Re: [PATCH v11 32/38] dyndbg: resolve "protection" of class'd pr_debug

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] dyndbg: race during module load bypasses ABI protection permanently
--

commit c8a052c030fff7b63aa2d9e4c2dc3aa455948704
Author: Jim Cromie <jim.cromie@gmail.com>

dyndbg: resolve "protection" of class'd pr_debug

This patch implements an ABI protection mechanism for dynamically debugged
classes by binding a controlling sysfs parameter to classmaps. If a module
parameter is configured, it protects class'd callsites from being
accidentally modified by un-classed wildcard queries.

> diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
> index 636a88994a774..d300d44c1a82e 100644
> --- a/lib/dynamic_debug.c
> +++ b/lib/dynamic_debug.c

[ ... ]

> @@ -252,7 +294,28 @@ static bool ddebug_match_desc(const struct ddebug_query *query,
>  	    dp->lineno > query->last_lineno)
>  		return false;
>  
> -	return true;
> +	/*
> +	 * above are all satisfied, so we can make final decisions:
> +	 * 1- class FOO or implied class __DEFAULT__
> +	 * 2- site.is_classed or not
> +	 */
> +	if (query->class_string) {
> +		/* class FOO given, exact match required */
> +		return (dp->class_id == selected_class);
> +	}
> +	/* query class __DEFAULT__ by omission. */
> +	if (dp->class_id == _DPRINTK_CLASS_DFLT) {
> +		/* un-classed site */
> +		return true;
> +	}
> +	/* site is class'd */
> +	site_map = ddebug_find_map_by_class_id(di, dp->class_id);
> +	if (!site_map) {
> +		WARN_ONCE(1, "unknown class_id %d, check %s's CLASSMAP definitions", dp->class_id, di->mod_name);
> +		return false;
> +	}
> +	/* module(-param) decides protection */
> +	return !ddebug_class_wants_protection(site_map);
>  }

[Severity: Medium]
Does this code expose a race condition when a module is loading?

Looking at ddebug_add_module(), the module is added to ddebug_tables and the
ddebug_lock is dropped before map->controlling_param is initialized:

lib/dynamic_debug.c:ddebug_add_module() {
	...
	mutex_lock(&ddebug_lock);
	list_add_tail(&dt->link, &ddebug_tables);
	mutex_unlock(&ddebug_lock);

	if (dt->info.maps.len)
		ddebug_apply_class_maps(&dt->info);
	...
}

If a concurrent wildcard query (like echo -p > /proc/dynamic_debug/control)
is processed while the lock is dropped but before ddebug_apply_class_maps()
finishes binding the parameter, site_map->controlling_param will be NULL.

This causes ddebug_class_wants_protection() to return false, bypassing the
protection and erroneously enabling the callsites.

[ ... ]

> @@ -772,11 +833,14 @@ static int param_set_dyndbg_module_classes(const char *instr,
>  					   const struct kernel_param *kp,
>  					   const char *mod_name)
>  {
> -	const struct ddebug_class_param *dcp = kp->arg;
> -	const struct ddebug_class_map *map = dcp->map;
> +	struct ddebug_class_param *dcp = kp->arg;
> +	struct ddebug_class_map *map = dcp->map;
>  	u32 inrep, new_bits, old_bits, old_val;
>  	int rc, totct = 0;
>  
> +	if (map && !map->controlling_param)
> +		map->controlling_param = dcp;

[Severity: Medium]
Is it safe to assign map->controlling_param here without holding
ddebug_lock or using WRITE_ONCE()?

Since this shared state is accessed by concurrent queries, could this
cause a data race?

[ ... ]

> @@ -1332,25 +1395,40 @@ static void ddebug_sync_classbits(const struct kernel_param *kp, const char *mod
>  	}
>  }
>  
> -static void ddebug_match_apply_kparam(const struct kernel_param *kp,
> -				      const struct ddebug_class_map *map,
> -				      const char *mod_name)
> +static struct ddebug_class_param *
> +ddebug_get_classmap_kparam(const struct kernel_param *kp,
> +			   const struct ddebug_class_map *map)
> +{
> +	struct ddebug_class_param *dcp;
> +
> +	if (kp->ops != &param_ops_dyndbg_classes)
> +		return NULL;
> +
> +	dcp = (struct ddebug_class_param *)kp->arg;
> +	return (map == dcp->map)
> +		? dcp : (struct ddebug_class_param *)NULL;
> +}
> +
> +static void ddebug_match_apply_kparam(const struct kernel_param *kp,
> +				      struct ddebug_class_map *map,
> +				      const char *mod_name)
>  {
> +	struct ddebug_class_param *dcp = ddebug_get_classmap_kparam(kp, map);
>  
>  	if (dcp && dcp->map == map) {
> +		/*
> +		 * Bind controlling_param to activate ABI protection in
> +		 * ddebug_match_desc(), shielding callsites from non-class
> +		 * wildcard (>control) queries.
> +		 */
> +		map->controlling_param = dcp;
>  		v2pr_info(" kp:%s.%s =0x%x", mod_name, kp->name, *dcp->bits);
>  		vpr_cm_info(map, " %s maps ", mod_name);
>  		ddebug_sync_classbits(kp, mod_name);
>  	}
>  }

[Severity: Medium]
Can the delayed assignment of map->controlling_param combined with
ddebug_sync_classbits() result in permanent desynchronization?

During the race window in ddebug_add_module() mentioned above, callsites
can be erroneously enabled by a concurrent query. Once the module loading
thread resumes, it binds map->controlling_param here and calls
ddebug_sync_classbits().

However, ddebug_sync_classbits() passes 0 for old_bits:

lib/dynamic_debug.c:ddebug_sync_classbits() {
	...
	case DD_CLASS_TYPE_DISJOINT_BITS:
		val = READ_ONCE(*dcp->bits);
		new_bits = val;
		v2pr_info("  %s: classbits: 0x%x\n", KP_NAME(kp), new_bits);
		ddebug_apply_class_bitmap(dcp, &new_bits, 0, modname);
	...
}

Because old_bits is 0, the function skips resetting any class bits that are
supposed to be off (since it sees new_bits (0) == old_bits (0)). Doesn't this
prevent the synchronizer from noticing and clearing the erroneously enabled
callsites?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923-dd-cmap-part2-clean-v11-0-9b6c217fdf2f@gmail.com?part=32