[i].num; s++) {struct find_symbol_arg fsa = {true ,if (find_symbol(&fsa)) {"%s: exports duplicate symbol %s" " (owned by %s)\n" ,return -ENOEXEC;return 0 ;static bool ignore_undef_symbol(Elf_Half emachine, const char *name)/* * On x86 , PIC code and Clang non - PIC code may have call foo @ PLT . GNU as * before 2 . 37 produces an unreferenced _ GLOBAL_OFFSET_TABLE_ on x86 - 64 . * i386 has a similar problem but may not deserve a fix . * * If we ever have to ignore many symbols , consider refactoring the code to * only warn if referenced by a relocation . if (emachine == EM_386 || emachine == EM_X86_64)return !strcmp(name, "_GLOBAL_OFFSET_TABLE_" );return false ;/* Change all symbols so that st_value encodes the pointer directly. */ static int simplify_symbols(struct module *mod, const struct load_info *info)void *)symsec->sh_addr;unsigned long secbase;unsigned int i;int ret = 0 ;const struct kernel_symbol *ksym;for (i = 1 ; i < symsec->sh_size / sizeof (Elf_Sym); i++) {const char *name = info->strtab + sym[i].st_name;switch (sym[i].st_shndx) {case SHN_COMMON:/* Ignore common symbols */ if (!strncmp(name, "__gnu_lto" , 9 ))break ;/* * We compiled with - fno - common . These are not * supposed to happen . "Common symbol: %s\n" , name);"%s: please compile with -fno-common\n" ,break ;case SHN_ABS:/* Don't need to do anything */ "Absolute symbol: 0x%08lx %s\n" ,long )sym[i].st_value, name);break ;case SHN_LIVEPATCH:/* Livepatch symbols are resolved by livepatch */ break ;case SHN_UNDEF:/* Ok if resolved. */ if (ksym && !IS_ERR(ksym)) {break ;/* Ok if weak or ignored. */ if (!ksym &&break ;"%s: Unknown symbol %s (err %d)\n" ,break ;default :/* Divert to percpu allocation if a percpu var. */ if (sym[i].st_shndx == info->index.pcpu)unsigned long )mod_percpu(mod);else break ;return ret;static int apply_relocations(struct module *mod, const struct load_info *info)unsigned int i;int err = 0 ;/* Now do relocations. */ for (i = 1 ; i < info->hdr->e_shnum; i++) {unsigned int infosec = info->sechdrs[i].sh_info;/* Not a valid relocation section? */ if (infosec >= info->hdr->e_shnum)continue ;/* * Don ' t bother with non - allocated sections . * An exception is the percpu section , which has separate allocations * for individual CPUs . We relocate the percpu section in the initial * ELF template and subsequently copy it to the per - CPU destinations . if (!(info->sechdrs[infosec].sh_flags & SHF_ALLOC) &&continue ;if (info->sechdrs[i].sh_flags & SHF_RELA_LIVEPATCH)else if (info->sechdrs[i].sh_type == SHT_REL)else if (info->sechdrs[i].sh_type == SHT_RELA)if (err < 0 )break ;return err;/* Additional bytes needed by arch in front of individual sections */ unsigned int __weak arch_mod_section_prepend(struct module *mod,unsigned int section)/* default implementation just returns zero */ return 0 ;long module_get_offset_and_type(struct module *mod, enum mod_mem_type type,unsigned int section)long offset;long mask = ((unsigned long )(type) & SH_ENTSIZE_TYPE_MASK) << SH_ENTSIZE_TYPE_SHIFT;1 );return offset | mask;bool module_init_layout_section(const char *sname)#ifndef CONFIG_MODULE_UNLOADif (module_exit_section(sname))return true ;#endif return module_init_section(sname);static void __layout_sections(struct module *mod, struct load_info *info, bool is_init)unsigned int m, i;/* * { Mask of required section header flags , * Mask of excluded section header flags } static const unsigned long masks[][2 ] = {0 }static const int core_m_to_mem_type[] = {static const int init_m_to_mem_type[] = {for (m = 0 ; m < ARRAY_SIZE(masks); ++m) {enum mod_mem_type type = is_init ? init_m_to_mem_type[m] : core_m_to_mem_type[m];for (i = 0 ; i < info->hdr->e_shnum; ++i) {const char *sname = info->secstrings + s->sh_name;if ((s->sh_flags & masks[m][0 ]) != masks[m][0 ]1 ])0 ULcontinue ;if (WARN_ON_ONCE(type == MOD_INVALID))continue ;/* * Do not allocate codetag memory as we load it into * preallocated contiguous memory . if (codetag_needs_module_section(mod, sname, s->sh_size)) {/* * s - > sh_entsize won ' t be used but populate the * type field to avoid confusion . unsigned long )(type) & SH_ENTSIZE_TYPE_MASK)continue ;"\t%s\n" , sname);/* * Lay out the SHF_ALLOC sections in a way not dissimilar to how ld * might - - code , read - only data , read - write data , small data . Tally * sizes , and place the offsets into sh_entsize fields : high bit means it * belongs in init . static void layout_sections(struct module *mod, struct load_info *info)unsigned int i;for (i = 0 ; i < info->hdr->e_shnum; i++)0 UL;"Core section allocation order for %s:\n" , mod->name);false );"Init section allocation order for %s:\n" , mod->name);true );static void module_license_taint_check(struct module *mod, const char *license)if (!license)"unspecified" ;if (!license_is_gpl_compatible(license)) {if (!test_taint(TAINT_PROPRIETARY_MODULE))"%s: module license '%s' taints kernel.\n" ,static int setup_modinfo(struct module *mod, struct load_info *info)const struct module_attribute *attr;char *imported_namespace;int i;for (i = 0 ; (attr = modinfo_attrs[i]); i++) {if (attr->setup)"import_ns" ) {/* * ' module : ' prefixed namespaces are implicit , disallow * explicit imports . if (strstarts(imported_namespace, "module:" )) {"%s: module tries to import module namespace: %s\n" ,return -EPERM;return 0 ;static void free_modinfo(struct module *mod)const struct module_attribute *attr;int i;for (i = 0 ; (attr = modinfo_attrs[i]); i++) {if (attr->free)bool __weak module_init_section(const char *name)return strstarts(name, ".init" );bool __weak module_exit_section(const char *name)return strstarts(name, ".exit" );static int validate_section_offset(const struct load_info *info, Elf_Shdr *shdr)#if defined (CONFIG_64BIT)unsigned long long secend;#else unsigned long secend;#endif /* * Check for both overflow and offset / size being * too large . if (secend < shdr->sh_offset || secend > info->len)return -ENOEXEC;return 0 ;/** * elf_validity_ehdr ( ) - Checks an ELF header for module validity * @ info : Load info containing the ELF header to check * * Checks whether an ELF header could belong to a valid module . Checks : * * * ELF header is within the data the user provided * * ELF magic is present * * It is relocatable ( not final linked , not core file , etc . ) * * The header ' s machine type matches what the architecture expects . * * Optional arch - specific hook for other properties * - module_elf_check_arch ( ) is currently only used by PPC to check * ELF ABI version , but may be used by others in the future . * * Return : % 0 if valid , % - ENOEXEC on failure . static int elf_validity_ehdr(const struct load_info *info)if (info->len < sizeof (*(info->hdr))) {"Invalid ELF header len %lu\n" , info->len);return -ENOEXEC;if (memcmp(info->hdr->e_ident, ELFMAG, SELFMAG) != 0 ) {"Invalid ELF header magic: != %s\n" , ELFMAG);return -ENOEXEC;if (info->hdr->e_type != ET_REL) {"Invalid ELF header type: %u != %u\n" ,return -ENOEXEC;if (!elf_check_arch(info->hdr)) {"Invalid architecture in ELF header: %u\n" ,return -ENOEXEC;if (!module_elf_check_arch(info->hdr)) {"Invalid module architecture in ELF header: %u\n" ,return -ENOEXEC;return 0 ;/** * elf_validity_cache_sechdrs ( ) - Cache section headers if valid * @ info : Load info to compute section headers from * * Checks : * * * ELF header is valid ( see elf_validity_ehdr ( ) ) * * Section headers are the size we expect * * Section array fits in the user provided data * * Section index 0 is NULL * * Section contents are inbounds * * Then updates @ info with a & load_info - > sechdrs pointer if valid . * * Return : % 0 if valid , negative error code if validation failed . static int elf_validity_cache_sechdrs(struct load_info *info)int i;int err;if (err < 0 )return err;if (info->hdr->e_shentsize != sizeof (Elf_Shdr)) {"Invalid ELF section header size\n" );return -ENOEXEC;/* * e_shnum is 16 bits , and sizeof ( Elf_Shdr ) is * known and small . So e_shnum * sizeof ( Elf_Shdr ) * will not overflow unsigned long on any platform . if (info->hdr->e_shoff >= info->lensizeof (Elf_Shdr) >"Invalid ELF section header overflow\n" );return -ENOEXEC;void *)info->hdr + info->hdr->e_shoff;/* * The code assumes that section 0 has a length of zero and * an addr of zero , so check for it . if (sechdrs[0 ].sh_type != SHT_NULL0 ].sh_size != 0 0 ].sh_addr != 0 ) {"ELF Spec violation: section 0 type(%d)!=SH_NULL or non-zero len or addr\n" ,0 ].sh_type);return -ENOEXEC;/* Validate contents are inbounds */ for (i = 1 ; i < info->hdr->e_shnum; i++) {switch (shdr->sh_type) {case SHT_NULL:case SHT_NOBITS:/* No contents, offset/size don't mean anything */ continue ;default :if (err < 0 ) {"Invalid ELF section in module (section %u type %u)\n" ,return err;return 0 ;/** * elf_validity_cache_secstrings ( ) - Caches section names if valid * @ info : Load info to cache section names from . Must have valid sechdrs . * * Specifically checks : * * * Section name table index is inbounds of section headers * * Section name table is not empty * * Section name table is NUL terminated * * All section name offsets are inbounds of the section * * Then updates @ info with a & load_info - > secstrings pointer if valid . * * Return : % 0 if valid , negative error code if validation failed . static int elf_validity_cache_secstrings(struct load_info *info)char *secstrings;int i;/* * Verify if the section name table index is valid . if (info->hdr->e_shstrndx == SHN_UNDEF"Invalid ELF section name index: %d || e_shstrndx (%d) >= e_shnum (%d)\n" ,return -ENOEXEC;/* * The section name table must be NUL - terminated , as required * by the spec . This makes strcmp and pr_ * calls that access * strings in the section safe . void *)info->hdr + strhdr->sh_offset;if (strhdr->sh_size == 0 ) {"empty section name table\n" );return -ENOEXEC;if (secstrings[strhdr->sh_size - 1 ] != '\0' ) {"ELF Spec violation: section name table isn't null terminated\n" );return -ENOEXEC;for (i = 0 ; i < info->hdr->e_shnum; i++) {/* SHT_NULL means sh_name has an undefined value */ if (shdr->sh_type == SHT_NULL)continue ;if (shdr->sh_name >= strhdr->sh_size) {"Invalid ELF section name in module (section %u type %u)\n" ,return -ENOEXEC;return 0 ;/** * elf_validity_cache_index_info ( ) - Validate and cache modinfo section * @ info : Load info to populate the modinfo index on . * Must have & load_info - > sechdrs and & load_info - > secstrings populated * * Checks that if there is a . modinfo section , it is unique . * Then , it caches its index in & load_info - > index . info . * Finally , it tries to populate the name to improve error messages . * * Return : % 0 if valid , % - ENOEXEC if multiple modinfo sections were found . static int elf_validity_cache_index_info(struct load_info *info)int info_idx;".modinfo" );if (info_idx == 0 )/* Early return, no .modinfo */ return 0 ;if (info_idx < 0 ) {"Only one .modinfo section must exist.\n" );return -ENOEXEC;/* Try to find a name early so we can log errors with a module name */ "name" );return 0 ;/** * elf_validity_cache_index_mod ( ) - Validates and caches this_module section * @ info : Load info to cache this_module on . * Must have & load_info - > sechdrs and & load_info - > secstrings populated * * The " . gnu . linkonce . this_module " ELF section is special . It is what modpost * uses to refer to _ _ this_module and let ' s use rely on THIS_MODULE to point * to & _ _ this_module properly . The kernel ' s modpost declares it on each * modules ' s * . mod . c file . If the struct module of the kernel changes a full * kernel rebuild is required . * * We have a few expectations for this special section , this function * validates all this for us : * * * The section has contents * * The section is unique * * We expect the kernel to always have to allocate it : SHF_ALLOC * * The section size must match the kernel ' s run time ' s struct module * size * * If all checks pass , the index will be cached in & load_info - > index . mod * * Return : % 0 on validation success , % - ENOEXEC on failure static int elf_validity_cache_index_mod(struct load_info *info)int mod_idx;".gnu.linkonce.this_module" );if (mod_idx <= 0 ) {"module %s: Exactly one .gnu.linkonce.this_module section must exist.\n" ,"(missing .modinfo section or name field)" );return -ENOEXEC;if (shdr->sh_type == SHT_NOBITS) {"module %s: .gnu.linkonce.this_module section must have a size set\n" ,"(missing .modinfo section or name field)" );return -ENOEXEC;if (!(shdr->sh_flags & SHF_ALLOC)) {"module %s: .gnu.linkonce.this_module must occupy memory during process execution\n" ,"(missing .modinfo section or name field)" );return -ENOEXEC;if (shdr->sh_size != sizeof (struct module)) {"module %s: .gnu.linkonce.this_module section size must match the kernel's built struct module size at run time\n" ,"(missing .modinfo section or name field)" );return -ENOEXEC;return 0 ;/** * elf_validity_cache_index_sym ( ) - Validate and cache symtab index * @ info : Load info to cache symtab index in . * Must have & load_info - > sechdrs and & load_info - > secstrings populated . * * Checks that there is exactly one symbol table , then caches its index in * & load_info - > index . sym . * * Return : % 0 if valid , % - ENOEXEC on failure . static int elf_validity_cache_index_sym(struct load_info *info)unsigned int sym_idx;unsigned int num_sym_secs = 0 ;int i;for (i = 1 ; i < info->hdr->e_shnum; i++) {if (info->sechdrs[i].sh_type == SHT_SYMTAB) {if (num_sym_secs != 1 ) {"%s: module has no symbols (stripped?)\n" ,"(missing .modinfo section or name field)" );return -ENOEXEC;return 0 ;/** * elf_validity_cache_index_str ( ) - Validate and cache strtab index * @ info : Load info to cache strtab index in . * Must have & load_info - > sechdrs and & load_info - > secstrings populated . * Must have & load_info - > index . sym populated . * * Looks at the symbol table ' s associated string table , makes sure it is * in - bounds , and caches it . * * Return : % 0 if valid , % - ENOEXEC on failure . static int elf_validity_cache_index_str(struct load_info *info)unsigned int str_idx = info->sechdrs[info->index.sym].sh_link;if (str_idx == SHN_UNDEF || str_idx >= info->hdr->e_shnum) {"Invalid ELF sh_link!=SHN_UNDEF(%d) or (sh_link(%d) >= hdr->e_shnum(%d)\n" ,return -ENOEXEC;return 0 ;/** * elf_validity_cache_index_versions ( ) - Validate and cache version indices * @ info : Load info to cache version indices in . * Must have & load_info - > sechdrs and & load_info - > secstrings populated . * @ flags : Load flags , relevant to suppress version loading , see * uapi / linux / module . h * * If we ' re ignoring modversions based on @ flags , zero all version indices * and return validity . Othewrise check : * * * If " _ _ version_ext_crcs " is present , " _ _ version_ext_names " is present * * There is a name present for every crc * * Then populate : * * * & load_info - > index . vers * * & load_info - > index . vers_ext_crc * * & load_info - > index . vers_ext_names * * if present . * * Return : % 0 if valid , % - ENOEXEC on failure . static int elf_validity_cache_index_versions(struct load_info *info, int flags)unsigned int vers_ext_crc;unsigned int vers_ext_name;char *name;/* If modversions were suppressed, pretend we didn't find any */ if (flags & MODULE_INIT_IGNORE_MODVERSIONS) {0 ;0 ;0 ;return 0 ;"__version_ext_crcs" );"__version_ext_names" );/* If we have one field, we must have the other */ if (!!vers_ext_crc != !!vers_ext_name) {"extended version crc+name presence does not match" );return -ENOEXEC;/* * If we have extended version information , we should have the same * number of entries in every section . if (vers_ext_crc) {sizeof (u32);void *)info->hdr +while (crc_count--) {1 ;if (name_size > remaining_len) {"more extended version crcs than names" );return -ENOEXEC;"__versions" );return 0 ;/** * elf_validity_cache_index ( ) - Resolve , validate , cache section indices * @ info : Load info to read from and update . * & load_info - > sechdrs and & load_info - > secstrings must be populated . * @ flags : Load flags , relevant to suppress version loading , see * uapi / linux / module . h * * Populates & load_info - > index , validating as it goes . * See child functions for per - field validation : * * * elf_validity_cache_index_info ( ) * * elf_validity_cache_index_mod ( ) * * elf_validity_cache_index_sym ( ) * * elf_validity_cache_index_str ( ) * * elf_validity_cache_index_versions ( ) * * If CONFIG_SMP is enabled , load the percpu section by name with no * validation . * * Return : 0 on success , negative error code if an index failed validation . static int elf_validity_cache_index(struct load_info *info, int flags)int err;if (err < 0 )return err;if (err < 0 )return err;if (err < 0 )return err;if (err < 0 )return err;if (err < 0 )return err;return 0 ;/** * elf_validity_cache_strtab ( ) - Validate and cache symbol string table * @ info : Load info to read from and update . * Must have & load_info - > sechdrs and & load_info - > secstrings populated . * Must have & load_info - > index populated . * * Checks : * * * The string table is not empty . * * The string table starts and ends with NUL ( required by ELF spec ) . * * Every & Elf_Sym - > st_name offset in the symbol table is inbounds of the * string table . * * And caches the pointer as & load_info - > strtab in @ info . * * Return : 0 on success , negative error code if a check failed . static int elf_validity_cache_strtab(struct load_info *info)char *strtab = (char *)info->hdr + str_shdr->sh_offset;void *)info->hdr + sym_shdr->sh_offset;int i;if (str_shdr->sh_size == 0 ) {"empty symbol string table\n" );return -ENOEXEC;if (strtab[0 ] != '\0' ) {"symbol string table missing leading NUL\n" );return -ENOEXEC;if (strtab[str_shdr->sh_size - 1 ] != '\0' ) {"symbol string table isn't NUL terminated\n" );return -ENOEXEC;/* * Now that we know strtab is correctly structured , check symbol * starts are inbounds before they ' re used later . for (i = 0 ; i < sym_shdr->sh_size / sizeof (*syms); i++) {if (syms[i].st_name >= str_shdr->sh_size) {"symbol name out of bounds in string table" );return -ENOEXEC;return 0 ;/* * Check userspace passed ELF module against our expectations , and cache * useful variables for further processing as we go . * * This does basic validity checks against section offsets and sizes , the * section name string table , and the indices used for it ( sh_name ) . * * As a last step , since we ' re already checking the ELF sections we cache * useful variables which will be used later for our convenience : * * o pointers to section headers * o cache the modinfo symbol section * o cache the string symbol section * o cache the module section * * As a last step we set info - > mod to the temporary copy of the module in * info - > hdr . The final one will be allocated in move_module ( ) . Any * modifications we make to our copy of the module will be carried over * to the final minted module . static int elf_validity_cache_copy(struct load_info *info, int flags)int err;if (err < 0 )return err;if (err < 0 )return err;if (err < 0 )return err;if (err < 0 )return err;/* This is temporary: point mod into copy of data. */ void *)info->hdr + info->sechdrs[info->index.mod].sh_offset;/* * If we didn ' t load the . modinfo ' name ' field earlier , fall back to * on - disk struct mod ' name ' field . if (!info->name)return 0 ;#define COPY_CHUNK_SIZE (16 *PAGE_SIZE)static int copy_chunked_from_user(void *dst, const void __user *usrc, unsigned long len)do {unsigned long n = min(len, COPY_CHUNK_SIZE);if (copy_from_user(dst, usrc, n) != 0 )return -EFAULT;while (len);return 0 ;static int check_modinfo_livepatch(struct module *mod, struct load_info *info)if (!get_modinfo(info, "livepatch" ))/* Nothing more to do */ return 0 ;if (set_livepatch_module(mod))return 0 ;"%s: module is marked as livepatch module, but livepatch support is disabled" ,return -ENOEXEC;static void check_modinfo_retpoline(struct module *mod, struct load_info *info)if (retpoline_module_ok(get_modinfo(info, "retpoline" )))return ;"%s: loading module not compiled with retpoline compiler.\n" ,/* Sets info->hdr and info->len. */ static int copy_module_from_user(const void __user *umod, unsigned long len,struct load_info *info)int err;if (info->len < sizeof (*(info->hdr)))return -ENOEXEC;true );if (err)return err;/* Suck in entire file: we'll want most of it. */ if (!info->hdr)return -ENOMEM;if (copy_chunked_from_user(info->hdr, umod, info->len) != 0 ) {goto out;char *)info->hdr, info->len,"init_module" );if (err)return err;static void free_copy(struct load_info *info, int flags)if (flags & MODULE_INIT_COMPRESSED_FILE)else static int rewrite_section_headers(struct load_info *info, int flags)unsigned int i;/* This should always be true, but let's be sure. */ 0 ].sh_addr = 0 ;for (i = 1 ; i < info->hdr->e_shnum; i++) {/* * Mark all sections sh_addr with their address in the * temporary image . /* Track but don't keep modinfo and version sections. */ unsigned long )SHF_ALLOC;unsigned long )SHF_ALLOC;unsigned long )SHF_ALLOC;unsigned long )SHF_ALLOC;return 0 ;static const char *const module_license_offenders[] = {/* driverloader was caught wrongly pretending to be under GPL */ "driverloader" ,/* lve claims to be GPL but upstream won't provide source */ "lve" ,/* static void module_augment_kernel_taints(struct module *mod, struct load_info *info)int prev_taint = test_taint(TAINT_PROPRIETARY_MODULE);if (!get_modinfo(info, "intree" )) {if (!test_taint(TAINT_OOT_MODULE))"%s: loading out-of-tree module taints kernel.\n" ,if (get_modinfo(info, "staging" )) {"%s: module is from the staging directory, the quality " "is unknown, you have been warned.\n" , mod->name);if (is_livepatch_module(mod)) {"%s: tainting kernel with TAINT_LIVEPATCH\n" ,"license" ));if (get_modinfo(info, "test" )) {if (!test_taint(TAINT_TEST))"%s: loading test module taints kernel.\n" ,#ifdef CONFIG_MODULE_SIGif (!mod->sig_ok) {"%s: module verification failed: signature " "and/or required key missing - tainting " "kernel\n" , mod->name);#endif /* * ndiswrapper is under GPL by itself , but loads proprietary modules . * Don ' t use add_taint_module ( ) , as it would prevent ndiswrapper from * using GPL - only symbols it needs . if (strcmp(mod->name, "ndiswrapper" ) == 0 )for (i = 0 ; i < ARRAY_SIZE(module_license_offenders); ++i) {if (strcmp(mod->name, module_license_offenders[i]) == 0 )if (!prev_taint && test_taint(TAINT_PROPRIETARY_MODULE))"%s: module license taints kernel.\n" , mod->name);static int check_modinfo(struct module *mod, struct load_info *info, int flags)const char *modmagic = get_modinfo(info, "vermagic" );int err;if (flags & MODULE_INIT_IGNORE_VERMAGIC)/* This is allowed: modprobe --force will invalidate it. */ if (!modmagic) {"bad vermagic" );if (err)return err;else if (!same_magic(modmagic, vermagic, info->index.vers)) {"%s: version magic '%s' should be '%s'\n" ,return -ENOEXEC;if (err)return err;return 0 ;static int find_module_sections(struct module *mod, struct load_info *info)"__param" ,sizeof (*mod->kp), &mod->num_kp);"__ksymtab" ,sizeof (*mod->syms), &mod->num_syms);"__kcrctab" );"__ksymtab_gpl" ,sizeof (*mod->gpl_syms),"__kcrctab_gpl" );#ifdef CONFIG_CONSTRUCTORS".ctors" ,sizeof (*mod->ctors), &mod->num_ctors);if (!mod->ctors)".init_array" ,sizeof (*mod->ctors), &mod->num_ctors);else if (find_sec(info, ".init_array" )) {/* * This shouldn ' t happen with same compiler and binutils * building all parts of the module . "%s: has both .ctors and .init_array.\n" ,return -EINVAL;#endif ".noinstr.text" , 1 ,#ifdef CONFIG_TRACEPOINTS"__tracepoints_ptrs" ,sizeof (*mod->tracepoints_ptrs),#endif #ifdef CONFIG_TREE_SRCU"___srcu_struct_ptrs" ,sizeof (*mod->srcu_struct_ptrs),#endif #ifdef CONFIG_BPF_EVENTS"__bpf_raw_tp_map" ,sizeof (*mod->bpf_raw_events),#endif #ifdef CONFIG_DEBUG_INFO_BTF_MODULES".BTF" , 1 , &mod->btf_data_size);".BTF.base" , 1 ,#endif #ifdef CONFIG_JUMP_LABEL"__jump_table" ,sizeof (*mod->jump_entries),#endif #ifdef CONFIG_EVENT_TRACING"_ftrace_events" ,sizeof (*mod->trace_events),"_ftrace_eval_map" ,sizeof (*mod->trace_evals),#endif #ifdef CONFIG_TRACING"__trace_printk_fmt" ,sizeof (*mod->trace_bprintk_fmt_start),#endif #ifdef CONFIG_DYNAMIC_FTRACE/* sechdrs[0].sh_size is always zero */ sizeof (*mod->ftrace_callsites),#endif #ifdef CONFIG_FUNCTION_ERROR_INJECTION"_error_injection_whitelist" ,sizeof (*mod->ei_funcs),#endif #ifdef CONFIG_KPROBES".kprobes.text" , 1 ,"_kprobe_blacklist" ,sizeof (unsigned long ),#endif #ifdef CONFIG_PRINTK_INDEX".printk_index" ,sizeof (*mod->printk_index_start),#endif #ifdef CONFIG_HAVE_STATIC_CALL_INLINE".static_call_sites" ,sizeof (*mod->static_call_sites),#endif #if IS_ENABLED(CONFIG_KUNIT)".kunit_test_suites" ,sizeof (*mod->kunit_suites),".kunit_init_test_suites" ,sizeof (*mod->kunit_init_suites),#endif "__ex_table" ,sizeof (*mod->extable), &mod->num_exentries);if (section_addr(info, "__obsparm" ))"%s: Ignoring obsolete parameters\n" , mod->name);#ifdef CONFIG_DYNAMIC_DEBUG_CORE"__dyndbg" ,sizeof (*mod->dyndbg_info.descs),"__dyndbg_classes" ,sizeof (*mod->dyndbg_info.classes),#endif return 0 ;static int move_module(struct module *mod, struct load_info *info)int i, ret;enum mod_mem_type t = MOD_MEM_NUM_TYPES;bool codetag_section_found = false ;if (!mod->mem[type].size) {continue ;if (ret) {goto out_err;/* Transfer each section which specifies SHF_ALLOC */ "Final section addresses for %s:\n" , mod->name);for (i = 0 ; i < info->hdr->e_shnum; i++) {void *dest;const char *sname;if (!(shdr->sh_flags & SHF_ALLOC))continue ;/* * Load codetag sections separately as they might still be used * after module unload . if (codetag_needs_module_section(mod, sname, shdr->sh_size)) {if (WARN_ON(!dest)) {goto out_err;if (IS_ERR(dest)) {goto out_err;true ;else {enum mod_mem_type type = shdr->sh_entsize >> SH_ENTSIZE_TYPE_SHIFT;unsigned long offset = shdr->sh_entsize & SH_ENTSIZE_OFFSET_MASK;if (shdr->sh_type != SHT_NOBITS) {/* * Our ELF checker already validated this , but let ' s * be pedantic and make the goal clearer . We actually * end up copying over all modifications made to the * userspace copy of the entire struct module . if (i == info->index.mod &&sizeof (struct module)))) {goto out_err;void *)shdr->sh_addr, shdr->sh_size);/* * Update the userspace copy ' s ELF section address to point to * our newly allocated memory as a pure convenience so that * users of info can keep taking advantage and using the newly * minted official memory area . unsigned long )dest;"\t0x%lx 0x%.8lx %s\n" , (long )shdr->sh_addr,long )shdr->sh_size, info->secstrings + shdr->sh_name);return 0 ;while (t--)if (codetag_section_found)return ret;static int check_export_symbol_versions(struct module *mod)#ifdef CONFIG_MODVERSIONSif ((mod->num_syms && !mod->crcs) ||return try_to_force_load(mod,"no versions for exported symbols" );#endif return 0 ;static void flush_module_icache(const struct module *mod)/* * Flush the instruction cache , since we ' ve played with text . * Do it before processing of module parameters , so the module * can provide parameter accessor functions of its own . const struct module_memory *mod_mem = &mod->mem[type];if (mod_mem->size) {unsigned long )mod_mem->base,unsigned long )mod_mem->base + mod_mem->size);bool __weak module_elf_check_arch(Elf_Ehdr *hdr)return true ;int __weak module_frob_arch_sections(Elf_Ehdr *hdr,char *secstrings,struct module *mod)return 0 ;/* module_blacklist is a comma-separated list of module names */ static char *module_blacklist;static bool blacklisted(const char *module_name)const char *p;if (!module_blacklist)return false ;for (p = module_blacklist; *p; p += len) {"," );if (strlen(module_name) == len && !memcmp(module_name, p, len))return true ;if (p[len] == ',' )return false ;0400 );static struct module *layout_and_allocate(struct load_info *info, int flags)struct module *mod;int err;/* Allow arches to frob section contents and sizes. */ if (err < 0 )return ERR_PTR(err);if (err < 0 )return ERR_PTR(err);/* We will do a special allocation for per-cpu sections later. */ unsigned long )SHF_ALLOC;/* * Mark relevant sections as SHF_RO_AFTER_INIT so layout_sections ( ) can * put them in the right place . * Note : ro_after_init sections also have SHF_ { WRITE , ALLOC } set . /* * Determine total sizes , and put offsets in sh_entsize . For now * this is done generically ; there doesn ' t appear to be any * special cases for the architectures . /* Allocate and move to the final place */ if (err)return ERR_PTR(err);/* Module has been copied to its final place now: return it. */ void *)info->sechdrs[info->index.mod].sh_addr;return mod;/* mod is no longer valid after this! */ static void module_deallocate(struct module *mod, struct load_info *info)int __weak module_finalize(const Elf_Ehdr *hdr,const Elf_Shdr *sechdrs,struct module *me)return 0 ;static int post_relocation(struct module *mod, const struct load_info *info)/* Sort exception table now relocations are done. */ /* Copy relocated percpu area over. */ void *)info->sechdrs[info->index.pcpu].sh_addr,/* Setup kallsyms-specific fields. */ /* Arch-specific module finalizing. */ return module_finalize(info->hdr, info->sechdrs, mod);/* Call module constructors. */ static void do_mod_ctors(struct module *mod)#ifdef CONFIG_CONSTRUCTORSunsigned long i;for (i = 0 ; i < mod->num_ctors; i++)#endif /* For freeing module_init on success, in case kallsyms traversing */ struct mod_initfree {struct llist_node node;void *init_text;void *init_data;void *init_rodata;static void do_free_init(struct work_struct *w)struct llist_node *pos, *n, *list;struct mod_initfree *initfree;struct mod_initfree, node);void flush_module_init_free_work(void )#undef MODULE_PARAM_PREFIX#define MODULE_PARAM_PREFIX "module." /* Default value for module->async_probe_requested */ static bool async_probe;bool , 0644 );/* * This is where the real work happens . * * Keep it uninlined to provide a reliable breakpoint target , e . g . for the gdb * helper command ' lx - symbols ' . static noinline int do_init_module(struct module *mod)int ret = 0 ;struct mod_initfree *freeinit;#if defined (CONFIG_MODULE_STATS)unsigned int text_size = 0 , total_size = 0 ;const struct module_memory *mod_mem = &mod->mem[type];if (mod_mem->size) {if (type == MOD_TEXT || type == MOD_INIT_TEXT)#endif sizeof (*freeinit), GFP_KERNEL);if (!freeinit) {goto fail;/* Start the module */ if (mod->init != NULL)if (ret < 0 ) {goto fail_free_freeinit;if (ret > 0 ) {"%s: '%s'->init suspiciously returned %d, it should " "follow 0/-E convention\n" "%s: loading module anyway...\n" ,/* Now it's a first class citizen! */ /* Delay uevent until module has finished its init routine */ /* * We need to finish all async code before the module init sequence * is done . This has potential to deadlock if synchronous module * loading is requested from async ( which is not allowed ! ) . * * See commit 0 fdff3ec6d87 ( " async , kmod : warn on synchronous * request_module ( ) from async workers " ) for more details . if (!mod->async_probe_requested)/* Drop initial reference. */ #ifdef CONFIG_KALLSYMS/* Switch to core kallsyms now init is done: kallsyms may be walking! */ #endif if (ret)"%s: module_enable_rodata_ro_after_init() returned %d, " "ro_after_init data might still be writable\n" ,0 ;#ifdef CONFIG_DEBUG_INFO_BTF_MODULES/* .BTF is not SHF_ALLOC and will get removed, so sanitize pointers */ #endif /* * We want to free module_init , but be aware that kallsyms may be * walking this within an RCU read section . In all the failure paths , we * call synchronize_rcu ( ) , but we don ' t want to slow down the success * path . execmem_free ( ) cannot be called in an interrupt , so do the * work and call synchronize_rcu ( ) in a work queue . * * Note that execmem_alloc ( ) on most architectures creates W + X page * mappings which won ' t be cleaned up until do_free_init ( ) runs . Any * code such as mark_rodata_ro ( ) which depends on those mappings to * be cleaned up needs to sync with the queued work by invoking * flush_module_init_free_work ( ) . if (llist_add(&freeinit->node, &init_free_list))return 0 ;/* Try to protect us from buggy refcounters. */ return ret;static int may_init_module(void )if (!capable(CAP_SYS_MODULE) || modules_disabled)return -EPERM;return 0 ;/* Is this module of this name done loading? No locks held. */ static bool finished_loading(const char *name)struct module *mod;bool ret;/* * The module_mutex should not be a heavily contended lock ; * if we get the occasional sleep here , we ' ll go an extra iteration * in the wait_event_interruptible ( ) , which is harmless . true );return ret;/* Must be called with module_mutex held */ static int module_patient_check_exists(const char *name,enum fail_dup_mod_reason reason)struct module *old;int err = 0 ;true );if (old == NULL)return 0 ;if (old->state == MODULE_STATE_COMING ||/* Wait in case it fails to load. */ if (err)return err;/* The module might have gone in the meantime. */ true );if (try_add_failed_module(name, reason))"Could not add fail-tracking for module: %s\n" , name);/* * We are here only when the same module was being loaded . Do * not try to load it again right now . It prevents long delays * caused by serialized module load failures . It might happen * when more devices of the same type trigger load of * a particular module . if (old && old->state == MODULE_STATE_LIVE)return -EEXIST;return -EBUSY;/* * We try to place it in the list now to make sure it ' s unique before * we dedicate too many resources . In particular , temporary percpu * memory exhaustion . static int add_unformed_module(struct module *mod)int err;if (err)goto out;0 ;return err;static int complete_formation(struct module *mod, struct load_info *info)int err;/* Find duplicate symbols (must be called under lock). */ if (err < 0 )goto out;/* These rely on module_mutex for list integrity. */ if (err)goto out_strict_rwx;if (err)goto out_strict_rwx;if (err)goto out_strict_rwx;/* * Mark state as coming so strong_try_module_get ( ) ignores us , * but kallsyms etc . can see us . return 0 ;return err;static int prepare_coming_module(struct module *mod)int err;if (err)return err;if (err)return err;static int unknown_module_param_cb(char *param, char *val, const char *modname,void *arg)struct module *mod = arg;int ret;if (strcmp(param, "async_probe" ) == 0 ) {if (kstrtobool(val, &mod->async_probe_requested))true ;return 0 ;/* Check for magic 'dyndbg' arg */ if (ret != 0 )"%s: unknown parameter '%s' ignored\n" , modname, param);return 0 ;/* Module within temporary copy, this doesn't do any allocation */ static int early_mod_check(struct load_info *info, int flags)int err;/* * Now that we know we have the correct module name , check * if it ' s blacklisted . if (blacklisted(info->name)) {"Module %s is blacklisted\n" , info->name);return -EPERM;if (err)return err;/* Check module struct version now, before we try to use module. */ if (!check_modstruct_version(info, info->mod))return -ENOEXEC;if (err)return err;return err;/* * Allocate and load the module : note that size of section 0 is always * zero , and we rely on this for optional sections . static int load_module(struct load_info *info, const char __user *uargs,int flags)struct module *mod;bool module_allocated = false ;long err = 0 ;char *after_dashes;/* * Do the signature check ( if any ) first . All that * the signature check needs is info - > len , it does * not need any of the section info . That can be * set up later . This will minimize the chances * of a corrupt module causing problems before * we even get to the signature check . * * The check will also adjust info - > len by stripping * off the sig length at the end of the module , making * checks against info - > len more correct . if (err)goto free_copy;/* * Do basic sanity checks against the ELF header and * sections . Cache useful sections and set the * info - > mod to the userspace passed struct module . if (err)goto free_copy;if (err)goto free_copy;/* Figure out module layout, and allocate all the memory. */ if (IS_ERR(mod)) {goto free_copy;true ;/* Reserve our place in the list. */ if (err)goto free_module;/* * We are tainting your kernel if your module gets into * the modules linked list somehow . /* To avoid stressing percpu allocator, do this once we're unique. */ if (err)goto unlink_mod;/* Now module is in final location, initialize linked lists, etc. */ if (err)goto unlink_mod;/* * Now we ' ve got everything in the final locations , we can * find optional sections . if (err)goto free_unload;if (err)goto free_unload;/* Set up MODINFO_ATTR fields */ if (err)goto free_modinfo;/* Fix up syms, so that st_value is a pointer to location. */ if (err < 0 )goto free_modinfo;if (err < 0 )goto free_modinfo;if (err < 0 )goto free_modinfo;/* Now copy in args */ 0 UL >> 1 );if (IS_ERR(mod->args)) {goto free_arch_cleanup;/* Ftrace init must be called in the MODULE_STATE_UNFORMED state */ /* Finally it's fully formed, ready to start executing. */ if (err)goto ddebug_cleanup;if (err)goto bug_cleanup;/* Module is ready to execute: parsing args may do that. */ 32768 , 32767 , mod,if (IS_ERR(after_dashes)) {goto coming_cleanup;else if (after_dashes) {"%s: parameters '%s' after `--' ignored\n" ,/* Link in to sysfs. */ if (err < 0 )goto coming_cleanup;if (is_livepatch_module(mod)) {if (err < 0 )goto sysfs_cleanup;if (codetag_load_module(mod))goto sysfs_cleanup;/* Get rid of temporary copy. */ /* Done! */ return do_init_module(mod);/* module_bug_cleanup needs module_mutex protection */ /* Unlink carefully: kallsyms could be walking list. */ /* Wait for RCU-sched synchronizing before releasing mod->list. */ /* Free lock-classes; relies on the preceding sync_rcu() */ /* * The info - > len is always set . We distinguish between * failures once the proper module was allocated and * before that . if (!module_allocated) {"?" );return err;void __user *, umod,unsigned long , len, const char __user *, uargs)int err;struct load_info info = { };if (err)return err;"init_module: umod=%p, len=%lu, uargs=%p\n" ,if (err) {return err;return load_module(&info, uargs, 0 );struct idempotent {const void *cookie;struct hlist_node entry;struct completion complete;int ret;#define IDEM_HASH_BITS 8 static struct hlist_head idem_hash[1 << IDEM_HASH_BITS];static DEFINE_SPINLOCK(idem_lock);static bool idempotent(struct idempotent *u, const void *cookie)int hash = hash_ptr(cookie, IDEM_HASH_BITS);struct hlist_head *head = idem_hash + hash;struct idempotent *existing;bool first;true ;if (existing->cookie != cookie)continue ;false ;break ;return !first;/* * We were the first one with ' cookie ' on the list , and we ended * up completing the operation . We now need to walk the list , * remove everybody - which includes ourselves - fill in the return * value , and then complete the operation . static int idempotent_complete(struct idempotent *u, int ret)const void *cookie = u->cookie;int hash = hash_ptr(cookie, IDEM_HASH_BITS);struct hlist_head *head = idem_hash + hash;struct hlist_node *next;struct idempotent *pos;if (pos->cookie != cookie)continue ;return ret;/* * Wait for the idempotent worker . * * If we get interrupted , we need to remove ourselves from the * the idempotent list , and the completion may still come in . * * The ' idem_lock ' protects against the race , and ' idem . ret ' was * initialized to - EINTR and is thus always the right return * value even if the idempotent work then completes between * the wait_for_completion and the cleanup . static int idempotent_wait_for_completion(struct idempotent *u)if (wait_for_completion_interruptible(&u->complete)) {if (!hlist_unhashed(&u->entry))return u->ret;static int init_module_from_file(struct file *f, const char __user * uargs, int flags)struct load_info info = { };void *buf = NULL;int len;0 , &buf, INT_MAX, NULL, READING_MODULE);if (len < 0 ) {return len;if (flags & MODULE_INIT_COMPRESSED_FILE) {int err = module_decompress(&info, buf, len);/* compressed data is no longer needed */ if (err) {return err;else {return load_module(&info, uargs, flags);static int idempotent_init_module(struct file *f, const char __user * uargs, int flags)struct idempotent idem;if (!(f->f_mode & FMODE_READ))return -EBADF;/* Are we the winners of the race and get to do this? */ if (!idempotent(&idem, file_inode(f))) {int ret = init_module_from_file(f, uargs, flags);return idempotent_complete(&idem, ret);/* * Somebody else won the race and is loading the module . return idempotent_wait_for_completion(&idem);int , fd, const char __user *, uargs, int , flags)int err = may_init_module();if (err)return err;"finit_module: fd=%d, uargs=%p, flags=%i\n" , fd, uargs, flags);if (flags & ~(MODULE_INIT_IGNORE_MODVERSIONSreturn -EINVAL;CLASS (fd, f)(fd);if (fd_empty(f))return -EBADF;return idempotent_init_module(fd_file(f), uargs, flags);/* Keep in sync with MODULE_FLAGS_BUF_SIZE !!! */ char *module_flags(struct module *mod, char *buf, bool show_state)int bx = 0 ;if (!mod->taints && !show_state)goto out;if (mod->taints ||'(' ;/* Show a - for module-is-being-unloaded */ if (mod->state == MODULE_STATE_GOING && show_state)'-' ;/* Show a + for module-is-being-loaded */ if (mod->state == MODULE_STATE_COMING && show_state)'+' ;')' ;'\0' ;return buf;/* Given an address, look for it in the module exception tables. */ const struct exception_table_entry *search_module_extables(unsigned long addr)struct module *mod;if (!mod)return NULL;if (!mod->num_exentries)return NULL;/* * The address passed here belongs to a module that is currently * invoked ( we are running inside it ) . Therefore its module : : refcnt * needs already be > 0 to ensure that it is not removed at this stage . * All other user need to invoke this function within a RCU read * section . return search_extable(mod->extable, mod->num_exentries, addr);/** * is_module_address ( ) - is this address inside a module ? * @ addr : the address to check . * * See is_module_text_address ( ) if you simply want to see if the address * is code ( not data ) . bool is_module_address(unsigned long addr)return __module_address(addr) != NULL;/** * _ _ module_address ( ) - get the module which contains an address . * @ addr : the address . * * Must be called within RCU read section or module mutex held so that * module doesn ' t get freed during this . struct module *__module_address(unsigned long addr)struct module *mod;if (addr >= mod_tree.addr_min && addr <= mod_tree.addr_max)goto lookup;#ifdef CONFIG_ARCH_WANTS_MODULES_DATA_IN_VMALLOCif (addr >= mod_tree.data_addr_min && addr <= mod_tree.data_addr_max)goto lookup;#endif return NULL;if (mod) {if (mod->state == MODULE_STATE_UNFORMED)return mod;/** * is_module_text_address ( ) - is this address inside module code ? * @ addr : the address to check . * * See is_module_address ( ) if you simply want to see if the address is * anywhere in a module . See kernel_text_address ( ) for testing if an * address corresponds to kernel or module code . bool is_module_text_address(unsigned long addr)return __module_text_address(addr) != NULL;void module_for_each_mod(int (*func)(struct module *mod, void *data), void *data)struct module *mod;if (mod->state == MODULE_STATE_UNFORMED)continue ;if (func(mod, data))break ;/** * _ _ module_text_address ( ) - get the module whose code contains an address . * @ addr : the address . * * Must be called within RCU read section or module mutex held so that * module doesn ' t get freed during this . struct module *__module_text_address(unsigned long addr)struct module *mod = __module_address(addr);if (mod) {/* Make sure it's within the text section. */ if (!within_module_mem_type(addr, mod, MOD_TEXT) &&return mod;/* Don't grab lock, we're oopsing. */ void print_modules(void )struct module *mod;char buf[MODULE_FLAGS_BUF_SIZE];"Modules linked in:" );/* Most callers should already have preempt disabled, but make sure */ if (mod->state == MODULE_STATE_UNFORMED)continue ;" %s%s" , mod->name, module_flags(mod, buf, true ));if (last_unloaded_module.name[0 ])" [last unloaded: %s%s]" , last_unloaded_module.name,"\n" );#ifdef CONFIG_MODULE_DEBUGFSstruct dentry *mod_debugfs_root;static int module_debugfs_init(void )"modules" , NULL);return 0 ;#endif
Messung V0.5 in Prozent C=94 H=94 G=93
¤ Dauer der Verarbeitung: 0.85 Sekunden
(vorverarbeitet am 2026-09-28)
¤ *© Formatika GbR, Deutschland
