Thread (49 messages) 49 messages, 9 authors, 21d ago

Re: [PATCH v3 8/8] selftests/livepatch: Add RISC-V syscall wrapper prefix

From: sashiko-bot@kernel.org
Date: 2026-06-09 06:45:52

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The module initialization function `livepatch_init()` leaks `klp_kobj` and its associated sysfs directory if `klp_enable_patch()` fails, leading to a kernel use-after-free.
--

commit 35d6758515b1de6295d7ae1a97c70e768cac9dfc
Author: Wang Han [off-list ref]

selftests/livepatch: Add RISC-V syscall wrapper prefix

The syscall livepatch selftest resolves and patches a syscall wrapper
symbol. To use that test for RISC-V livepatch validation, add the
RISC-V FN_PREFIX definition for ARCH_HAS_SYSCALL_WRAPPER.
quoted hunk ↗ jump to hunk
diff --git a/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c b/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c
index dd802783ea849..275e4b10cf595 100644
--- a/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c
+++ b/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c
@@ -18,6 +18,8 @@
 #define FN_PREFIX __s390x_
 #elif defined(__aarch64__)
 #define FN_PREFIX __arm64_
+#elif defined(__riscv)
+#define FN_PREFIX __riscv_
 #else
 /* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER */
 #define FN_PREFIX
[Severity: High]
This isn't a bug introduced by this patch, but does livepatch_init() leak
klp_kobj and its associated sysfs directory if klp_enable_patch() fails?

If klp_enable_patch() returns an error code, livepatch_init() returns this
error directly without calling kobject_put(klp_kobj):

tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c:livepatch_init() {
    ...
	klp_kobj = kobject_create_and_add("test_klp_syscall", kernel_kobj);
	if (!klp_kobj)
		return -ENOMEM;

	ret = sysfs_create_file(klp_kobj, &klp_attr.attr);
	if (ret) {
		kobject_put(klp_kobj);
		return ret;
	}
    ...
	return klp_enable_patch(&patch);
}

Because the initialization fails, the module loader frees the module memory,
but the sysfs file /sys/kernel/test_klp_syscall/npids remains registered.

A subsequent user-space access to this sysfs file could dereference a pointer
to the now-freed module data (klp_attr) and execute a freed function pointer
(npids_show), resulting in a use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.194d76e3a15b.v3.riscv-livepatch.wanghan@linux.alibaba.com?part=8
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help