Re: [PATCH v3 8/8] selftests/livepatch: Add RISC-V syscall wrapper prefix

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The module initialization function `livepatch_init()` leaks `klp_kobj` and its associated sysfs directory if `klp_enable_patch()` fails, leading to a kernel use-after-free.
--

commit 35d6758515b1de6295d7ae1a97c70e768cac9dfc
Author: Wang Han <wanghan@linux.alibaba.com>

selftests/livepatch: Add RISC-V syscall wrapper prefix

The syscall livepatch selftest resolves and patches a syscall wrapper
symbol. To use that test for RISC-V livepatch validation, add the
RISC-V FN_PREFIX definition for ARCH_HAS_SYSCALL_WRAPPER.

> diff --git a/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c b/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c
> index dd802783ea849..275e4b10cf595 100644
> --- a/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c
> +++ b/tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c
> @@ -18,6 +18,8 @@
>  #define FN_PREFIX __s390x_
>  #elif defined(__aarch64__)
>  #define FN_PREFIX __arm64_
> +#elif defined(__riscv)
> +#define FN_PREFIX __riscv_
>  #else
>  /* powerpc does not select ARCH_HAS_SYSCALL_WRAPPER */
>  #define FN_PREFIX

[Severity: High]
This isn't a bug introduced by this patch, but does livepatch_init() leak
klp_kobj and its associated sysfs directory if klp_enable_patch() fails?

If klp_enable_patch() returns an error code, livepatch_init() returns this
error directly without calling kobject_put(klp_kobj):

tools/testing/selftests/livepatch/test_modules/test_klp_syscall.c:livepatch_init() {
    ...
	klp_kobj = kobject_create_and_add("test_klp_syscall", kernel_kobj);
	if (!klp_kobj)
		return -ENOMEM;

	ret = sysfs_create_file(klp_kobj, &klp_attr.attr);
	if (ret) {
		kobject_put(klp_kobj);
		return ret;
	}
    ...
	return klp_enable_patch(&patch);
}

Because the initialization fails, the module loader frees the module memory,
but the sysfs file /sys/kernel/test_klp_syscall/npids remains registered.

A subsequent user-space access to this sysfs file could dereference a pointer
to the now-freed module data (klp_attr) and execute a freed function pointer
(npids_show), resulting in a use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.194d76e3a15b.v3.riscv-livepatch.wanghan@linux.alibaba.com?part=8