kmodloader: fix invalid read outside mapped region
[project/ubox.git] / kmodloader.c
index 07b67009aaf50f4ddd14db0b0a650234a11689ee..cad22484e97fbffb4bd267dc43243391fbc90090 100644 (file)
 #include <libgen.h>
 #include <glob.h>
 #include <elf.h>
+#include <ctype.h>
 
 #include <libubox/avl.h>
 #include <libubox/avl-cmp.h>
 #include <libubox/utils.h>
 #include <libubox/ulog.h>
+#include <libubox/kvlist.h>
+#include <libubox/list.h>
 
 #define DEF_MOD_PATH "/modules/%s/"
+#define MOD_BUILTIN "modules.builtin"
+#define MOD_BUILTIN_MODINFO "modules.builtin.modinfo"
 /* duplicated from in-kernel include/linux/module.h */
 #define MODULE_NAME_LEN (64 - sizeof(unsigned long))
 
+struct param {
+       char *name;
+       char *desc;
+       char *type;
+       struct list_head list;
+};
+
 enum {
+       BUILTIN,
        SCANNED,
        PROBE,
        LOADED,
+       BLACKLISTED,
 };
 
 struct module {
@@ -65,6 +79,7 @@ struct module_node {
 };
 
 static struct avl_tree modules;
+static KVLIST(options, kvlist_strlen);
 
 static char **module_folders = NULL;
 
@@ -108,8 +123,10 @@ static int init_module_folders(void)
                s = p + 1;
        }
 
-       if (!module_folders)
+       if (!module_folders) {
+               ULOG_ERR("no module folders for kernel version %s found\n", ver.release);
                return -1;
+       }
 
        module_folders[n] = NULL;
        return 0;
@@ -305,6 +322,7 @@ static int scan_loaded_modules(void)
 {
        size_t buf_len = 0;
        char *buf = NULL;
+       int rv = -1;
        FILE *fp;
 
        fp = fopen("/proc/modules", "r");
@@ -330,55 +348,113 @@ static int scan_loaded_modules(void)
                        /* possibly a module outside /lib/modules/<ver>/ */
                        n = alloc_module(m.name, NULL, 0, m.depends, m.size);
                }
+               if (!n) {
+                       ULOG_ERR("Failed to allocate memory for module\n");
+                       goto out;
+               }
+
                n->usage = m.usage;
                n->state = LOADED;
        }
+       rv = 0;
+out:
        free(buf);
        fclose(fp);
 
-       return 0;
+       return rv;
 }
 
-static struct module* get_module_info(const char *module, const char *name)
+static char *mmap_modinfo(const char *module, const char *name, struct stat *s, unsigned int *offset, unsigned int *size)
 {
-       int fd = open(module, O_RDONLY);
-       unsigned int offset, size;
-       char *map = MAP_FAILED, *strings, *dep = NULL;
-       const char **aliases = NULL;
-       int naliases = 0;
-       struct module *m = NULL;
-       struct stat s;
+       const bool is_builtin = (module == NULL);
+       const char *mpath = NULL;
+       char *map = MAP_FAILED;
+       char path[350], **f;
+       int fd = -1;
+
+       if (is_builtin)
+               for (f = module_folders; *f; f++) {
+                       snprintf(path, sizeof(path), "%s%s", *f, MOD_BUILTIN_MODINFO);
+                       if (!stat(path, s) && S_ISREG(s->st_mode)) {
+                               mpath = path;
+                               break;
+                       }
+               }
+       else
+               mpath = module;
+
+       if (!mpath) {
+               ULOG_ERR("cannot find modinfo path of module - %s\n", name);
+               goto out;
+       }
 
+       fd = open(mpath, O_RDONLY);
        if (fd < 0) {
-               ULOG_ERR("failed to open %s\n", module);
+               ULOG_ERR("failed to open %s\n", mpath);
                goto out;
        }
 
-       if (fstat(fd, &s) == -1) {
-               ULOG_ERR("failed to stat %s\n", module);
+       if (fstat(fd, s) == -1) {
+               ULOG_ERR("failed to stat %s\n", mpath);
                goto out;
        }
 
-       map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
+       map = mmap(NULL, s->st_size, PROT_READ, MAP_PRIVATE, fd, 0);
        if (map == MAP_FAILED) {
-               ULOG_ERR("failed to mmap %s\n", module);
+               ULOG_ERR("failed to mmap %s\n", mpath);
                goto out;
        }
 
-       if (elf_find_section(map, ".modinfo", &offset, &size)) {
-               ULOG_ERR("failed to load the .modinfo section from %s\n", module);
-               goto out;
+       if (is_builtin) {
+               *offset = 0;
+               *size = s->st_size;
+       } else if (elf_find_section(map, ".modinfo", offset, size)) {
+               ULOG_ERR("failed to load the .modinfo section from %s\n", mpath);
+               munmap(map, s->st_size);
+               map = MAP_FAILED;
        }
 
+out:
+       if (fd >= 0)
+               close(fd);
+       return map;
+}
+
+static struct module* get_module_info(const char *module, const char *name)
+{
+       const bool is_builtin = (module == NULL);
+       unsigned int offset, size;
+       char *map, *strings, *dep = NULL;
+       const char **aliases = NULL;
+       const char **aliasesr;
+       int naliases = 0;
+       struct module *m = NULL;
+       struct stat s;
+
+       map = mmap_modinfo(module, name, &s, &offset, &size);
+       if (map == MAP_FAILED)
+               goto out;
+
        strings = map + offset;
        while (true) {
+               char *end = map + offset + size;
                char *sep;
                int len;
 
-               while (!strings[0])
+               while ((strings < end) && !strings[0])
                        strings++;
-               if (strings >= map + offset + size)
+               if (strings >= end)
                        break;
+               if (is_builtin) {
+                       sep = strstr(strings, ".");
+                       if (!sep)
+                               break;
+                       if (strlen(name) == (sep - strings) &&
+                           !strncmp(strings, name, sep - strings))
+                               strings = sep + 1;
+                       else
+                               goto next_string;
+               }
                sep = strstr(strings, "=");
                if (!sep)
                        break;
@@ -387,43 +463,94 @@ static struct module* get_module_info(const char *module, const char *name)
                if (!strncmp(strings, "depends=", len + 1))
                        dep = sep;
                else if (!strncmp(strings, "alias=", len + 1)) {
-                       aliases = realloc(aliases, sizeof(sep) * (naliases + 1));
-                       if (!aliases) {
+                       aliasesr = realloc(aliases, sizeof(sep) * (naliases + 1));
+                       if (!aliasesr) {
                                ULOG_ERR("out of memory\n");
                                goto out;
                        }
 
+                       aliases = aliasesr;
                        aliases[naliases++] = sep;
                }
+next_string:
                strings = &sep[strlen(sep)];
        }
 
-       m = alloc_module(name, aliases, naliases, dep, s.st_size);
+       m = alloc_module(name, aliases, naliases, dep, is_builtin ? 0 : s.st_size);
 
        if (m)
-               m->state = SCANNED;
+               m->state = is_builtin ? BUILTIN : SCANNED;
 
 out:
        if (map != MAP_FAILED)
                munmap(map, s.st_size);
 
-       if (fd >= 0)
-               close(fd);
-
        free(aliases);
 
        return m;
 }
 
+static int scan_builtin_modules(void)
+{
+       char **p, path[350];
+       size_t buf_len = 0;
+       char *buf = NULL;
+       struct stat st;
+       FILE *fp = NULL;
+       int rv = -1;
+
+       if (!module_folders && init_module_folders())
+               return -1;
+       for (p = module_folders; *p; p++) {
+               snprintf(path, sizeof(path), "%s%s", *p, MOD_BUILTIN);
+               fp = fopen(path, "r");
+               if (!fp)
+                       continue;
+
+               if (!fstat(fileno(fp), &st) && S_ISREG(st.st_mode))
+                       break;
+
+               /* Not regular file, close it and check next */
+               fclose(fp);
+               fp = NULL;
+       }
+       if (!fp)
+               return 0;       /* OK if modules.builtin unavailable */
+
+       while (getline(&buf, &buf_len, fp) > 0) {
+               struct module *m;
+               char *name;
+
+               name = get_module_name(buf);
+               if (!name)
+                       continue;
+               m = find_module(name);
+               if (m && !strcmp(m->name, name)) {
+                       ULOG_WARN("found duplicate builtin module %s\n", name);
+                       continue;
+               }
+               m = get_module_info(NULL, name);
+               if (!m) {
+                       ULOG_ERR("failed to find info for builtin module %s\n", name);
+                       goto err;
+               }
+       }
+
+       rv = 0;
+err:
+       free(buf);
+       fclose(fp);
+
+       return rv;
+}
+
 static int scan_module_folder(const char *dir)
 {
        int gl_flags = GLOB_NOESCAPE | GLOB_MARK;
-       struct utsname ver;
        char *path;
        glob_t gl;
        int j, rv = 0;
 
-       uname(&ver);
        path = alloca(strlen(dir) + sizeof("*.ko") + 1);
        sprintf(path, "%s*.ko", dir);
 
@@ -433,15 +560,29 @@ static int scan_module_folder(const char *dir)
        for (j = 0; j < gl.gl_pathc; j++) {
                char *name = get_module_name(gl.gl_pathv[j]);
                struct module *m;
+               char *opts;
 
                if (!name)
                        continue;
 
                m = find_module(name);
+               if (m)
+                       continue;
+
+               m = get_module_info(gl.gl_pathv[j], name);
                if (!m) {
-                       if (!get_module_info(gl.gl_pathv[j], name))
-                               rv |= -1;
+                       rv |= -1;
+                       continue;
                }
+
+               opts = kvlist_get(&options, name);
+               if (!opts)
+                       continue;
+
+               if (*opts == '\x01')
+                       m->state = BLACKLISTED;
+               else
+                       m->opts = strdup(opts);
        }
 
        globfree(&gl);
@@ -463,45 +604,46 @@ static int scan_module_folders(void)
        return rv;
 }
 
-static int print_modinfo(char *module)
+static int print_modinfo(const struct module *m)
 {
-       int fd = open(module, O_RDONLY);
+       const bool is_builtin = (m->state == BUILTIN);
        unsigned int offset, size;
+       struct param *p;
        struct stat s;
-       char *map = MAP_FAILED, *strings;
+       char *map, *strings, *mpath;
        int rv = -1;
 
-       if (fd < 0) {
-               ULOG_ERR("failed to open %s\n", module);
-               goto out;
-       }
-
-       if (fstat(fd, &s) == -1) {
-               ULOG_ERR("failed to stat %s\n", module);
-               goto out;
-       }
+       LIST_HEAD(params);
 
-       map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
-       if (map == MAP_FAILED) {
-               ULOG_ERR("failed to mmap %s\n", module);
+       mpath = get_module_path(m->name);
+       map = mmap_modinfo(mpath, m->name, &s, &offset, &size);
+       if (map == MAP_FAILED)
                goto out;
-       }
-
-       if (elf_find_section(map, ".modinfo", &offset, &size)) {
-               ULOG_ERR("failed to load the .modinfo section from %s\n", module);
-               goto out;
-       }
 
        strings = map + offset;
-       printf("module:\t\t%s\n", module);
+       if (is_builtin)
+               printf("name:\t\t%s\n", m->name);
+       printf("filename:\t%s\n", is_builtin ? "(builtin)" : mpath);
        while (true) {
+               char *end = map + offset + size;
+               char *pname, *pdata;
                char *dup = NULL;
-               char *sep;
+               char *sep, *sep2;
 
-               while (!strings[0])
+               while ((strings < end) && !strings[0])
                        strings++;
-               if (strings >= map + offset + size)
+               if (strings >= end)
                        break;
+               if (is_builtin) {
+                       sep = strstr(strings, ".");
+                       if (!sep)
+                               break;
+                       if (strlen(m->name) == (sep - strings) &&
+                           !strncmp(strings, m->name, sep - strings))
+                               strings = sep + 1;
+                       else
+                               goto next_string;
+               }
                sep = strstr(strings, "=");
                if (!sep)
                        break;
@@ -512,10 +654,51 @@ static int print_modinfo(char *module)
                                printf("%s:\t\t%s\n",  dup, sep);
                        else
                                printf("%s:\t%s\n",  dup, sep);
+               } else {
+                       sep2 = strstr(sep, ":");
+                       if (!sep2) {
+                               free(dup);
+                               break;
+                       }
+
+                       pname = strndup(sep, sep2 - sep);
+                       sep2++;
+                       pdata = strdup(sep2);
+
+                       list_for_each_entry(p, &params, list)
+                               if (!strcmp(pname, p->name))
+                                       break;
+
+                       if (list_entry_is_h(p, &params, list)) {
+                               p = alloca(sizeof(*p));
+                               p->name = pname;
+                               p->desc = p->type = NULL;
+                               list_add(&p->list, &params);
+                       } else {
+                               free(pname);
+                       }
+
+                       if (!strcmp(dup, "parmtype"))
+                               p->type = pdata;
+                       else
+                               p->desc = pdata;
                }
+
+               free(dup);
+next_string:
                strings = &sep[strlen(sep)];
-               if (dup)
-                       free(dup);
+       }
+
+       list_for_each_entry(p, &params, list) {
+               printf("parm:\t\t%s",  p->name);
+               if (p->desc)
+                       printf(":%s", p->desc);
+               if (p->type)
+                       printf(" (%s)", p->type);
+               printf("\n");
+               free(p->name);
+               free(p->desc);
+               free(p->type);
        }
 
        rv = 0;
@@ -524,9 +707,6 @@ out:
        if (map != MAP_FAILED)
                munmap(map, s.st_size);
 
-       if (fd >= 0)
-               close(fd);
-
        return rv;
 }
 
@@ -561,6 +741,11 @@ static int insert_module(char *path, const char *options)
        struct stat s;
        int fd, ret = -1;
 
+       if (!path) {
+               ULOG_ERR("Path not specified\n");
+               return ret;
+       }
+
        if (stat(path, &s)) {
                ULOG_ERR("missing module %s\n", path);
                return ret;
@@ -681,6 +866,7 @@ static int print_modprobe_usage(void)
        ULOG_INFO(
                "Usage:\n"
                "\tmodprobe [-q] [-v] filename\n"
+               "\tmodprobe -a [-q] [-v] filename [filename...]\n"
        );
 
        return -1;
@@ -773,12 +959,19 @@ static int main_rmmod(int argc, char **argv)
        if (scan_loaded_modules())
                return -1;
 
+       if (scan_builtin_modules())
+               return -1;
+
        name = get_module_name(argv[1]);
        m = find_module(name);
        if (!m) {
                ULOG_ERR("module is not loaded\n");
                return -1;
        }
+       if (m->state == BUILTIN) {
+               ULOG_ERR("module is builtin\n");
+               return -1;
+       }
        ret = syscall(__NR_delete_module, m->name, 0);
 
        if (ret)
@@ -834,6 +1027,9 @@ static int main_modinfo(int argc, char **argv)
        if (scan_module_folders())
                return -1;
 
+       if (scan_builtin_modules())
+               return -1;
+
        name = get_module_name(argv[1]);
        m = find_module(name);
        if (!m) {
@@ -841,13 +1037,7 @@ static int main_modinfo(int argc, char **argv)
                return -1;
        }
 
-       name = get_module_path(m->name);
-       if (!name) {
-               ULOG_ERR("cannot find path of module - %s\n", m->name);
-               return -1;
-       }
-
-       print_modinfo(name);
+       print_modinfo(m);
 
        return 0;
 }
@@ -856,14 +1046,18 @@ static int main_modprobe(int argc, char **argv)
 {
        struct module_node *mn;
        struct module *m;
-       char *name;
-       char *mod = NULL;
+       int exit_code = 0;
+       int load_fail;
        int log_level = LOG_WARNING;
        int opt;
        bool quiet = false;
+       bool use_all = false;
 
-       while ((opt = getopt(argc, argv, "qv")) != -1 ) {
+       while ((opt = getopt(argc, argv, "aqv")) != -1 ) {
                switch (opt) {
+                       case 'a':
+                               use_all = true;
+                               break;
                        case 'q': /* shhhh! */
                                quiet = true;
                                break;
@@ -882,48 +1076,60 @@ static int main_modprobe(int argc, char **argv)
        /* after print_modprobe_usage() so it won't be filtered out */
        ulog_threshold(log_level);
 
-       mod = argv[optind];
-
        if (scan_module_folders())
                return -1;
 
        if (scan_loaded_modules())
                return -1;
 
-       name = get_module_name(mod);
-       m = find_module(name);
-       if (m && m->state == LOADED) {
-               if (!quiet)
-                       ULOG_ERR("%s is already loaded\n", name);
-               return 0;
-       } else if (!m) {
-               if (!quiet)
-                       ULOG_ERR("failed to find a module named %s\n", name);
+       if (scan_builtin_modules())
                return -1;
-       } else {
-               int fail;
 
-               m->state = PROBE;
+       do {
+               char *name;
 
-               fail = load_modprobe(true);
+               name = get_module_name(argv[optind]);
+               m = find_module(name);
 
-               if (fail) {
-                       ULOG_ERR("%d module%s could not be probed\n",
-                                fail, (fail == 1) ? ("") : ("s"));
+               if (m && m->state == BLACKLISTED) {
+                       if (!quiet)
+                               ULOG_INFO("%s is blacklisted\n", name);
+               } else if (m && m->state == LOADED) {
+                       if (!quiet)
+                               ULOG_INFO("%s is already loaded\n", name);
+               } else if (m && m->state == BUILTIN) {
+                       if (!quiet)
+                               ULOG_INFO("%s is builtin\n", name);
+               } else if (!m) {
+                       if (!quiet)
+                               ULOG_ERR("failed to find a module named %s\n", name);
+                       exit_code = -1;
+               } else {
+                       m->state = PROBE;
+               }
 
-                       avl_for_each_element(&modules, mn, avl) {
-                               if (mn->is_alias)
-                                       continue;
-                               m = mn->m;
-                               if ((m->state == PROBE) || m->error)
-                                       ULOG_ERR("- %s\n", m->name);
-                       }
+               optind++;
+       } while (use_all && optind < argc);
+
+       load_fail = load_modprobe(true);
+       if (load_fail) {
+               ULOG_ERR("%d module%s could not be probed\n",
+                        load_fail, (load_fail == 1) ? ("") : ("s"));
+
+               avl_for_each_element(&modules, mn, avl) {
+                       if (mn->is_alias)
+                               continue;
+                       m = mn->m;
+                       if ((m->state == PROBE) || m->error)
+                               ULOG_ERR("- %s\n", m->name);
                }
+
+               exit_code = -1;
        }
 
        free_modules();
 
-       return 0;
+       return exit_code;
 }
 
 static int main_loader(int argc, char **argv)
@@ -934,7 +1140,7 @@ static int main_loader(int argc, char **argv)
        struct module *m;
        glob_t gl;
        char *path;
-       int fail, j;
+       int ret = 0, fail, j;
 
        if (argc > 1)
                dir = argv[1];
@@ -949,13 +1155,13 @@ static int main_loader(int argc, char **argv)
        strcat(path, "*");
 
        if (scan_module_folders()) {
-               free (path);
-               return -1;
+               ret = -1;
+               goto free_path;
        }
 
        if (scan_loaded_modules()) {
-               free (path);
-               return -1;
+               ret = -1;
+               goto free_path;
        }
 
        ULOG_INFO("loading kernel modules from %s\n", path);
@@ -986,11 +1192,26 @@ static int main_loader(int argc, char **argv)
                                *opts++ = '\0';
 
                        m = find_module(get_module_name(mod));
-                       if (!m || (m->state == LOADED))
+                       if (!m || m->state == LOADED || m->state == BLACKLISTED)
                                continue;
 
-                       if (opts)
-                               m->opts = strdup(opts);
+                       if (opts) {
+                               if (m->opts) {
+                                       char *prev = m->opts;
+
+                                       fail = asprintf(&m->opts, "%s %s", prev, opts);
+                                       free(prev);
+                                       if (fail < 0) {
+                                               ULOG_ERR("out of memory for opts %s\n", opts);
+                                               free(mod);
+                                               fclose(fp);
+                                               ret = -1;
+                                               goto out;
+                                       }
+                               } else {
+                                       m->opts = strdup(opts);
+                               }
+                       }
                        m->state = PROBE;
                        if (basename(gl.gl_pathv[j])[0] - '0' <= 9)
                                load_modprobe(false);
@@ -1019,9 +1240,10 @@ static int main_loader(int argc, char **argv)
 
 out:
        globfree(&gl);
+free_path:
        free(path);
 
-       return 0;
+       return ret;
 }
 
 static inline char weight(char c)
@@ -1043,6 +1265,82 @@ static int avl_modcmp(const void *k1, const void *k2, void *ptr)
        return (unsigned char)weight(*s1) - (unsigned char)weight(*s2);
 }
 
+static void
+load_options(void)
+{
+       static char buf[512];
+       char *s;
+       FILE *f;
+
+       f = fopen("/etc/modules.conf", "r");
+       if (!f)
+               return;
+
+       while ((s = fgets(buf, sizeof(buf), f)) != NULL) {
+               char *c, *cmd, *mod;
+
+               while (isspace(*s))
+                       s++;
+
+               c = strchr(s, '#');
+               if (c)
+                       *c = 0;
+
+               while (isspace(*s))
+                       s++;
+
+               c = s + strlen(s);
+               while (c > s && isspace(c[-1])) {
+                       c[-1] = 0;
+                       c--;
+               }
+
+               cmd = strsep(&s, " \t");
+               if (!cmd || !*cmd)
+                       continue;
+
+               while (isspace(*s))
+                       s++;
+
+               mod = strsep(&s, " \t");
+               if (!mod || !*mod)
+                       continue;
+
+               if (!strcmp(cmd, "blacklist")) {
+                       kvlist_set(&options, mod, "\x01");
+                       continue;
+               }
+
+               if (!strcmp(cmd, "options")) {
+                       char *prev = kvlist_get(&options, mod);
+                       char *val = NULL;
+
+                       while (isspace(*s))
+                               s++;
+
+                       if (!*s)
+                               continue;
+
+                       if (prev && prev[0] == '\x01')
+                               continue;
+
+                       if (!prev) {
+                               kvlist_set(&options, mod, s);
+                               continue;
+                       }
+
+                       if (asprintf(&val, "%s %s", prev, s) < 0)
+                               continue;
+
+                       kvlist_set(&options, mod, val);
+                       free(val);
+                       continue;
+               }
+       }
+
+       fclose(f);
+}
+
 int main(int argc, char **argv)
 {
        char *exec = basename(*argv);
@@ -1060,6 +1358,8 @@ int main(int argc, char **argv)
        if (!strcmp(exec, "modinfo"))
                return main_modinfo(argc, argv);
 
+       load_options();
+
        if (!strcmp(exec, "modprobe"))
                return main_modprobe(argc, argv);