1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright(c) 2014 Intel Mobile Communications GmbH 4 * Copyright(c) 2015 Intel Deutschland GmbH 5 * 6 * Author: Johannes Berg <johannes@sipsolutions.net> 7 */ 8 #include <linux/module.h> 9 #include <linux/device.h> 10 #include <linux/devcoredump.h> 11 #include <linux/list.h> 12 #include <linux/slab.h> 13 #include <linux/fs.h> 14 #include <linux/workqueue.h> 15 16 static struct class devcd_class; 17 18 /* global disable flag, for security purposes */ 19 static bool devcd_disabled; 20 21 /* if data isn't read by userspace after 5 minutes then delete it */ 22 #define DEVCD_TIMEOUT (HZ * 60 * 5) 23 24 struct devcd_entry { 25 struct device devcd_dev; 26 void *data; 27 size_t datalen; 28 /* 29 * Here, mutex is required to serialize the calls to del_wk work between 30 * user/kernel space which happens when devcd is added with device_add() 31 * and that sends uevent to user space. User space reads the uevents, 32 * and calls to devcd_data_write() which try to modify the work which is 33 * not even initialized/queued from devcoredump. 34 * 35 * 36 * 37 * cpu0(X) cpu1(Y) 38 * 39 * dev_coredump() uevent sent to user space 40 * device_add() ======================> user space process Y reads the 41 * uevents writes to devcd fd 42 * which results into writes to 43 * 44 * devcd_data_write() 45 * mod_delayed_work() 46 * try_to_grab_pending() 47 * del_timer() 48 * debug_assert_init() 49 * INIT_DELAYED_WORK() 50 * schedule_delayed_work() 51 * 52 * 53 * Also, mutex alone would not be enough to avoid scheduling of 54 * del_wk work after it get flush from a call to devcd_free() 55 * mentioned as below. 56 * 57 * disabled_store() 58 * devcd_free() 59 * mutex_lock() devcd_data_write() 60 * flush_delayed_work() 61 * mutex_unlock() 62 * mutex_lock() 63 * mod_delayed_work() 64 * mutex_unlock() 65 * So, delete_work flag is required. 66 */ 67 struct mutex mutex; 68 bool delete_work; 69 struct module *owner; 70 ssize_t (*read)(char *buffer, loff_t offset, size_t count, 71 void *data, size_t datalen); 72 void (*free)(void *data); 73 struct delayed_work del_wk; 74 struct device *failing_dev; 75 }; 76 77 static struct devcd_entry *dev_to_devcd(struct device *dev) 78 { 79 return container_of(dev, struct devcd_entry, devcd_dev); 80 } 81 82 static void devcd_dev_release(struct device *dev) 83 { 84 struct devcd_entry *devcd = dev_to_devcd(dev); 85 86 devcd->free(devcd->data); 87 module_put(devcd->owner); 88 89 /* 90 * this seems racy, but I don't see a notifier or such on 91 * a struct device to know when it goes away? 92 */ 93 if (devcd->failing_dev->kobj.sd) 94 sysfs_delete_link(&devcd->failing_dev->kobj, &dev->kobj, 95 "devcoredump"); 96 97 put_device(devcd->failing_dev); 98 kfree(devcd); 99 } 100 101 static void devcd_del(struct work_struct *wk) 102 { 103 struct devcd_entry *devcd; 104 105 devcd = container_of(wk, struct devcd_entry, del_wk.work); 106 107 device_del(&devcd->devcd_dev); 108 put_device(&devcd->devcd_dev); 109 } 110 111 static ssize_t devcd_data_read(struct file *filp, struct kobject *kobj, 112 struct bin_attribute *bin_attr, 113 char *buffer, loff_t offset, size_t count) 114 { 115 struct device *dev = kobj_to_dev(kobj); 116 struct devcd_entry *devcd = dev_to_devcd(dev); 117 118 return devcd->read(buffer, offset, count, devcd->data, devcd->datalen); 119 } 120 121 static ssize_t devcd_data_write(struct file *filp, struct kobject *kobj, 122 struct bin_attribute *bin_attr, 123 char *buffer, loff_t offset, size_t count) 124 { 125 struct device *dev = kobj_to_dev(kobj); 126 struct devcd_entry *devcd = dev_to_devcd(dev); 127 128 mutex_lock(&devcd->mutex); 129 if (!devcd->delete_work) { 130 devcd->delete_work = true; 131 mod_delayed_work(system_wq, &devcd->del_wk, 0); 132 } 133 mutex_unlock(&devcd->mutex); 134 135 return count; 136 } 137 138 static struct bin_attribute devcd_attr_data = { 139 .attr = { .name = "data", .mode = S_IRUSR | S_IWUSR, }, 140 .size = 0, 141 .read = devcd_data_read, 142 .write = devcd_data_write, 143 }; 144 145 static struct bin_attribute *devcd_dev_bin_attrs[] = { 146 &devcd_attr_data, NULL, 147 }; 148 149 static const struct attribute_group devcd_dev_group = { 150 .bin_attrs = devcd_dev_bin_attrs, 151 }; 152 153 static const struct attribute_group *devcd_dev_groups[] = { 154 &devcd_dev_group, NULL, 155 }; 156 157 static int devcd_free(struct device *dev, void *data) 158 { 159 struct devcd_entry *devcd = dev_to_devcd(dev); 160 161 mutex_lock(&devcd->mutex); 162 if (!devcd->delete_work) 163 devcd->delete_work = true; 164 165 flush_delayed_work(&devcd->del_wk); 166 mutex_unlock(&devcd->mutex); 167 return 0; 168 } 169 170 static ssize_t disabled_show(const struct class *class, const struct class_attribute *attr, 171 char *buf) 172 { 173 return sysfs_emit(buf, "%d\n", devcd_disabled); 174 } 175 176 /* 177 * 178 * disabled_store() worker() 179 * class_for_each_device(&devcd_class, 180 * NULL, NULL, devcd_free) 181 * ... 182 * ... 183 * while ((dev = class_dev_iter_next(&iter)) 184 * devcd_del() 185 * device_del() 186 * put_device() <- last reference 187 * error = fn(dev, data) devcd_dev_release() 188 * devcd_free(dev, data) kfree(devcd) 189 * mutex_lock(&devcd->mutex); 190 * 191 * 192 * In the above diagram, It looks like disabled_store() would be racing with parallely 193 * running devcd_del() and result in memory abort while acquiring devcd->mutex which 194 * is called after kfree of devcd memory after dropping its last reference with 195 * put_device(). However, this will not happens as fn(dev, data) runs 196 * with its own reference to device via klist_node so it is not its last reference. 197 * so, above situation would not occur. 198 */ 199 200 static ssize_t disabled_store(const struct class *class, const struct class_attribute *attr, 201 const char *buf, size_t count) 202 { 203 long tmp = simple_strtol(buf, NULL, 10); 204 205 /* 206 * This essentially makes the attribute write-once, since you can't 207 * go back to not having it disabled. This is intentional, it serves 208 * as a system lockdown feature. 209 */ 210 if (tmp != 1) 211 return -EINVAL; 212 213 devcd_disabled = true; 214 215 class_for_each_device(&devcd_class, NULL, NULL, devcd_free); 216 217 return count; 218 } 219 static CLASS_ATTR_RW(disabled); 220 221 static struct attribute *devcd_class_attrs[] = { 222 &class_attr_disabled.attr, 223 NULL, 224 }; 225 ATTRIBUTE_GROUPS(devcd_class); 226 227 static struct class devcd_class = { 228 .name = "devcoredump", 229 .dev_release = devcd_dev_release, 230 .dev_groups = devcd_dev_groups, 231 .class_groups = devcd_class_groups, 232 }; 233 234 static ssize_t devcd_readv(char *buffer, loff_t offset, size_t count, 235 void *data, size_t datalen) 236 { 237 return memory_read_from_buffer(buffer, count, &offset, data, datalen); 238 } 239 240 static void devcd_freev(void *data) 241 { 242 vfree(data); 243 } 244 245 /** 246 * dev_coredumpv - create device coredump with vmalloc data 247 * @dev: the struct device for the crashed device 248 * @data: vmalloc data containing the device coredump 249 * @datalen: length of the data 250 * @gfp: allocation flags 251 * 252 * This function takes ownership of the vmalloc'ed data and will free 253 * it when it is no longer used. See dev_coredumpm() for more information. 254 */ 255 void dev_coredumpv(struct device *dev, void *data, size_t datalen, 256 gfp_t gfp) 257 { 258 dev_coredumpm(dev, NULL, data, datalen, gfp, devcd_readv, devcd_freev); 259 } 260 EXPORT_SYMBOL_GPL(dev_coredumpv); 261 262 static int devcd_match_failing(struct device *dev, const void *failing) 263 { 264 struct devcd_entry *devcd = dev_to_devcd(dev); 265 266 return devcd->failing_dev == failing; 267 } 268 269 /** 270 * devcd_free_sgtable - free all the memory of the given scatterlist table 271 * (i.e. both pages and scatterlist instances) 272 * NOTE: if two tables allocated with devcd_alloc_sgtable and then chained 273 * using the sg_chain function then that function should be called only once 274 * on the chained table 275 * @data: pointer to sg_table to free 276 */ 277 static void devcd_free_sgtable(void *data) 278 { 279 _devcd_free_sgtable(data); 280 } 281 282 /** 283 * devcd_read_from_sgtable - copy data from sg_table to a given buffer 284 * and return the number of bytes read 285 * @buffer: the buffer to copy the data to it 286 * @buf_len: the length of the buffer 287 * @data: the scatterlist table to copy from 288 * @offset: start copy from @offset@ bytes from the head of the data 289 * in the given scatterlist 290 * @data_len: the length of the data in the sg_table 291 */ 292 static ssize_t devcd_read_from_sgtable(char *buffer, loff_t offset, 293 size_t buf_len, void *data, 294 size_t data_len) 295 { 296 struct scatterlist *table = data; 297 298 if (offset > data_len) 299 return -EINVAL; 300 301 if (offset + buf_len > data_len) 302 buf_len = data_len - offset; 303 return sg_pcopy_to_buffer(table, sg_nents(table), buffer, buf_len, 304 offset); 305 } 306 307 /** 308 * dev_coredump_put - remove device coredump 309 * @dev: the struct device for the crashed device 310 * 311 * dev_coredump_put() removes coredump, if exists, for a given device from 312 * the file system and free its associated data otherwise, does nothing. 313 * 314 * It is useful for modules that do not want to keep coredump 315 * available after its unload. 316 */ 317 void dev_coredump_put(struct device *dev) 318 { 319 struct device *existing; 320 321 existing = class_find_device(&devcd_class, NULL, dev, 322 devcd_match_failing); 323 if (existing) { 324 devcd_free(existing, NULL); 325 put_device(existing); 326 } 327 } 328 EXPORT_SYMBOL_GPL(dev_coredump_put); 329 330 /** 331 * dev_coredumpm - create device coredump with read/free methods 332 * @dev: the struct device for the crashed device 333 * @owner: the module that contains the read/free functions, use %THIS_MODULE 334 * @data: data cookie for the @read/@free functions 335 * @datalen: length of the data 336 * @gfp: allocation flags 337 * @read: function to read from the given buffer 338 * @free: function to free the given buffer 339 * 340 * Creates a new device coredump for the given device. If a previous one hasn't 341 * been read yet, the new coredump is discarded. The data lifetime is determined 342 * by the device coredump framework and when it is no longer needed the @free 343 * function will be called to free the data. 344 */ 345 void dev_coredumpm(struct device *dev, struct module *owner, 346 void *data, size_t datalen, gfp_t gfp, 347 ssize_t (*read)(char *buffer, loff_t offset, size_t count, 348 void *data, size_t datalen), 349 void (*free)(void *data)) 350 { 351 static atomic_t devcd_count = ATOMIC_INIT(0); 352 struct devcd_entry *devcd; 353 struct device *existing; 354 355 if (devcd_disabled) 356 goto free; 357 358 existing = class_find_device(&devcd_class, NULL, dev, 359 devcd_match_failing); 360 if (existing) { 361 put_device(existing); 362 goto free; 363 } 364 365 if (!try_module_get(owner)) 366 goto free; 367 368 devcd = kzalloc(sizeof(*devcd), gfp); 369 if (!devcd) 370 goto put_module; 371 372 devcd->owner = owner; 373 devcd->data = data; 374 devcd->datalen = datalen; 375 devcd->read = read; 376 devcd->free = free; 377 devcd->failing_dev = get_device(dev); 378 devcd->delete_work = false; 379 380 mutex_init(&devcd->mutex); 381 device_initialize(&devcd->devcd_dev); 382 383 dev_set_name(&devcd->devcd_dev, "devcd%d", 384 atomic_inc_return(&devcd_count)); 385 devcd->devcd_dev.class = &devcd_class; 386 387 mutex_lock(&devcd->mutex); 388 dev_set_uevent_suppress(&devcd->devcd_dev, true); 389 if (device_add(&devcd->devcd_dev)) 390 goto put_device; 391 392 /* 393 * These should normally not fail, but there is no problem 394 * continuing without the links, so just warn instead of 395 * failing. 396 */ 397 if (sysfs_create_link(&devcd->devcd_dev.kobj, &dev->kobj, 398 "failing_device") || 399 sysfs_create_link(&dev->kobj, &devcd->devcd_dev.kobj, 400 "devcoredump")) 401 dev_warn(dev, "devcoredump create_link failed\n"); 402 403 dev_set_uevent_suppress(&devcd->devcd_dev, false); 404 kobject_uevent(&devcd->devcd_dev.kobj, KOBJ_ADD); 405 INIT_DELAYED_WORK(&devcd->del_wk, devcd_del); 406 schedule_delayed_work(&devcd->del_wk, DEVCD_TIMEOUT); 407 mutex_unlock(&devcd->mutex); 408 return; 409 put_device: 410 put_device(&devcd->devcd_dev); 411 mutex_unlock(&devcd->mutex); 412 put_module: 413 module_put(owner); 414 free: 415 free(data); 416 } 417 EXPORT_SYMBOL_GPL(dev_coredumpm); 418 419 /** 420 * dev_coredumpsg - create device coredump that uses scatterlist as data 421 * parameter 422 * @dev: the struct device for the crashed device 423 * @table: the dump data 424 * @datalen: length of the data 425 * @gfp: allocation flags 426 * 427 * Creates a new device coredump for the given device. If a previous one hasn't 428 * been read yet, the new coredump is discarded. The data lifetime is determined 429 * by the device coredump framework and when it is no longer needed 430 * it will free the data. 431 */ 432 void dev_coredumpsg(struct device *dev, struct scatterlist *table, 433 size_t datalen, gfp_t gfp) 434 { 435 dev_coredumpm(dev, NULL, table, datalen, gfp, devcd_read_from_sgtable, 436 devcd_free_sgtable); 437 } 438 EXPORT_SYMBOL_GPL(dev_coredumpsg); 439 440 static int __init devcoredump_init(void) 441 { 442 return class_register(&devcd_class); 443 } 444 __initcall(devcoredump_init); 445 446 static void __exit devcoredump_exit(void) 447 { 448 class_for_each_device(&devcd_class, NULL, NULL, devcd_free); 449 class_unregister(&devcd_class); 450 } 451 __exitcall(devcoredump_exit); 452