Re: [PATCH v5 2/9] livepatch: Make klp_find_func() non static
From: sashiko-bot@kernel.org
Date: 2026-08-09 09:32:14
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] A malformed livepatch module with a missing `old_name` triggers a NULL pointer dereference in `klp_find_func()`. --
--- Patch [2]: [PATCH v5 2/9] livepatch: Make klp_find_func() non static ---commit c50e76ff358d6d9f27c1c156d6d6f492f2cdd3b1 Author: Yafang Shao [off-list ref] livepatch: Make klp_find_func() non static This commit makes klp_find_func() non-static to allow its use in other source files by an upcoming patch. It also renames the parameter @old_func to @func.
quoted hunk ↗ jump to hunk
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c index 28d15ba58a26d..5d05d6fcbf57c 100644 --- a/kernel/livepatch/core.c +++ b/kernel/livepatch/core.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -82,21 +82,21 @@ static bool klp_initialized(void) return !!klp_root_kobj; } -static struct klp_func *klp_find_func(struct klp_object *obj, - struct klp_func *old_func) +/* Check if @func is present in @obj. */ +struct klp_func *klp_find_func(struct klp_object *obj, struct klp_func *func) { - struct klp_func *func; + struct klp_func *obj_func; - klp_for_each_func(obj, func) { + klp_for_each_func(obj, obj_func) { /* * Besides identical old_sympos, also consider old_sympos * of 0 and 1 are identical. */ - if ((strcmp(old_func->old_name, func->old_name) == 0) && - ((old_func->old_sympos == func->old_sympos) || - (old_func->old_sympos == 0 && func->old_sympos == 1) || - (old_func->old_sympos == 1 && func->old_sympos == 0))) { - return func; + if ((strcmp(obj_func->old_name, func->old_name) == 0) &&
[Severity: High]
This is a pre-existing issue, but could this strcmp() trigger a null pointer
dereference if a malformed livepatch module has a missing old_name field?
When loading a livepatch module where patch->replace is true, if a
struct klp_func element has .new_func defined but .old_name set to null,
klp_init_patch_early() adds this unvalidated function to obj->func_list.
Subsequently, klp_add_object_nops() calls klp_find_func() on the unvalidated
new patch object before klp_init_object() performs the expected null check:
kernel/livepatch/core.c:klp_add_object_nops() {
...
func = klp_find_func(obj, old_func);
...
}
This unconditionally passes the unvalidated, null obj_func->old_name to
strcmp().
Does this allow a malformed module to bypass validation and crash the
system instead of being gracefully rejected?
+ ((obj_func->old_sympos == func->old_sympos) ||
+ (obj_func->old_sympos == 0 && func->old_sympos == 1) ||
+ (obj_func->old_sympos == 1 && func->old_sympos == 0))) {
+ return obj_func;
}
}-- Sashiko AI review · https://sashiko.dev/#/patchset/20260809091954.22930-1-laoar.shao@gmail.com?part=2