Re: [PATCH] Do not use relay_file_operations directly.

[PrzemysÅaw PaweÅczyk <przemyslaw at pawelczyk dot it>]

Hi,

I have just committed a patch with following description.

> Reference counting is important to avoid removing the module while the
> file exposing relay channel is being used. SystemTap alone does not need
> it, but malicious user may block reloading the module by opening such
> file and stap user won't notice it during unloading.
>
> relay_file_operations defined and exported in kernel/relay.c is const
> and .owner is obviously not set there, hence it shouldn't be used
> directly by any kernel module.
>
> Add relay_file_operations_w_owner and use it instead of mentioned one to
> fix 'trace' file handling w.r.t. module unloading.
>
> * runtime/transport/relay_v2.c: Add owner to the trace file.
> ---
> Âruntime/transport/relay_v2.c | Â Â8 +++++++-
> Â1 files changed, 7 insertions(+), 1 deletions(-)

Yes, We were blindly using relay_file_operations which is pretty bad
if there are some evil users. But no more!

SystemTap package maintainers (in distributions not using latest stap
version from git) should apply this fix.


Bonus: record of not so (thanks to the patch) evil behavior.

### pts/1

$ stap -e probe begin { println("Hello world"); }
Hello world

### pts/2

$ tail -f /sys/kernel/debug/systemtap/stap_*/trace0

### pts/1

^CError removing module 'stap_1218a25c1575dcaa37f47e2577fda605_604':
Resource temporarily unavailable.
Pass 5: run failed.  Try again with another '--vp 00001' option.

$ lsmod | grep stap
stap_1218a25c1575dcaa37f47e2577fda605_604    16957  1

$ stap -e 'probe begin { println("Hello world"); }'
Error inserting module
'/tmp/stapGC2MDK/stap_1218a25c1575dcaa37f47e2577fda605_604.ko': File
exists
Retrying, after attempted removal of module
stap_1218a25c1575dcaa37f47e2577fda605_604 (rc -1)
Error inserting module
'/tmp/stapGC2MDK/stap_1218a25c1575dcaa37f47e2577fda605_604.ko': File
exists
Pass 5: run failed.  Try again with another '--vp 00001' option.

$ lsof | grep stap
tail      27613    przemoc    3r      REG                0,6        12
  110014 /sys/kernel/debug/systemtap/stap_1218a25c1575dcaa37f47e2577fda605_604/trace0

$ kill 27613

### pts/2

Terminated

### pts/1

$ stap -e 'probe begin { println("Hello world"); }'
Error inserting module
'/tmp/stapv7RlM9/stap_1218a25c1575dcaa37f47e2577fda605_604.ko': File
exists
Retrying, after attempted removal of module
stap_1218a25c1575dcaa37f47e2577fda605_604 (rc 0)
Hello world
^C


Regards.

-- 
PrzemysÅaw PaweÅczyk