Fix race between cat /proc/*/wchan and rmmod et al

kallsyms_lookup() can go iterating over modules list unprotected which is OK
for emergency situations (oops), but not OK for regular stuff like
/proc/*/wchan.

Introduce lookup_symbol_name()/lookup_module_symbol_name() which copy symbol
name into caller-supplied buffer or return -ERANGE.  All copying is done with
module_mutex held, so...

Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

7 files changed, 66 insertions, 19 deletions

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 3b4fe21c7e94..0c2052c79243 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -278,16 +278,15 @@ static int proc_pid_auxv(struct task_struct *task, char *buffer)
  */
 static int proc_pid_wchan(struct task_struct *task, char *buffer)
 {
-        const char *sym_name;
         unsigned long wchan;
-        char namebuf[KSYM_NAME_LEN+1];
+        char symname[KSYM_NAME_LEN+1];
 
         wchan = get_wchan(task);
 
-        sym_name = kallsyms_lookup(wchan, NULL, NULL, NULL, namebuf);
-        if (sym_name)
-                return sprintf(buffer, "%s", sym_name);
-        return sprintf(buffer, "%lu", wchan);
+        if (lookup_symbol_name(wchan, symname) < 0)
+                return sprintf(buffer, "%lu", wchan);
+        else
+                return sprintf(buffer, "%s", symname);
 }
 #endif /* CONFIG_KALLSYMS */
 
diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
index 3e3b92dabe3b..ae0117a95cfd 100644
--- a/include/linux/kallsyms.h
+++ b/include/linux/kallsyms.h
@@ -30,6 +30,8 @@ extern int sprint_symbol(char *buffer, unsigned long address);
 /* Look up a kernel symbol and print it to the kernel messages. */
 extern void __print_symbol(const char *fmt, unsigned long address);
 
+int lookup_symbol_name(unsigned long addr, char *symname);
+
 #else /* !CONFIG_KALLSYMS */
 
 static inline unsigned long kallsyms_lookup_name(const char *name)
@@ -58,6 +60,11 @@ static inline int sprint_symbol(char *buffer, unsigned long addr)
         return 0;
 }
 
+static inline int lookup_symbol_name(unsigned long addr, char *symname)
+{
+        return -ERANGE;
+}
+
 /* Stupid that this does nothing, but I didn't create this mess. */
 #define __print_symbol(fmt, addr)
 #endif /*CONFIG_KALLSYMS*/
diff --git a/include/linux/module.h b/include/linux/module.h
index 58d5a10cdf0d..099ae5932c68 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -454,6 +454,7 @@ const char *module_address_lookup(unsigned long addr,
                                   unsigned long *symbolsize,
                                   unsigned long *offset,
                                   char **modname);
+int lookup_module_symbol_name(unsigned long addr, char *symname);
 
 /* For extable.c to search modules' exception tables. */
 const struct exception_table_entry *search_module_extables(unsigned long addr);
@@ -525,6 +526,11 @@ static inline const char *module_address_lookup(unsigned long addr,
         return NULL;
 }
 
+static inline int lookup_module_symbol_name(unsigned long addr, char *symname)
+{
+        return -ERANGE;
+}
+
 static inline int module_get_kallsym(unsigned int symnum, unsigned long *value,
                                         char *type, char *name,
                                         char *module_name, int *exported)
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index f66da025cb7f..4e2ec191a127 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -269,6 +269,23 @@ const char *kallsyms_lookup(unsigned long addr,
         return NULL;
 }
 
+int lookup_symbol_name(unsigned long addr, char *symname)
+{
+        symname[0] = '\0';
+        symname[KSYM_NAME_LEN] = '\0';
+
+        if (is_ksym_addr(addr)) {
+                unsigned long pos;
+
+                pos = get_symbol_pos(addr, NULL, NULL);
+                /* Grab name */
+                kallsyms_expand_symbol(get_symbol_offset(pos), symname);
+                return 0;
+        }
+        /* see if it's in a module */
+        return lookup_module_symbol_name(addr, symname);
+}
+
 /* Look up a kernel symbol and return it in a text buffer. */
 int sprint_symbol(char *buffer, unsigned long address)
 {
diff --git a/kernel/module.c b/kernel/module.c
index bf4dccadf7b8..3da76ad32d78 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2126,6 +2126,29 @@ const char *module_address_lookup(unsigned long addr,
         return NULL;
 }
 
+int lookup_module_symbol_name(unsigned long addr, char *symname)
+{
+        struct module *mod;
+
+        mutex_lock(&module_mutex);
+        list_for_each_entry(mod, &modules, list) {
+                if (within(addr, mod->module_init, mod->init_size) ||
+                    within(addr, mod->module_core, mod->core_size)) {
+                        const char *sym;
+
+                        sym = get_ksymbol(mod, addr, NULL, NULL);
+                        if (!sym)
+                                goto out;
+                        strlcpy(symname, sym, KSYM_NAME_LEN + 1);
+                        mutex_unlock(&module_mutex);
+                        return 0;
+                }
+        }
+out:
+        mutex_unlock(&module_mutex);
+        return -ERANGE;
+}
+
 int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
                         char *name, char *module_name, int *exported)
 {
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index fe9314a89f20..b734ca4bc75e 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -38,15 +38,12 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
 
 static void print_name_offset(struct seq_file *m, void *sym)
 {
-        unsigned long addr = (unsigned long)sym;
-        char namebuf[KSYM_NAME_LEN+1];
-        const char *sym_name;
+        char symname[KSYM_NAME_LEN+1];
 
-        sym_name = kallsyms_lookup(addr, NULL, NULL, NULL, namebuf);
-        if (sym_name)
-                SEQ_printf(m, "%s", sym_name);
-        else
+        if (lookup_symbol_name((unsigned long)sym, symname) < 0)
                 SEQ_printf(m, "<%p>", sym);
+        else
+                SEQ_printf(m, "%s", symname);
 }
 
 static void
diff --git a/kernel/time/timer_stats.c b/kernel/time/timer_stats.c
index 946ed45f7d2f..868f1bceb07f 100644
--- a/kernel/time/timer_stats.c
+++ b/kernel/time/timer_stats.c
@@ -257,14 +257,12 @@ void timer_stats_update_stats(void *timer, pid_t pid, void *startf,
 
 static void print_name_offset(struct seq_file *m, unsigned long addr)
 {
-        char namebuf[KSYM_NAME_LEN+1];
-        const char *sym_name;
+        char symname[KSYM_NAME_LEN+1];
 
-        sym_name = kallsyms_lookup(addr, NULL, NULL, NULL, namebuf);
-        if (sym_name)
-                seq_printf(m, "%s", sym_name);
-        else
+        if (lookup_symbol_name(addr, symname) < 0)
                 seq_printf(m, "<%p>", (void *)addr);
+        else
+                seq_printf(m, "%s", symname);
 }
 
 static int tstats_show(struct seq_file *m, void *v)