lua-lsm: fix unregister and module lifetime handling - #16
Draft
chenzongyao200127 wants to merge 6 commits into
Draft
lua-lsm: fix unregister and module lifetime handling#16chenzongyao200127 wants to merge 6 commits into
chenzongyao200127 wants to merge 6 commits into
Conversation
chenzongyao200127
force-pushed
the
lua-lsm-unregister-lifetime-fixes
branch
from
May 14, 2026 09:23
5d588fd to
3b3aa86
Compare
Collaborator
Author
|
The changes involved in this PR are kind of complex. I will add reproduction steps that clearly demonstrate the issues with the original implementation to prove its necessity. |
chenzongyao200127
force-pushed
the
lua-lsm-unregister-lifetime-fixes
branch
from
July 9, 2026 07:11
3b3aa86 to
b752d84
Compare
chenzongyao200127
marked this pull request as draft
July 9, 2026 09:51
shared[name] caches a Lua userdata that can outlive module unregister. The userdata used to hold a raw kvcache_dict pointer, while unregister freed the backing shared dict before every loaded VM was purged. If unregister left the module busy, later shared-dict access could dereference freed memory. Store a refcounted shared-dict wrapper in the userdata, tombstone shared dicts when unregister starts, and drop the module list reference only once unregister can finish. Allocate the Lua userdata slot before taking the per-userdata shared-dict reference, so allocation failures cannot leak the wrapper ref. Signed-off-by: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>
task_call_func() may run callbacks under pi_lock and, for runnable tasks, the runqueue lock. The unregister path used it to remove modules from other tasks' Lua VMs, which updates Lua tables and can run a full Lua GC. Stop doing remote task VM teardown from task_call_func(). Unregister now purges only the current task and per-cpu Lua VMs directly; other task VMs purge unloading modules lazily when they next enter Lua-LSM. Modules that still have loaded VMs remain zombie and unregister returns -EBUSY until the remaining VMs have purged them. Signed-off-by: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>
Lazy unload can drop a module's last VM-local reference after unregister() has already returned -EBUSY. In that case the module used to stay on the unloading list until another unregister() retried the final teardown. Queue a worker when lazy purge or task teardown drains nloaded to zero. The worker detaches the drained zombie under modules_mutex, waits for the modules_ss SRCU grace period, and then frees the module outside the mutex. Also skip purge attempts once nloaded is already zero and make lua_modules_free() explicitly rely on the caller's existing SRCU read-side protection. Signed-off-by: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>
Rely on workqueue serialization for async module finalization. Use SRCU callbacks for delayed module free after list removal. Rename VM-side unload helpers around dropping modules from Lua VMs. Name the loaded VM count explicitly. Signed-off-by: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>
Unregister used to return -EBUSY whenever a deactivated module still had loaded Lua VMs, even though the module's hooks no longer run and the finalize worker reclaims it asynchronously once loaded_vm_count drains to zero. Reporting an error for an operation that has, from the caller's point of view, already succeeded (the policy is stopped) is misleading and hard to script against. Return 0 in that case. The module stays on the list as ZOMBIE until the background worker frees it. Expose the module state (live/coming/going/ zombie) as a new column in /sys/kernel/security/lua/modules so the pending cleanup is observable. Signed-off-by: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>
When lua-lsm debug logging is disabled, __log_info() expands to an empty statement, so the loaded_vms locals in lvm_drop_module() and lvm_put_loaded_modules() are unused and trip -Werror=unused-variable. The lua_lsm_module_drop_from_vm() call has side effects (it decrements loaded_vm_count and may queue the finalize worker) and must stay, so annotate the locals with __maybe_unused. Signed-off-by: Zongyao Chen <ZongYao.Chen@linux.alibaba.com>
chenzongyao200127
force-pushed
the
lua-lsm-unregister-lifetime-fixes
branch
from
July 31, 2026 07:42
097f152 to
f90a7a1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lua-LSM module unregister has to coordinate several lifetimes at once: the global module list protected by modules_ss SRCU, per-VM loaded module references, shared dictionaries cached in Lua userdata, and the contexts where VM teardown is allowed to run.
This series keeps those pieces ordered so unregister no longer frees state that can still be reached from an existing Lua VM, and so lazy unload can finish modules once the last VM-local reference is gone.
The series contains these commits:
Main fixes:
Please use Rebase and merge, or another merge mode that preserves the individual commits. Please do not squash this PR, since each commit has its own kernel-style subject and message.
Validation:
Signed-off-by: Zongyao Chen ZongYao.Chen@linux.alibaba.com