Thread (21 messages) flat view 21 messages, 5 authors, 6h ago

Re: [PATCH v9 4/9] livepatch: Call klp_init_patch_early() earlier

From: sashiko-bot@kernel.org
Date: 2026-09-13 02:55:06

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free on statically allocated kobjects when CONFIG_DEBUG_KOBJECT_RELEASE is enabled
--

commit 482a331678a5995d891ae6ebde80245198dd0aba
Author: Yafang Shao [off-list ref]

livepatch: Call klp_init_patch_early() earlier

Invoke klp_init_patch_early() during early initialization to avoid
mixing for_each_() and for_each_*_static() variants later in the code.
quoted hunk ↗ jump to hunk
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index c34306ecfb0bb..f088955de8557 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -1159,6 +1152,13 @@ int klp_enable_patch(struct klp_patch *patch)
 
 	klp_init_patch_early(patch);
 
+	if (!klp_is_patch_compatible(patch)) {
+		pr_err("Livepatch patch (%s) is not compatible with the already installed livepatches.\n",
+			patch->mod->name);
+		ret = -EINVAL;
+		goto err;
[Severity: High]
This is a pre-existing issue, but could jumping to the error path here
cause a use-after-free when CONFIG_DEBUG_KOBJECT_RELEASE is enabled?

If klp_enable_patch() fails here due to patch incompatibility, the error
path calls klp_free_patch_start(), which eventually invokes kobject_put()
on the statically allocated obj and func structures:

kernel/livepatch/core.c:__klp_free_objects() {
    ...
    kobject_put(&obj->kobj);
    ...
}

When CONFIG_DEBUG_KOBJECT_RELEASE is enabled, kobject_put() schedules
delayed release works for these kobjects, which are embedded within the
livepatch module's memory.

Since klp_enable_patch() only waits for the patch kobject's completion and
ignores the obj and func kobjects, module_init() returns an error. This
leads the kernel to unload the module and free its memory while the delayed
release works are still pending.

Is there a way to ensure the module memory isn't freed before these
delayed works complete?
+	}
+
 	ret = klp_init_patch(patch);
 	if (ret)
 		goto err;
-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913024228.72317-1-laoar.shao@gmail.com?part=4
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help