On Wed, Sep 23, 2026 at 4:53 PM <[email protected]> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s)
> to consider:
> - [Medium] dyndbg: race during module load bypasses ABI protection permanently
> --
>
> commit c8a052c030fff7b63aa2d9e4c2dc3aa455948704
> Author: Jim Cromie <[email protected]>
>
> dyndbg: resolve "protection" of class'd pr_debug
>
> This patch implements an ABI protection mechanism for dynamically debugged
> classes by binding a controlling sysfs parameter to classmaps. If a module
> parameter is configured, it protects class'd callsites from being
> accidentally modified by un-classed wildcard queries.
>
> > diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
> > index 636a88994a774..d300d44c1a82e 100644
> > --- a/lib/dynamic_debug.c
> > +++ b/lib/dynamic_debug.c
>
> [ ... ]
>
> > @@ -252,7 +294,28 @@ static bool ddebug_match_desc(const struct
> > ddebug_query *query,
> > dp->lineno > query->last_lineno)
> > return false;
> >
> > - return true;
> > + /*
> > + * above are all satisfied, so we can make final decisions:
> > + * 1- class FOO or implied class __DEFAULT__
> > + * 2- site.is_classed or not
> > + */
> > + if (query->class_string) {
> > + /* class FOO given, exact match required */
> > + return (dp->class_id == selected_class);
> > + }
> > + /* query class __DEFAULT__ by omission. */
> > + if (dp->class_id == _DPRINTK_CLASS_DFLT) {
> > + /* un-classed site */
> > + return true;
> > + }
> > + /* site is class'd */
> > + site_map = ddebug_find_map_by_class_id(di, dp->class_id);
> > + if (!site_map) {
> > + WARN_ONCE(1, "unknown class_id %d, check %s's CLASSMAP
> > definitions", dp->class_id, di->mod_name);
> > + return false;
> > + }
> > + /* module(-param) decides protection */
> > + return !ddebug_class_wants_protection(site_map);
> > }
>
> [Severity: Medium]
> Does this code expose a race condition when a module is loading?
>
> Looking at ddebug_add_module(), the module is added to ddebug_tables and the
> ddebug_lock is dropped before map->controlling_param is initialized:
>
> lib/dynamic_debug.c:ddebug_add_module() {
> ...
> mutex_lock(&ddebug_lock);
> list_add_tail(&dt->link, &ddebug_tables);
> mutex_unlock(&ddebug_lock);
>
> if (dt->info.maps.len)
> ddebug_apply_class_maps(&dt->info);
> ...
> }
>
> If a concurrent wildcard query (like echo -p > /proc/dynamic_debug/control)
> is processed while the lock is dropped but before ddebug_apply_class_maps()
> finishes binding the parameter, site_map->controlling_param will be NULL.
>
> This causes ddebug_class_wants_protection() to return false, bypassing the
> protection and erroneously enabling the callsites.
>
yes, theres a narrow window where a module w classd pr-debugs
is changeable with "+p" flags, before the controlling-param is set up.
Once the protection is in place, "-p" will not be able to undo the "+p".
Only toggling the param itself will undo those "+p"s
v12 addresses this by setting the controlling-param before the module
is added to the ddebug-tables list, and not in the class-map-attach
> [ ... ]
>
> > @@ -772,11 +833,14 @@ static int param_set_dyndbg_module_classes(const char
> > *instr,
> > const struct kernel_param *kp,
> > const char *mod_name)
> > {
> > - const struct ddebug_class_param *dcp = kp->arg;
> > - const struct ddebug_class_map *map = dcp->map;
> > + struct ddebug_class_param *dcp = kp->arg;
> > + struct ddebug_class_map *map = dcp->map;
> > u32 inrep, new_bits, old_bits, old_val;
> > int rc, totct = 0;
> >
> > + if (map && !map->controlling_param)
> > + map->controlling_param = dcp;
>
> [Severity: Medium]
> Is it safe to assign map->controlling_param here without holding
> ddebug_lock or using WRITE_ONCE()?
>
> Since this shared state is accessed by concurrent queries, could this
> cause a data race?
>
> [ ... ]
>
> > @@ -1332,25 +1395,40 @@ static void ddebug_sync_classbits(const struct
> > kernel_param *kp, const char *mod
> > }
> > }
> >
> > -static void ddebug_match_apply_kparam(const struct kernel_param *kp,
> > - const struct ddebug_class_map *map,
> > - const char *mod_name)
> > +static struct ddebug_class_param *
> > +ddebug_get_classmap_kparam(const struct kernel_param *kp,
> > + const struct ddebug_class_map *map)
> > +{
> > + struct ddebug_class_param *dcp;
> > +
> > + if (kp->ops != ¶m_ops_dyndbg_classes)
> > + return NULL;
> > +
> > + dcp = (struct ddebug_class_param *)kp->arg;
> > + return (map == dcp->map)
> > + ? dcp : (struct ddebug_class_param *)NULL;
> > +}
> > +
> > +static void ddebug_match_apply_kparam(const struct kernel_param *kp,
> > + struct ddebug_class_map *map,
> > + const char *mod_name)
> > {
> > + struct ddebug_class_param *dcp = ddebug_get_classmap_kparam(kp, map);
> >
> > if (dcp && dcp->map == map) {
> > + /*
> > + * Bind controlling_param to activate ABI protection in
> > + * ddebug_match_desc(), shielding callsites from non-class
> > + * wildcard (>control) queries.
> > + */
> > + map->controlling_param = dcp;
> > v2pr_info(" kp:%s.%s =0x%x", mod_name, kp->name, *dcp->bits);
> > vpr_cm_info(map, " %s maps ", mod_name);
> > ddebug_sync_classbits(kp, mod_name);
> > }
> > }
>
> [Severity: Medium]
> Can the delayed assignment of map->controlling_param combined with
> ddebug_sync_classbits() result in permanent desynchronization?
>
> During the race window in ddebug_add_module() mentioned above, callsites
> can be erroneously enabled by a concurrent query. Once the module loading
> thread resumes, it binds map->controlling_param here and calls
> ddebug_sync_classbits().
>
> However, ddebug_sync_classbits() passes 0 for old_bits:
>
> lib/dynamic_debug.c:ddebug_sync_classbits() {
> ...
> case DD_CLASS_TYPE_DISJOINT_BITS:
> val = READ_ONCE(*dcp->bits);
> new_bits = val;
> v2pr_info(" %s: classbits: 0x%x\n", KP_NAME(kp), new_bits);
> ddebug_apply_class_bitmap(dcp, &new_bits, 0, modname);
> ...
> }
>
> Because old_bits is 0, the function skips resetting any class bits that are
> supposed to be off (since it sees new_bits (0) == old_bits (0)). Doesn't this
> prevent the synchronizer from noticing and clearing the erroneously enabled
> callsites?
>
> --
> Sashiko AI review ·
> https://sashiko.dev/#/patchset/[email protected]?part=32
