Re: [PATCH v3 8/8] selftests/livepatch: Add RISC-V syscall wrapper prefix
From: sashiko-bot@kernel.org
Date: 2026-06-09 06:45:52
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] The module initialization function `livepatch_init()` leaks `klp_kobj` and its associated sysfs directory if `klp_enable_patch()` fails, leading to a kernel use-after-free. -- commit 35d6758515b1de6295d7ae1a97c70e768cac9dfc Author: Wang Han [off-list ref] selftests/livepatch: Add RISC-V syscall wrapper prefix The syscall livepatch selftest resolves and patches a syscall wrapper symbol. To use that test for RISC-V livepatch validation, add the RISC-V FN_PREFIX definition for ARCH_HAS_SYSCALL_WRAPPER.
quoted hunk ↗ jump to hunk
diff --git a/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c b/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c index dd802783ea849..275e4b10cf595 100644 --- a/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c +++ b/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c@@ -18,6 +18,8 @@ #define FN_PREFIX __s390x_ #elif defined(__aarch64__) #define FN_PREFIX __arm64_ +#elif defined(__riscv) +#define FN_PREFIX __riscv_ #else /* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER */ #define FN_PREFIX
[Severity: High]
This isn't a bug introduced by this patch, but does livepatch_init() leak
klp_kobj and its associated sysfs directory if klp_enable_patch() fails?
If klp_enable_patch() returns an error code, livepatch_init() returns this
error directly without calling kobject_put(klp_kobj):
tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c:livepatch_init() {
...
klp_kobj = kobject_create_and_add("test_klp_syscall", kernel_kobj);
if (!klp_kobj)
return -ENOMEM;
ret = sysfs_create_file(klp_kobj, &klp_attr.attr);
if (ret) {
kobject_put(klp_kobj);
return ret;
}
...
return klp_enable_patch(&patch);
}
Because the initialization fails, the module loader frees the module memory,
but the sysfs file /sys/kernel/test_klp_syscall/npids remains registered.
A subsequent user-space access to this sysfs file could dereference a pointer
to the now-freed module data (klp_attr) and execute a freed function pointer
(npids_show), resulting in a use-after-free.
--
Sashiko AI review · https://sashiko.dev/#/patchset/cover.194d76e3a15b.v3.riscv-livepatch.wanghan@linux.alibaba.com?part=8