1 files changed, 190 insertions, 67 deletions

diff --git a/kernel/module.c b/kernel/module.c
index 250092c1d57d..0925c9a71975 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -188,6 +188,7 @@ struct load_info {
    ongoing or failed initialization etc. */
 static inline int strong_try_module_get(struct module *mod)
 {
+        BUG_ON(mod && mod->state == MODULE_STATE_UNFORMED);
         if (mod && mod->state == MODULE_STATE_COMING)
                 return -EBUSY;
         if (try_module_get(mod))
@@ -196,9 +197,10 @@ static inline int strong_try_module_get(struct module *mod)
                 return -ENOENT;
 }
 
-static inline void add_taint_module(struct module *mod, unsigned flag)
+static inline void add_taint_module(struct module *mod, unsigned flag,
+                                    enum lockdep_ok lockdep_ok)
 {
-        add_taint(flag);
+        add_taint(flag, lockdep_ok);
         mod->taints |= (1U << flag);
 }
 
@@ -343,6 +345,9 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
 #endif
                 };
 
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
+
                 if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
                         return true;
         }
@@ -450,16 +455,24 @@ const struct kernel_symbol *find_symbol(const char *name,
 EXPORT_SYMBOL_GPL(find_symbol);
 
 /* Search for module by name: must hold module_mutex. */
-struct module *find_module(const char *name)
+static struct module *find_module_all(const char *name,
+                                      bool even_unformed)
 {
         struct module *mod;
 
         list_for_each_entry(mod, &modules, list) {
+                if (!even_unformed && mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 if (strcmp(mod->name, name) == 0)
                         return mod;
         }
         return NULL;
 }
+
+struct module *find_module(const char *name)
+{
+        return find_module_all(name, false);
+}
 EXPORT_SYMBOL_GPL(find_module);
 
 #ifdef CONFIG_SMP
@@ -525,6 +538,8 @@ bool is_module_percpu_address(unsigned long addr)
         preempt_disable();
 
         list_for_each_entry_rcu(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 if (!mod->percpu_size)
                         continue;
                 for_each_possible_cpu(cpu) {
@@ -713,7 +728,7 @@ static inline int try_force_unload(unsigned int flags)
 {
         int ret = (flags & O_TRUNC);
         if (ret)
-                add_taint(TAINT_FORCED_RMMOD);
+                add_taint(TAINT_FORCED_RMMOD, LOCKDEP_NOW_UNRELIABLE);
         return ret;
 }
 #else
@@ -1048,6 +1063,8 @@ static ssize_t show_initstate(struct module_attribute *mattr,
         case MODULE_STATE_GOING:
                 state = "going";
                 break;
+        default:
+                BUG();
         }
         return sprintf(buffer, "%s\n", state);
 }
@@ -1122,7 +1139,7 @@ static int try_to_force_load(struct module *mod, const char *reason)
         if (!test_taint(TAINT_FORCED_MODULE))
                 printk(KERN_WARNING "%s: %s: kernel tainted.\n",
                        mod->name, reason);
-        add_taint_module(mod, TAINT_FORCED_MODULE);
+        add_taint_module(mod, TAINT_FORCED_MODULE, LOCKDEP_NOW_UNRELIABLE);
         return 0;
 #else
         return -ENOEXEC;
@@ -1786,6 +1803,8 @@ void set_all_modules_text_rw(void)
 
         mutex_lock(&module_mutex);
         list_for_each_entry_rcu(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 if ((mod->module_core) && (mod->core_text_size)) {
                         set_page_attributes(mod->module_core,
                                                 mod->module_core + mod->core_text_size,
@@ -1807,6 +1826,8 @@ void set_all_modules_text_ro(void)
 
         mutex_lock(&module_mutex);
         list_for_each_entry_rcu(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 if ((mod->module_core) && (mod->core_text_size)) {
                         set_page_attributes(mod->module_core,
                                                 mod->module_core + mod->core_text_size,
@@ -2127,7 +2148,8 @@ static void set_license(struct module *mod, const char *license)
                 if (!test_taint(TAINT_PROPRIETARY_MODULE))
                         printk(KERN_WARNING "%s: module license '%s' taints "
                                 "kernel.\n", mod->name, license);
-                add_taint_module(mod, TAINT_PROPRIETARY_MODULE);
+                add_taint_module(mod, TAINT_PROPRIETARY_MODULE,
+                                 LOCKDEP_NOW_UNRELIABLE);
         }
 }
 
@@ -2519,7 +2541,7 @@ static int copy_module_from_fd(int fd, struct load_info *info)
         if (err)
                 goto out;
 
-        err = vfs_getattr(file->f_vfsmnt, file->f_dentry, &stat);
+        err = vfs_getattr(&file->f_path, &stat);
         if (err)
                 goto out;
 
@@ -2527,6 +2549,13 @@ static int copy_module_from_fd(int fd, struct load_info *info)
                 err = -EFBIG;
                 goto out;
         }
+
+        /* Don't hand 0 to vmalloc, it whines. */
+        if (stat.size == 0) {
+                err = -EINVAL;
+                goto out;
+        }
+
         info->hdr = vmalloc(stat.size);
         if (!info->hdr) {
                 err = -ENOMEM;
@@ -2673,10 +2702,10 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags)
         }
 
         if (!get_modinfo(info, "intree"))
-                add_taint_module(mod, TAINT_OOT_MODULE);
+                add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK);
 
         if (get_modinfo(info, "staging")) {
-                add_taint_module(mod, TAINT_CRAP);
+                add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK);
                 printk(KERN_WARNING "%s: module is from the staging directory,"
                        " the quality is unknown, you have been warned.\n",
                        mod->name);
@@ -2842,15 +2871,17 @@ static int check_module_license_and_versions(struct module *mod)
          * using GPL-only symbols it needs.
          */
         if (strcmp(mod->name, "ndiswrapper") == 0)
-                add_taint(TAINT_PROPRIETARY_MODULE);
+                add_taint(TAINT_PROPRIETARY_MODULE, LOCKDEP_NOW_UNRELIABLE);
 
         /* driverloader was caught wrongly pretending to be under GPL */
         if (strcmp(mod->name, "driverloader") == 0)
-                add_taint_module(mod, TAINT_PROPRIETARY_MODULE);
+                add_taint_module(mod, TAINT_PROPRIETARY_MODULE,
+                                 LOCKDEP_NOW_UNRELIABLE);
 
         /* lve claims to be GPL but upstream won't provide source */
         if (strcmp(mod->name, "lve") == 0)
-                add_taint_module(mod, TAINT_PROPRIETARY_MODULE);
+                add_taint_module(mod, TAINT_PROPRIETARY_MODULE,
+                                 LOCKDEP_NOW_UNRELIABLE);
 
 #ifdef CONFIG_MODVERSIONS
         if ((mod->num_syms && !mod->crcs)
@@ -2990,8 +3021,9 @@ static bool finished_loading(const char *name)
         bool ret;
 
         mutex_lock(&module_mutex);
-        mod = find_module(name);
-        ret = !mod || mod->state != MODULE_STATE_COMING;
+        mod = find_module_all(name, true);
+        ret = !mod || mod->state == MODULE_STATE_LIVE
+                || mod->state == MODULE_STATE_GOING;
         mutex_unlock(&module_mutex);
 
         return ret;
@@ -3013,6 +3045,12 @@ static int do_init_module(struct module *mod)
 {
         int ret = 0;
 
+        /*
+         * We want to find out whether @mod uses async during init.  Clear
+         * PF_USED_ASYNC.  async_schedule*() will set it.
+         */
+        current->flags &= ~PF_USED_ASYNC;
+
         blocking_notifier_call_chain(&module_notify_list,
                         MODULE_STATE_COMING, mod);
 
@@ -3058,8 +3096,25 @@ static int do_init_module(struct module *mod)
         blocking_notifier_call_chain(&module_notify_list,
                                      MODULE_STATE_LIVE, mod);
 
-        /* We need to finish all async code before the module init sequence is done */
-        async_synchronize_full();
+        /*
+         * We need to finish all async code before the module init sequence
+         * is done.  This has potential to deadlock.  For example, a newly
+         * detected block device can trigger request_module() of the
+         * default iosched from async probing task.  Once userland helper
+         * reaches here, async_synchronize_full() will wait on the async
+         * task waiting on request_module() and deadlock.
+         *
+         * This deadlock is avoided by perfomring async_synchronize_full()
+         * iff module init queued any async jobs.  This isn't a full
+         * solution as it will deadlock the same if module loading from
+         * async jobs nests more than once; however, due to the various
+         * constraints, this hack seems to be the best option for now.
+         * Please refer to the following thread for details.
+         *
+         * http://thread.gmane.org/gmane.linux.kernel/1420814
+         */
+        if (current->flags & PF_USED_ASYNC)
+                async_synchronize_full();
 
         mutex_lock(&module_mutex);
         /* Drop initial reference. */
@@ -3090,12 +3145,72 @@ static int may_init_module(void)
         return 0;
 }
 
+/*
+ * We try to place it in the list now to make sure it's unique before
+ * we dedicate too many resources.  In particular, temporary percpu
+ * memory exhaustion.
+ */
+static int add_unformed_module(struct module *mod)
+{
+        int err;
+        struct module *old;
+
+        mod->state = MODULE_STATE_UNFORMED;
+
+again:
+        mutex_lock(&module_mutex);
+        if ((old = find_module_all(mod->name, true)) != NULL) {
+                if (old->state == MODULE_STATE_COMING
+                    || old->state == MODULE_STATE_UNFORMED) {
+                        /* Wait in case it fails to load. */
+                        mutex_unlock(&module_mutex);
+                        err = wait_event_interruptible(module_wq,
+                                               finished_loading(mod->name));
+                        if (err)
+                                goto out_unlocked;
+                        goto again;
+                }
+                err = -EEXIST;
+                goto out;
+        }
+        list_add_rcu(&mod->list, &modules);
+        err = 0;
+
+out:
+        mutex_unlock(&module_mutex);
+out_unlocked:
+        return err;
+}
+
+static int complete_formation(struct module *mod, struct load_info *info)
+{
+        int err;
+
+        mutex_lock(&module_mutex);
+
+        /* Find duplicate symbols (must be called under lock). */
+        err = verify_export_symbols(mod);
+        if (err < 0)
+                goto out;
+
+        /* This relies on module_mutex for list integrity. */
+        module_bug_finalize(info->hdr, info->sechdrs, mod);
+
+        /* Mark state as coming so strong_try_module_get() ignores us,
+         * but kallsyms etc. can see us. */
+        mod->state = MODULE_STATE_COMING;
+
+out:
+        mutex_unlock(&module_mutex);
+        return err;
+}
+
 /* Allocate and load the module: note that size of section 0 is always
    zero, and we rely on this for optional sections. */
 static int load_module(struct load_info *info, const char __user *uargs,
                        int flags)
 {
-        struct module *mod, *old;
+        struct module *mod;
         long err;
 
         err = module_sig_check(info);
@@ -3113,16 +3228,26 @@ static int load_module(struct load_info *info, const char __user *uargs,
                 goto free_copy;
         }
 
+        /* Reserve our place in the list. */
+        err = add_unformed_module(mod);
+        if (err)
+                goto free_module;
+
 #ifdef CONFIG_MODULE_SIG
         mod->sig_ok = info->sig_ok;
-        if (!mod->sig_ok)
-                add_taint_module(mod, TAINT_FORCED_MODULE);
+        if (!mod->sig_ok) {
+                printk_once(KERN_NOTICE
+                            "%s: module verification failed: signature and/or"
+                            " required key missing - tainting kernel\n",
+                            mod->name);
+                add_taint_module(mod, TAINT_FORCED_MODULE, LOCKDEP_STILL_OK);
+        }
 #endif
 
         /* Now module is in final location, initialize linked lists, etc. */
         err = module_unload_init(mod);
         if (err)
-                goto free_module;
+                goto unlink_mod;
 
         /* Now we've got everything in the final locations, we can
          * find optional sections. */
@@ -3157,54 +3282,23 @@ static int load_module(struct load_info *info, const char __user *uargs,
                 goto free_arch_cleanup;
         }
 
-        /* Mark state as coming so strong_try_module_get() ignores us. */
-        mod->state = MODULE_STATE_COMING;
-
-        /* Now sew it into the lists so we can get lockdep and oops
-         * info during argument parsing.  No one should access us, since
-         * strong_try_module_get() will fail.
-         * lockdep/oops can run asynchronous, so use the RCU list insertion
-         * function to insert in a way safe to concurrent readers.
-         * The mutex protects against concurrent writers.
-         */
-again:
-        mutex_lock(&module_mutex);
-        if ((old = find_module(mod->name)) != NULL) {
-                if (old->state == MODULE_STATE_COMING) {
-                        /* Wait in case it fails to load. */
-                        mutex_unlock(&module_mutex);
-                        err = wait_event_interruptible(module_wq,
-                                               finished_loading(mod->name));
-                        if (err)
-                                goto free_arch_cleanup;
-                        goto again;
-                }
-                err = -EEXIST;
-                goto unlock;
-        }
-
-        /* This has to be done once we're sure module name is unique. */
         dynamic_debug_setup(info->debug, info->num_debug);
 
-        /* Find duplicate symbols */
-        err = verify_export_symbols(mod);
-        if (err < 0)
-                goto ddebug;
-
-        module_bug_finalize(info->hdr, info->sechdrs, mod);
-        list_add_rcu(&mod->list, &modules);
-        mutex_unlock(&module_mutex);
+        /* Finally it's fully formed, ready to start executing. */
+        err = complete_formation(mod, info);
+        if (err)
+                goto ddebug_cleanup;
 
         /* Module is ready to execute: parsing args may do that. */
         err = parse_args(mod->name, mod->args, mod->kp, mod->num_kp,
                          -32768, 32767, &ddebug_dyndbg_module_param_cb);
         if (err < 0)
-                goto unlink;
+                goto bug_cleanup;
 
         /* Link in to syfs. */
         err = mod_sysfs_setup(mod, info, mod->kp, mod->num_kp);
         if (err < 0)
-                goto unlink;
+                goto bug_cleanup;
 
         /* Get rid of temporary copy. */
         free_copy(info);
@@ -3214,16 +3308,13 @@ again:
 
         return do_init_module(mod);
 
- unlink:
+ bug_cleanup:
+        /* module_bug_cleanup needs module_mutex protection */
         mutex_lock(&module_mutex);
-        /* Unlink carefully: kallsyms could be walking list. */
-        list_del_rcu(&mod->list);
         module_bug_cleanup(mod);
-        wake_up_all(&module_wq);
- ddebug:
-        dynamic_debug_remove(info->debug);
- unlock:
         mutex_unlock(&module_mutex);
+ ddebug_cleanup:
+        dynamic_debug_remove(info->debug);
         synchronize_sched();
         kfree(mod->args);
  free_arch_cleanup:
@@ -3232,6 +3323,12 @@ again:
         free_modinfo(mod);
  free_unload:
         module_unload_free(mod);
+ unlink_mod:
+        mutex_lock(&module_mutex);
+        /* Unlink carefully: kallsyms could be walking list. */
+        list_del_rcu(&mod->list);
+        wake_up_all(&module_wq);
+        mutex_unlock(&module_mutex);
  free_module:
         module_deallocate(mod, info);
  free_copy:
@@ -3354,6 +3451,8 @@ const char *module_address_lookup(unsigned long addr,
 
         preempt_disable();
         list_for_each_entry_rcu(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 if (within_module_init(addr, mod) ||
                     within_module_core(addr, mod)) {
                         if (modname)
@@ -3377,6 +3476,8 @@ int lookup_module_symbol_name(unsigned long addr, char *symname)
 
         preempt_disable();
         list_for_each_entry_rcu(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 if (within_module_init(addr, mod) ||
                     within_module_core(addr, mod)) {
                         const char *sym;
@@ -3401,6 +3502,8 @@ int lookup_module_symbol_attrs(unsigned long addr, unsigned long *size,
 
         preempt_disable();
         list_for_each_entry_rcu(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 if (within_module_init(addr, mod) ||
                     within_module_core(addr, mod)) {
                         const char *sym;
@@ -3428,6 +3531,8 @@ int module_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
 
         preempt_disable();
         list_for_each_entry_rcu(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 if (symnum < mod->num_symtab) {
                         *value = mod->symtab[symnum].st_value;
                         *type = mod->symtab[symnum].st_info;
@@ -3470,9 +3575,12 @@ unsigned long module_kallsyms_lookup_name(const char *name)
                         ret = mod_find_symname(mod, colon+1);
                 *colon = ':';
         } else {
-                list_for_each_entry_rcu(mod, &modules, list)
+                list_for_each_entry_rcu(mod, &modules, list) {
+                        if (mod->state == MODULE_STATE_UNFORMED)
+                                continue;
                         if ((ret = mod_find_symname(mod, name)) != 0)
                                 break;
+                }
         }
         preempt_enable();
         return ret;
@@ -3487,6 +3595,8 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *,
         int ret;
 
         list_for_each_entry(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 for (i = 0; i < mod->num_symtab; i++) {
                         ret = fn(data, mod->strtab + mod->symtab[i].st_name,
                                  mod, mod->symtab[i].st_value);
@@ -3502,6 +3612,7 @@ static char *module_flags(struct module *mod, char *buf)
 {
         int bx = 0;
 
+        BUG_ON(mod->state == MODULE_STATE_UNFORMED);
         if (mod->taints ||
             mod->state == MODULE_STATE_GOING ||
             mod->state == MODULE_STATE_COMING) {
@@ -3543,6 +3654,10 @@ static int m_show(struct seq_file *m, void *p)
         struct module *mod = list_entry(p, struct module, list);
         char buf[8];
 
+        /* We always ignore unformed modules. */
+        if (mod->state == MODULE_STATE_UNFORMED)
+                return 0;
+
         seq_printf(m, "%s %u",
                    mod->name, mod->init_size + mod->core_size);
         print_unload_info(m, mod);
@@ -3603,6 +3718,8 @@ const struct exception_table_entry *search_module_extables(unsigned long addr)
 
         preempt_disable();
         list_for_each_entry_rcu(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 if (mod->num_exentries == 0)
                         continue;
 
@@ -3651,10 +3768,13 @@ struct module *__module_address(unsigned long addr)
         if (addr < module_addr_min || addr > module_addr_max)
                 return NULL;
 
-        list_for_each_entry_rcu(mod, &modules, list)
+        list_for_each_entry_rcu(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 if (within_module_core(addr, mod)
                     || within_module_init(addr, mod))
                         return mod;
+        }
         return NULL;
 }
 EXPORT_SYMBOL_GPL(__module_address);
@@ -3707,8 +3827,11 @@ void print_modules(void)
         printk(KERN_DEFAULT "Modules linked in:");
         /* Most callers should already have preempt disabled, but make sure */
         preempt_disable();
-        list_for_each_entry_rcu(mod, &modules, list)
+        list_for_each_entry_rcu(mod, &modules, list) {
+                if (mod->state == MODULE_STATE_UNFORMED)
+                        continue;
                 printk(" %s%s", mod->name, module_flags(mod, buf));
+        }
         preempt_enable();
         if (last_unloaded_module[0])
                 printk(" [last unloaded: %s]", last_unloaded_module);