5 files changed, 59 insertions, 34 deletions

diff --git a/Documentation/livepatch/shadow-vars.txt b/Documentation/livepatch/shadow-vars.txt
index 9c7ae191641c..ecc09a7be5dd 100644
--- a/Documentation/livepatch/shadow-vars.txt
+++ b/Documentation/livepatch/shadow-vars.txt
@@ -65,11 +65,15 @@ to do actions that can be done only once when a new variable is allocated.
 
 * klp_shadow_free() - detach and free a <obj, id> shadow variable
   - find and remove a <obj, id> reference from global hashtable
-    - if found, free shadow variable
+    - if found
+      - call destructor function if defined
+      - free shadow variable
 
 * klp_shadow_free_all() - detach and free all <*, id> shadow variables
   - find and remove any <*, id> references from global hashtable
-    - if found, free shadow variable
+    - if found
+      - call destructor function if defined
+      - free shadow variable
 
 
 2. Use cases
@@ -136,7 +140,7 @@ variable:
 
 void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
 {
-        klp_shadow_free(sta, PS_LOCK);
+        klp_shadow_free(sta, PS_LOCK, NULL);
         kfree(sta);
         ...
 
diff --git a/include/linux/livepatch.h b/include/linux/livepatch.h
index 7e084321b146..aec44b1d9582 100644
--- a/include/linux/livepatch.h
+++ b/include/linux/livepatch.h
@@ -189,6 +189,7 @@ static inline bool klp_have_reliable_stack(void)
 typedef int (*klp_shadow_ctor_t)(void *obj,
                                  void *shadow_data,
                                  void *ctor_data);
+typedef void (*klp_shadow_dtor_t)(void *obj, void *shadow_data);
 
 void *klp_shadow_get(void *obj, unsigned long id);
 void *klp_shadow_alloc(void *obj, unsigned long id,
@@ -197,8 +198,8 @@ void *klp_shadow_alloc(void *obj, unsigned long id,
 void *klp_shadow_get_or_alloc(void *obj, unsigned long id,
                               size_t size, gfp_t gfp_flags,
                               klp_shadow_ctor_t ctor, void *ctor_data);
-void klp_shadow_free(void *obj, unsigned long id);
-void klp_shadow_free_all(unsigned long id);
+void klp_shadow_free(void *obj, unsigned long id, klp_shadow_dtor_t dtor);
+void klp_shadow_free_all(unsigned long id, klp_shadow_dtor_t dtor);
 
 #else /* !CONFIG_LIVEPATCH */
 
diff --git a/kernel/livepatch/shadow.c b/kernel/livepatch/shadow.c
index b10a0bbb7f84..83958c814439 100644
--- a/kernel/livepatch/shadow.c
+++ b/kernel/livepatch/shadow.c
@@ -243,15 +243,26 @@ void *klp_shadow_get_or_alloc(void *obj, unsigned long id,
 }
 EXPORT_SYMBOL_GPL(klp_shadow_get_or_alloc);
 
+static void klp_shadow_free_struct(struct klp_shadow *shadow,
+                                   klp_shadow_dtor_t dtor)
+{
+        hash_del_rcu(&shadow->node);
+        if (dtor)
+                dtor(shadow->obj, shadow->data);
+        kfree_rcu(shadow, rcu_head);
+}
+
 /**
  * klp_shadow_free() - detach and free a <obj, id> shadow variable
  * @obj:        pointer to parent object
  * @id:         data identifier
+ * @dtor:       custom callback that can be used to unregister the variable
+ *              and/or free data that the shadow variable points to (optional)
  *
  * This function releases the memory for this <obj, id> shadow variable
  * instance, callers should stop referencing it accordingly.
  */
-void klp_shadow_free(void *obj, unsigned long id)
+void klp_shadow_free(void *obj, unsigned long id, klp_shadow_dtor_t dtor)
 {
         struct klp_shadow *shadow;
         unsigned long flags;
@@ -263,8 +274,7 @@ void klp_shadow_free(void *obj, unsigned long id)
                                (unsigned long)obj) {
 
                 if (klp_shadow_match(shadow, obj, id)) {
-                        hash_del_rcu(&shadow->node);
-                        kfree_rcu(shadow, rcu_head);
+                        klp_shadow_free_struct(shadow, dtor);
                         break;
                 }
         }
@@ -276,11 +286,13 @@ EXPORT_SYMBOL_GPL(klp_shadow_free);
 /**
  * klp_shadow_free_all() - detach and free all <*, id> shadow variables
  * @id:         data identifier
+ * @dtor:       custom callback that can be used to unregister the variable
+ *              and/or free data that the shadow variable points to (optional)
  *
  * This function releases the memory for all <*, id> shadow variable
  * instances, callers should stop referencing them accordingly.
  */
-void klp_shadow_free_all(unsigned long id)
+void klp_shadow_free_all(unsigned long id, klp_shadow_dtor_t dtor)
 {
         struct klp_shadow *shadow;
         unsigned long flags;
@@ -290,10 +302,8 @@ void klp_shadow_free_all(unsigned long id)
 
         /* Delete all <*, id> from hash */
         hash_for_each(klp_shadow_hash, i, shadow, node) {
-                if (klp_shadow_match(shadow, shadow->obj, id)) {
-                        hash_del_rcu(&shadow->node);
-                        kfree_rcu(shadow, rcu_head);
-                }
+                if (klp_shadow_match(shadow, shadow->obj, id))
+                        klp_shadow_free_struct(shadow, dtor);
         }
 
         spin_unlock_irqrestore(&klp_shadow_lock, flags);
diff --git a/samples/livepatch/livepatch-shadow-fix1.c b/samples/livepatch/livepatch-shadow-fix1.c
index 04151c7f2631..49b13553eaae 100644
--- a/samples/livepatch/livepatch-shadow-fix1.c
+++ b/samples/livepatch/livepatch-shadow-fix1.c
@@ -98,9 +98,19 @@ struct dummy *livepatch_fix1_dummy_alloc(void)
         return d;
 }
 
+static void livepatch_fix1_dummy_leak_dtor(void *obj, void *shadow_data)
+{
+        void *d = obj;
+        void **shadow_leak = shadow_data;
+
+        kfree(*shadow_leak);
+        pr_info("%s: dummy @ %p, prevented leak @ %p\n",
+                         __func__, d, *shadow_leak);
+}
+
 void livepatch_fix1_dummy_free(struct dummy *d)
 {
-        void **shadow_leak, *leak;
+        void **shadow_leak;
 
         /*
          * Patch: fetch the saved SV_LEAK shadow variable, detach and
@@ -109,15 +119,10 @@ void livepatch_fix1_dummy_free(struct dummy *d)
          * was loaded.)
          */
         shadow_leak = klp_shadow_get(d, SV_LEAK);
-        if (shadow_leak) {
-                leak = *shadow_leak;
-                klp_shadow_free(d, SV_LEAK);
-                kfree(leak);
-                pr_info("%s: dummy @ %p, prevented leak @ %p\n",
-                         __func__, d, leak);
-        } else {
+        if (shadow_leak)
+                klp_shadow_free(d, SV_LEAK, livepatch_fix1_dummy_leak_dtor);
+        else
                 pr_info("%s: dummy @ %p leaked!\n", __func__, d);
-        }
 
         kfree(d);
 }
@@ -163,7 +168,7 @@ static int livepatch_shadow_fix1_init(void)
 static void livepatch_shadow_fix1_exit(void)
 {
         /* Cleanup any existing SV_LEAK shadow variables */
-        klp_shadow_free_all(SV_LEAK);
+        klp_shadow_free_all(SV_LEAK, livepatch_fix1_dummy_leak_dtor);
 
         WARN_ON(klp_unregister_patch(&patch));
 }
diff --git a/samples/livepatch/livepatch-shadow-fix2.c b/samples/livepatch/livepatch-shadow-fix2.c
index d6c62844dc15..b34c7bf83356 100644
--- a/samples/livepatch/livepatch-shadow-fix2.c
+++ b/samples/livepatch/livepatch-shadow-fix2.c
@@ -68,22 +68,27 @@ bool livepatch_fix2_dummy_check(struct dummy *d, unsigned long jiffies)
         return time_after(jiffies, d->jiffies_expire);
 }
 
+static void livepatch_fix2_dummy_leak_dtor(void *obj, void *shadow_data)
+{
+        void *d = obj;
+        void **shadow_leak = shadow_data;
+
+        kfree(*shadow_leak);
+        pr_info("%s: dummy @ %p, prevented leak @ %p\n",
+                         __func__, d, *shadow_leak);
+}
+
 void livepatch_fix2_dummy_free(struct dummy *d)
 {
-        void **shadow_leak, *leak;
+        void **shadow_leak;
         int *shadow_count;
 
         /* Patch: copy the memory leak patch from the fix1 module. */
         shadow_leak = klp_shadow_get(d, SV_LEAK);
-        if (shadow_leak) {
-                leak = *shadow_leak;
-                klp_shadow_free(d, SV_LEAK);
-                kfree(leak);
-                pr_info("%s: dummy @ %p, prevented leak @ %p\n",
-                         __func__, d, leak);
-        } else {
+        if (shadow_leak)
+                klp_shadow_free(d, SV_LEAK, livepatch_fix2_dummy_leak_dtor);
+        else
                 pr_info("%s: dummy @ %p leaked!\n", __func__, d);
-        }
 
         /*
          * Patch: fetch the SV_COUNTER shadow variable and display
@@ -93,7 +98,7 @@ void livepatch_fix2_dummy_free(struct dummy *d)
         if (shadow_count) {
                 pr_info("%s: dummy @ %p, check counter = %d\n",
                         __func__, d, *shadow_count);
-                klp_shadow_free(d, SV_COUNTER);
+                klp_shadow_free(d, SV_COUNTER, NULL);
         }
 
         kfree(d);
@@ -140,7 +145,7 @@ static int livepatch_shadow_fix2_init(void)
 static void livepatch_shadow_fix2_exit(void)
 {
         /* Cleanup any existing SV_COUNTER shadow variables */
-        klp_shadow_free_all(SV_COUNTER);
+        klp_shadow_free_all(SV_COUNTER, NULL);
 
         WARN_ON(klp_unregister_patch(&patch));
 }