[PATCH v3 0/2] livepatch: Fix issues around CONFIG_DEBUG_KOBJECT_RELEASE

[PATCH v3 0/2] livepatch: Fix issues around CONFIG_DEBUG_KOBJECT_RELEASE

[Yafang Shao]

These fixes were found while implementing the replace set series [0].
They are independent of that series and can be applied separately.

Link: https://lore.kernel.org/live-patching/20260809091954.22930-1-laoar.shao@gmail.com [0]

Changes:
v2->v3: 
- rename the subject
- include the selftests patch
- exclude the klp-build patch
- use kobj->kref instead of introducing extra counter (Petr)

v2:
https://lore.kernel.org/live-patching/20260816090442.18128-1-laoar.shao@gmail.com/
https://lore.kernel.org/live-patching/20260818054629.69246-1-laoar.shao@gmail.com/

v1->v2:
- minor improvements and acked-by (Song)
- fix issues reported by sashiko

v1: https://lore.kernel.org/live-patching/20260813030408.9761-1-laoar.shao@gmail.com/

Yafang Shao (2):
  livepatch: Fix UAF of unregistered patch kobjects
  selftests/livepatch: filter debug messages in check_result()

 include/linux/livepatch.h                      |  4 ++++
 kernel/livepatch/core.c                        | 10 ++++++++++
 tools/testing/selftests/livepatch/functions.sh | 12 +++++++++---
 3 files changed, 23 insertions(+), 3 deletions(-)

-- 
2.52.0

[PATCH v3 1/2] livepatch: Fix UAF of unregistered patch kobjects

[Yafang Shao]

The kobjects of a livepatch are released via kobject_put().  When
CONFIG_DEBUG_KOBJECT_RELEASE is enabled, kobject_put() does not release
the kobject synchronously but schedules a delayed release with a random
delay of up to 4 seconds (see kobject_release() in lib/kobject.c).

klp_free_patch_finish() only waits for the release of the patch kobject:

  klp_free_patch_finish():
    kobject_put(&patch->kobj);
    wait_for_completion(&patch->finish);

patch->finish is completed by the patch kobject's release callback.  If
the patch kobject was never added to sysfs, or if some child kobjects
were initialized but never added to sysfs (e.g. when klp_enable_patch()
fails after klp_init_patch_early()), those un-added children do not hold
a reference on the patch kobject.  kobject_add() is what takes the parent
reference, so the patch kobject can be released first, completing
patch->finish while the child releases are still pending.

The caller then unloads the livepatch module, which destroys the static
klp_object and klp_func structures.  The delayed child release callbacks
later access this freed memory, causing a use-after-free.

Fix it by making every child kobject hold an explicit reference on its
parent from the moment the object is initialized: klp_init_object_early()
takes a reference on the patch kobject and klp_init_func_early() takes a
reference on the object kobject.  Unlike the reference taken by
kobject_add(), these references also exist for objects that are never
added to sysfs, and the release callbacks drop them unconditionally.
This guarantees the patch kobject is released only after all child
kobjects have been released, so patch->finish cannot be completed before
the static structures are safe to free.

Because kobj->parent is set only by kobject_add(), add explicit
back-pointers, obj->patch and func->obj, so the release callbacks can
find the parent.  Dynamic objects and nop functions are freed by their
release callbacks; save the parent pointer before freeing and drop the
parent reference afterwards.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260809094046.50ED31F000E9@smtp.kernel.org/
Suggested-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
---
 include/linux/livepatch.h |  4 ++++
 kernel/livepatch/core.c   | 10 ++++++++++
 2 files changed, 14 insertions(+)

diff --git a/include/linux/livepatch.h b/include/linux/livepatch.h
index ba9e3988c07c..5f74f79c22b4 100644
--- a/include/linux/livepatch.h
+++ b/include/linux/livepatch.h
@@ -33,6 +33,7 @@
  * @kobj:	kobject for sysfs resources
  * @node:	list node for klp_object func_list
  * @stack_node:	list node for klp_ops func_stack list
+ * @obj:	back pointer to the owning object
  * @old_size:	size of the old function
  * @new_size:	size of the new function
  * @nop:        temporary patch to use the original code again; dyn. allocated
@@ -72,6 +73,7 @@ struct klp_func {
 	struct kobject kobj;
 	struct list_head node;
 	struct list_head stack_node;
+	struct klp_object *obj;
 	unsigned long old_size, new_size;
 	bool nop;
 	bool patched;
@@ -86,6 +88,7 @@ struct klp_func {
  * @kobj:	kobject for sysfs resources
  * @func_list:	dynamic list of the function entries
  * @node:	list node for klp_patch obj_list
+ * @patch:	back pointer to the owning patch
  * @mod:	kernel module associated with the patched object
  *		(NULL for vmlinux)
  * @dynamic:    temporary object for nop functions; dynamically allocated
@@ -101,6 +104,7 @@ struct klp_object {
 	struct kobject kobj;
 	struct list_head func_list;
 	struct list_head node;
+	struct klp_patch *patch;
 	struct module *mod;
 	bool dynamic;
 	bool patched;
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index a240d1144e89..517fe427ff92 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -646,12 +646,15 @@ static const struct kobj_type klp_ktype_patch = {
 
 static void klp_kobj_release_object(struct kobject *kobj)
 {
+	struct klp_patch *patch;
 	struct klp_object *obj;
 
 	obj = container_of(kobj, struct klp_object, kobj);
+	patch = obj->patch;
 
 	if (obj->dynamic)
 		klp_free_object_dynamic(obj);
+	kobject_put(&patch->kobj);
 }
 
 static const struct kobj_type klp_ktype_object = {
@@ -662,12 +665,15 @@ static const struct kobj_type klp_ktype_object = {
 
 static void klp_kobj_release_func(struct kobject *kobj)
 {
+	struct klp_object *obj;
 	struct klp_func *func;
 
 	func = container_of(kobj, struct klp_func, kobj);
+	obj = func->obj;
 
 	if (func->nop)
 		klp_free_func_nop(func);
+	kobject_put(&obj->kobj);
 }
 
 static const struct kobj_type klp_ktype_func = {
@@ -943,7 +949,9 @@ static void klp_init_func_early(struct klp_object *obj,
 				struct klp_func *func)
 {
 	kobject_init(&func->kobj, &klp_ktype_func);
+	kobject_get(&obj->kobj);
 	list_add_tail(&func->node, &obj->func_list);
+	func->obj = obj;
 }
 
 static void klp_init_object_early(struct klp_patch *patch,
@@ -951,7 +959,9 @@ static void klp_init_object_early(struct klp_patch *patch,
 {
 	INIT_LIST_HEAD(&obj->func_list);
 	kobject_init(&obj->kobj, &klp_ktype_object);
+	kobject_get(&patch->kobj);
 	list_add_tail(&obj->node, &patch->obj_list);
+	obj->patch = patch;
 }
 
 static void klp_init_patch_early(struct klp_patch *patch)
-- 
2.52.0

[PATCH v3 2/2] selftests/livepatch: filter debug messages in check_result()

[Yafang Shao]

CONFIG_DEBUG_KOBJECT makes kobject_add_internal(), kobject_uevent_env(),
fill_kobj_path() and friends emit pr_debug() messages, and
CONFIG_DEBUG_KOBJECT_RELEASE makes kobject_release() emit a pr_info()
for every delayed kobject free.  All of these carry the "kobject:" prefix
via pr_fmt(), e.g.:

 # --- expected
 # +++ result
 # @@ -1,7 +1,13 @@
 #  % insmod test_modules/test_klp_livepatch.ko
 # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_add_internal: parent: 'module', set: 'module'
 # +kobject: 'holders' (000000002856f0ae): kobject_add_internal: parent: 'test_klp_livepatch', set: '<NULL>'
 # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_add_internal: parent: 'livepatch', set: '<NULL>'
 # +kobject: 'vmlinux' (000000007b8837e6): kobject_add_internal: parent: 'test_klp_livepatch', set: '<NULL>'
 #  livepatch: enabling patch 'test_klp_livepatch'
 #  livepatch: 'test_klp_livepatch': initializing patching transition
 #  livepatch: 'test_klp_livepatch': starting patching transition
 # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_uevent_env
 # +kobject: 'test_klp_livepatch' (000000009dbf565e): fill_kobj_path: path = '/module/test_klp_livepatch'
 #  livepatch: 'test_klp_livepatch': completing patching transition
 #  livepatch: 'test_klp_livepatch': patching complete
 #  % echo 0 > /sys/kernel/livepatch/test_klp_livepatch/enabled
 # @@ -9,4 +15,17 @@ livepatch: 'test_klp_livepatch': initial
 #  livepatch: 'test_klp_livepatch': starting unpatching transition
 #  livepatch: 'test_klp_livepatch': completing unpatching transition
 #  livepatch: 'test_klp_livepatch': unpatching complete
 # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_release, parent 00000000f8785d63 (delayed 2000)
 # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_cleanup, parent 00000000f8785d63
 # +kobject: 'test_klp_livepatch' (00000000dcae1113): auto cleanup kobject_del
 # +kobject: 'test_klp_livepatch' (00000000dcae1113): calling ktype release
 # +kobject: 'test_klp_livepatch': free name
 #  % rmmod test_klp_livepatch
 # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_release, parent 0000000052e5c022 (delayed 3000)
 # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_cleanup, parent 0000000052e5c022
 # +kobject: 'test_klp_livepatch' (000000009dbf565e): auto cleanup kobject_del
 # +kobject: 'test_klp_livepatch' (000000009dbf565e): auto cleanup 'remove' event
 # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_uevent_env
 # +kobject: 'test_klp_livepatch' (000000009dbf565e): fill_kobj_path: path = '/module/test_klp_livepatch'
 # +kobject: 'test_klp_livepatch' (000000009dbf565e): calling ktype release
 # +kobject: 'test_klp_livepatch': free name
 #
 # ERROR: livepatch kselftest(s) failed
 not ok 1 selftests: livepatch: test-livepatch.sh # exit=1

The livepatch test modules' kobjects are named "test_klp_*", so these
lines match the check_result() grep for "test_klp" and leak into the
result.  The extra lines no longer match the expected output, so the
selftests fail when either debug config is enabled.

Filtering out every "kobject:" line also hides real WARN()s, e.g. the
one kobject_get() emits for an object whose refcount was not
initialized.  Filtering with "dmesg --level=..." is not enough either,
since the tests enable livepatch pr_debug() through dynamic_debug/control
and expect its messages.  Read the log with "dmesg --raw" and drop only
the debug-level messages without the "livepatch:" prefix, plus the
specific delayed-release info message.

Suggested-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
---
 tools/testing/selftests/livepatch/functions.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/tools/testing/selftests/livepatch/functions.sh b/tools/testing/selftests/livepatch/functions.sh
index 30dc677b2f45..1eba371f9d4d 100644
--- a/tools/testing/selftests/livepatch/functions.sh
+++ b/tools/testing/selftests/livepatch/functions.sh
@@ -306,9 +306,9 @@ function start_test {
 	# find new kernel messages since the test started.
 	local last_dmesg_msg="livepatch kselftest timestamp: $(date --rfc-3339=ns)"
 	log "$last_dmesg_msg"
-	loop_until 'dmesg | grep -q "$last_dmesg_msg"' ||
+	loop_until 'dmesg --raw | grep -q "$last_dmesg_msg"' ||
 		die "buffer busy? can't find canary dmesg message: $last_dmesg_msg"
-	LAST_DMESG=$(dmesg | grep "$last_dmesg_msg")
+	LAST_DMESG=$(dmesg --raw | grep "$last_dmesg_msg")
 
 	echo -n "TEST: $test ... "
 	log "===== TEST: $test ====="
@@ -321,12 +321,18 @@ function check_result {
 	local result
 
 	# Test results include any new dmesg entry since LAST_DMESG, then:
+	# - exclude debug messages except with "livepatch:" prefix
 	# - include lines matching keywords
 	# - exclude lines matching keywords
 	# - filter out dmesg timestamp prefixes
-	result=$(dmesg | awk -v last_dmesg="$LAST_DMESG" 'p; $0 == last_dmesg { p=1 }' | \
+	# - exclude the delayed kobject release messages when CONFIG_DEBUG_KOBJECT_RELEASE is on
+	result=$(dmesg --raw | \
+		 awk -v last_dmesg="$LAST_DMESG" \
+		 'p { if ($0 !~ /^<7>/ || $0 ~ /livepatch:/) print; next } $0 == last_dmesg { p = 1 }' | \
 		 grep -e 'livepatch:' -e 'test_klp' | \
 		 grep -v '\(tainting\|taints\) kernel' | \
+		 grep -v 'kobject: .*parent.*(delayed' | \
+		 sed 's/^<[0-9]*>//' | \
 		 sed 's/^\[[ 0-9.]*\] //' | \
 		 sed 's/^\[[ ]*[CT][0-9]*\] //')
 
-- 
2.52.0

Re: [PATCH v3 1/2] livepatch: Fix UAF of unregistered patch kobjects

[Song Liu]

On Thu, Aug 20, 2026 at 8:17 PM Yafang Shao <laoar.shao@gmail.com> wrote:
>
> The kobjects of a livepatch are released via kobject_put().  When
> CONFIG_DEBUG_KOBJECT_RELEASE is enabled, kobject_put() does not release
> the kobject synchronously but schedules a delayed release with a random
> delay of up to 4 seconds (see kobject_release() in lib/kobject.c).

I think I have seen this issue before. Thanks for fixing it!

>
> klp_free_patch_finish() only waits for the release of the patch kobject:
>
>   klp_free_patch_finish():
>     kobject_put(&patch->kobj);
>     wait_for_completion(&patch->finish);
>
> patch->finish is completed by the patch kobject's release callback.  If
> the patch kobject was never added to sysfs, or if some child kobjects
> were initialized but never added to sysfs (e.g. when klp_enable_patch()
> fails after klp_init_patch_early()), those un-added children do not hold
> a reference on the patch kobject.  kobject_add() is what takes the parent
> reference, so the patch kobject can be released first, completing
> patch->finish while the child releases are still pending.
>
> The caller then unloads the livepatch module, which destroys the static
> klp_object and klp_func structures.  The delayed child release callbacks
> later access this freed memory, causing a use-after-free.
>
> Fix it by making every child kobject hold an explicit reference on its
> parent from the moment the object is initialized: klp_init_object_early()
> takes a reference on the patch kobject and klp_init_func_early() takes a
> reference on the object kobject.  Unlike the reference taken by
> kobject_add(), these references also exist for objects that are never
> added to sysfs, and the release callbacks drop them unconditionally.
> This guarantees the patch kobject is released only after all child
> kobjects have been released, so patch->finish cannot be completed before
> the static structures are safe to free.
>
> Because kobj->parent is set only by kobject_add(), add explicit
> back-pointers, obj->patch and func->obj, so the release callbacks can
> find the parent.  Dynamic objects and nop functions are freed by their
> release callbacks; save the parent pointer before freeing and drop the
> parent reference afterwards.
>
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/all/20260809094046.50ED31F000E9@smtp.kernel.org/
> Suggested-by: Petr Mladek <pmladek@suse.com>
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 2/2] selftests/livepatch: filter debug messages in check_result()

[Song Liu]

On Thu, Aug 20, 2026 at 8:17 PM Yafang Shao <laoar.shao@gmail.com> wrote:
>
[...]
>
> Filtering out every "kobject:" line also hides real WARN()s, e.g. the
> one kobject_get() emits for an object whose refcount was not
> initialized.  Filtering with "dmesg --level=..." is not enough either,
> since the tests enable livepatch pr_debug() through dynamic_debug/control
> and expect its messages.  Read the log with "dmesg --raw" and drop only
> the debug-level messages without the "livepatch:" prefix, plus the
> specific delayed-release info message.
>
> Suggested-by: Petr Mladek <pmladek@suse.com>
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>

Acked-by: Song Liu <song@kernel.org>

Re: [PATCH v3 1/2] livepatch: Fix UAF of unregistered patch kobjects

[Petr Mladek]

On Fri 2026-08-21 11:16:47, Yafang Shao wrote:
> The kobjects of a livepatch are released via kobject_put().  When
> CONFIG_DEBUG_KOBJECT_RELEASE is enabled, kobject_put() does not release
> the kobject synchronously but schedules a delayed release with a random
> delay of up to 4 seconds (see kobject_release() in lib/kobject.c).
> 
> klp_free_patch_finish() only waits for the release of the patch kobject:
> 
>   klp_free_patch_finish():
>     kobject_put(&patch->kobj);
>     wait_for_completion(&patch->finish);
> 
> patch->finish is completed by the patch kobject's release callback.  If
> the patch kobject was never added to sysfs, or if some child kobjects
> were initialized but never added to sysfs (e.g. when klp_enable_patch()
> fails after klp_init_patch_early()), those un-added children do not hold
> a reference on the patch kobject.  kobject_add() is what takes the parent
> reference, so the patch kobject can be released first, completing
> patch->finish while the child releases are still pending.
> 
> The caller then unloads the livepatch module, which destroys the static
> klp_object and klp_func structures.  The delayed child release callbacks
> later access this freed memory, causing a use-after-free.
> 
> Fix it by making every child kobject hold an explicit reference on its
> parent from the moment the object is initialized: klp_init_object_early()
> takes a reference on the patch kobject and klp_init_func_early() takes a
> reference on the object kobject.  Unlike the reference taken by
> kobject_add(), these references also exist for objects that are never
> added to sysfs, and the release callbacks drop them unconditionally.
> This guarantees the patch kobject is released only after all child
> kobjects have been released, so patch->finish cannot be completed before
> the static structures are safe to free.
> 
> Because kobj->parent is set only by kobject_add(), add explicit
> back-pointers, obj->patch and func->obj, so the release callbacks can
> find the parent.  Dynamic objects and nop functions are freed by their
> release callbacks; save the parent pointer before freeing and drop the
> parent reference afterwards.
> 
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/all/20260809094046.50ED31F000E9@smtp.kernel.org/
> Suggested-by: Petr Mladek <pmladek@suse.com>
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>

Looks good and selftests passed:

Reviewed-by: Petr Mladek <pmladek@suse.com>
Tested-by: Petr Mladek <pmladek@suse.com>

Best Regards,
Petr

Re: [PATCH v3 2/2] selftests/livepatch: filter debug messages in check_result()

[Petr Mladek]

On Fri 2026-08-21 11:16:48, Yafang Shao wrote:
> CONFIG_DEBUG_KOBJECT makes kobject_add_internal(), kobject_uevent_env(),
> fill_kobj_path() and friends emit pr_debug() messages, and
> CONFIG_DEBUG_KOBJECT_RELEASE makes kobject_release() emit a pr_info()
> for every delayed kobject free.  All of these carry the "kobject:" prefix
> via pr_fmt(), e.g.:
> 
>  # --- expected
>  # +++ result
>  # @@ -1,7 +1,13 @@
>  #  % insmod test_modules/test_klp_livepatch.ko
>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_add_internal: parent: 'module', set: 'module'
>  # +kobject: 'holders' (000000002856f0ae): kobject_add_internal: parent: 'test_klp_livepatch', set: '<NULL>'
>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_add_internal: parent: 'livepatch', set: '<NULL>'
>  # +kobject: 'vmlinux' (000000007b8837e6): kobject_add_internal: parent: 'test_klp_livepatch', set: '<NULL>'
>  #  livepatch: enabling patch 'test_klp_livepatch'
>  #  livepatch: 'test_klp_livepatch': initializing patching transition
>  #  livepatch: 'test_klp_livepatch': starting patching transition
>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_uevent_env
>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): fill_kobj_path: path = '/module/test_klp_livepatch'
>  #  livepatch: 'test_klp_livepatch': completing patching transition
>  #  livepatch: 'test_klp_livepatch': patching complete
>  #  % echo 0 > /sys/kernel/livepatch/test_klp_livepatch/enabled
>  # @@ -9,4 +15,17 @@ livepatch: 'test_klp_livepatch': initial
>  #  livepatch: 'test_klp_livepatch': starting unpatching transition
>  #  livepatch: 'test_klp_livepatch': completing unpatching transition
>  #  livepatch: 'test_klp_livepatch': unpatching complete
>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_release, parent 00000000f8785d63 (delayed 2000)
>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_cleanup, parent 00000000f8785d63
>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): auto cleanup kobject_del
>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): calling ktype release
>  # +kobject: 'test_klp_livepatch': free name
>  #  % rmmod test_klp_livepatch
>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_release, parent 0000000052e5c022 (delayed 3000)
>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_cleanup, parent 0000000052e5c022
>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): auto cleanup kobject_del
>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): auto cleanup 'remove' event
>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_uevent_env
>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): fill_kobj_path: path = '/module/test_klp_livepatch'
>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): calling ktype release
>  # +kobject: 'test_klp_livepatch': free name
>  #
>  # ERROR: livepatch kselftest(s) failed
>  not ok 1 selftests: livepatch: test-livepatch.sh # exit=1
> 
> The livepatch test modules' kobjects are named "test_klp_*", so these
> lines match the check_result() grep for "test_klp" and leak into the
> result.  The extra lines no longer match the expected output, so the
> selftests fail when either debug config is enabled.
> 
> Filtering out every "kobject:" line also hides real WARN()s, e.g. the
> one kobject_get() emits for an object whose refcount was not
> initialized.  Filtering with "dmesg --level=..." is not enough either,
> since the tests enable livepatch pr_debug() through dynamic_debug/control
> and expect its messages.  Read the log with "dmesg --raw" and drop only
> the debug-level messages without the "livepatch:" prefix, plus the
> specific delayed-release info message.
> 
> Suggested-by: Petr Mladek <pmladek@suse.com>
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>

I am not much familiar with awk. But the changes look good
and selftests passed so:

Reviewed-by: Petr Mladek <pmladek@suse.com>
Tested-by: Petr Mladek <pmladek@suse.com>

Best Regards,
Petr

Re: [PATCH v3 0/2] livepatch: Fix issues around CONFIG_DEBUG_KOBJECT_RELEASE

[Petr Mladek]

On Fri 2026-08-21 11:16:46, Yafang Shao wrote:
> These fixes were found while implementing the replace set series [0].
> They are independent of that series and can be applied separately.
> 
> Link: https://lore.kernel.org/live-patching/20260809091954.22930-1-laoar.shao@gmail.com [0]
> 
> Changes:
> v2->v3: 
> - rename the subject
> - include the selftests patch
> - exclude the klp-build patch
> - use kobj->kref instead of introducing extra counter (Petr)
> 
> v2:
> https://lore.kernel.org/live-patching/20260816090442.18128-1-laoar.shao@gmail.com/
> https://lore.kernel.org/live-patching/20260818054629.69246-1-laoar.shao@gmail.com/
> 
> v1->v2:
> - minor improvements and acked-by (Song)
> - fix issues reported by sashiko
> 
> v1: https://lore.kernel.org/live-patching/20260813030408.9761-1-laoar.shao@gmail.com/
> 
> Yafang Shao (2):
>   livepatch: Fix UAF of unregistered patch kobjects
>   selftests/livepatch: filter debug messages in check_result()
> 
>  include/linux/livepatch.h                      |  4 ++++
>  kernel/livepatch/core.c                        | 10 ++++++++++
>  tools/testing/selftests/livepatch/functions.sh | 12 +++++++++---
>  3 files changed, 23 insertions(+), 3 deletions(-)

The series looks ready for linux-next. I am going to wait
one week for more potential review. Then I would push it
if nobody complained in the meantime.

Best Regards,
Petr

Re: [PATCH v3 2/2] selftests/livepatch: filter debug messages in check_result()

[Joe Lawrence]

On 8/26/26 3:54 AM, Petr Mladek wrote:
> On Fri 2026-08-21 11:16:48, Yafang Shao wrote:
>> CONFIG_DEBUG_KOBJECT makes kobject_add_internal(), kobject_uevent_env(),
>> fill_kobj_path() and friends emit pr_debug() messages, and
>> CONFIG_DEBUG_KOBJECT_RELEASE makes kobject_release() emit a pr_info()
>> for every delayed kobject free.  All of these carry the "kobject:" prefix
>> via pr_fmt(), e.g.:
>>
>>  # --- expected
>>  # +++ result
>>  # @@ -1,7 +1,13 @@
>>  #  % insmod test_modules/test_klp_livepatch.ko
>>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_add_internal: parent: 'module', set: 'module'
>>  # +kobject: 'holders' (000000002856f0ae): kobject_add_internal: parent: 'test_klp_livepatch', set: '<NULL>'
>>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_add_internal: parent: 'livepatch', set: '<NULL>'
>>  # +kobject: 'vmlinux' (000000007b8837e6): kobject_add_internal: parent: 'test_klp_livepatch', set: '<NULL>'
>>  #  livepatch: enabling patch 'test_klp_livepatch'
>>  #  livepatch: 'test_klp_livepatch': initializing patching transition
>>  #  livepatch: 'test_klp_livepatch': starting patching transition
>>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_uevent_env
>>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): fill_kobj_path: path = '/module/test_klp_livepatch'
>>  #  livepatch: 'test_klp_livepatch': completing patching transition
>>  #  livepatch: 'test_klp_livepatch': patching complete
>>  #  % echo 0 > /sys/kernel/livepatch/test_klp_livepatch/enabled
>>  # @@ -9,4 +15,17 @@ livepatch: 'test_klp_livepatch': initial
>>  #  livepatch: 'test_klp_livepatch': starting unpatching transition
>>  #  livepatch: 'test_klp_livepatch': completing unpatching transition
>>  #  livepatch: 'test_klp_livepatch': unpatching complete
>>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_release, parent 00000000f8785d63 (delayed 2000)
>>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_cleanup, parent 00000000f8785d63
>>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): auto cleanup kobject_del
>>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): calling ktype release
>>  # +kobject: 'test_klp_livepatch': free name
>>  #  % rmmod test_klp_livepatch
>>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_release, parent 0000000052e5c022 (delayed 3000)
>>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_cleanup, parent 0000000052e5c022
>>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): auto cleanup kobject_del
>>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): auto cleanup 'remove' event
>>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_uevent_env
>>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): fill_kobj_path: path = '/module/test_klp_livepatch'
>>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): calling ktype release
>>  # +kobject: 'test_klp_livepatch': free name
>>  #
>>  # ERROR: livepatch kselftest(s) failed
>>  not ok 1 selftests: livepatch: test-livepatch.sh # exit=1
>>
>> The livepatch test modules' kobjects are named "test_klp_*", so these
>> lines match the check_result() grep for "test_klp" and leak into the
>> result.  The extra lines no longer match the expected output, so the
>> selftests fail when either debug config is enabled.
>>
>> Filtering out every "kobject:" line also hides real WARN()s, e.g. the
>> one kobject_get() emits for an object whose refcount was not
>> initialized.  Filtering with "dmesg --level=..." is not enough either,
>> since the tests enable livepatch pr_debug() through dynamic_debug/control
>> and expect its messages.  Read the log with "dmesg --raw" and drop only
>> the debug-level messages without the "livepatch:" prefix, plus the
>> specific delayed-release info message.
>>
>> Suggested-by: Petr Mladek <pmladek@suse.com>
>> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> 
> I am not much familiar with awk. But the changes look good
> and selftests passed so:
> 

I translate the awk as:
- read through the steam, print nothing yet,
  - when the last_dmesg line is encountered, set the p variable
- continue through the stream and if p is set,
  - print a line if its initial field is "<7>" or "livepatch:"

which LGTM.


One dmesg nit: years ago someone complained about BusyBox vs. selftests
compatibility:

https://lore.kernel.org/live-patching/20200710183745.19730-1-joe.lawrence@redhat.com/

and my google-foo tells me that its dmesg only supports -r and not
--raw.  I don't know if it's worth using the short option without
testing it, but -r would also supported by util-linux's dmesg, fwiw.

-- 
Joe

Re: [PATCH v3 2/2] selftests/livepatch: filter debug messages in check_result()

[Yafang Shao]

On Thu, Aug 27, 2026 at 4:27 AM Joe Lawrence <joe.lawrence@redhat.com> wrote:
>
> On 8/26/26 3:54 AM, Petr Mladek wrote:
> > On Fri 2026-08-21 11:16:48, Yafang Shao wrote:
> >> CONFIG_DEBUG_KOBJECT makes kobject_add_internal(), kobject_uevent_env(),
> >> fill_kobj_path() and friends emit pr_debug() messages, and
> >> CONFIG_DEBUG_KOBJECT_RELEASE makes kobject_release() emit a pr_info()
> >> for every delayed kobject free.  All of these carry the "kobject:" prefix
> >> via pr_fmt(), e.g.:
> >>
> >>  # --- expected
> >>  # +++ result
> >>  # @@ -1,7 +1,13 @@
> >>  #  % insmod test_modules/test_klp_livepatch.ko
> >>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_add_internal: parent: 'module', set: 'module'
> >>  # +kobject: 'holders' (000000002856f0ae): kobject_add_internal: parent: 'test_klp_livepatch', set: '<NULL>'
> >>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_add_internal: parent: 'livepatch', set: '<NULL>'
> >>  # +kobject: 'vmlinux' (000000007b8837e6): kobject_add_internal: parent: 'test_klp_livepatch', set: '<NULL>'
> >>  #  livepatch: enabling patch 'test_klp_livepatch'
> >>  #  livepatch: 'test_klp_livepatch': initializing patching transition
> >>  #  livepatch: 'test_klp_livepatch': starting patching transition
> >>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_uevent_env
> >>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): fill_kobj_path: path = '/module/test_klp_livepatch'
> >>  #  livepatch: 'test_klp_livepatch': completing patching transition
> >>  #  livepatch: 'test_klp_livepatch': patching complete
> >>  #  % echo 0 > /sys/kernel/livepatch/test_klp_livepatch/enabled
> >>  # @@ -9,4 +15,17 @@ livepatch: 'test_klp_livepatch': initial
> >>  #  livepatch: 'test_klp_livepatch': starting unpatching transition
> >>  #  livepatch: 'test_klp_livepatch': completing unpatching transition
> >>  #  livepatch: 'test_klp_livepatch': unpatching complete
> >>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_release, parent 00000000f8785d63 (delayed 2000)
> >>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): kobject_cleanup, parent 00000000f8785d63
> >>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): auto cleanup kobject_del
> >>  # +kobject: 'test_klp_livepatch' (00000000dcae1113): calling ktype release
> >>  # +kobject: 'test_klp_livepatch': free name
> >>  #  % rmmod test_klp_livepatch
> >>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_release, parent 0000000052e5c022 (delayed 3000)
> >>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_cleanup, parent 0000000052e5c022
> >>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): auto cleanup kobject_del
> >>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): auto cleanup 'remove' event
> >>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): kobject_uevent_env
> >>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): fill_kobj_path: path = '/module/test_klp_livepatch'
> >>  # +kobject: 'test_klp_livepatch' (000000009dbf565e): calling ktype release
> >>  # +kobject: 'test_klp_livepatch': free name
> >>  #
> >>  # ERROR: livepatch kselftest(s) failed
> >>  not ok 1 selftests: livepatch: test-livepatch.sh # exit=1
> >>
> >> The livepatch test modules' kobjects are named "test_klp_*", so these
> >> lines match the check_result() grep for "test_klp" and leak into the
> >> result.  The extra lines no longer match the expected output, so the
> >> selftests fail when either debug config is enabled.
> >>
> >> Filtering out every "kobject:" line also hides real WARN()s, e.g. the
> >> one kobject_get() emits for an object whose refcount was not
> >> initialized.  Filtering with "dmesg --level=..." is not enough either,
> >> since the tests enable livepatch pr_debug() through dynamic_debug/control
> >> and expect its messages.  Read the log with "dmesg --raw" and drop only
> >> the debug-level messages without the "livepatch:" prefix, plus the
> >> specific delayed-release info message.
> >>
> >> Suggested-by: Petr Mladek <pmladek@suse.com>
> >> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> >
> > I am not much familiar with awk. But the changes look good
> > and selftests passed so:
> >
>
> I translate the awk as:
> - read through the steam, print nothing yet,
>   - when the last_dmesg line is encountered, set the p variable
> - continue through the stream and if p is set,
>   - print a line if its initial field is "<7>" or "livepatch:"

right

>
> which LGTM.
>
>
> One dmesg nit: years ago someone complained about BusyBox vs. selftests
> compatibility:
>
> https://lore.kernel.org/live-patching/20200710183745.19730-1-joe.lawrence@redhat.com/
>
> and my google-foo tells me that its dmesg only supports -r and not
> --raw.  I don't know if it's worth using the short option without
> testing it, but -r would also supported by util-linux's dmesg, fwiw.

makes sense.
I will update it with -r.

--
Regards
Yafang