Re: [RFC] livepatch: Add integration tests for klp-build toolchain

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] livepatch: use-after-free in klp_test_module_init() via dangling klp_test_kobj pointer
- [Medium] livepatch: memory leak of klp_test_module_kobj on sysfs_create_group() failure
--

commit 440c68ecb776cce99d846849a24bfeacf1e70de3
Author: Song Liu <song@kernel.org>
Subject: livepatch: Add integration tests for klp-build toolchain

This commit adds integration tests for the klp-build toolchain, including
kernel side dummy code built into vmlinux and as a loadable module. It
provides sysfs interfaces to verify livepatches and exercises ThinLTO
suffix handling.

Link: https://lore.kernel.org/live-patching/20260226005436.379303-9-song@kernel.org/

[Severity: Medium]
In lib/livepatch/klp_test_module.c, inside klp_test_module_init() at line
95, the code returns the result of sysfs_create_group() directly. If this
function fails, does it bypass the cleanup for the recently created
klp_test_module_kobj? Should there be a call to
kobject_put(klp_test_module_kobj) on this error path to prevent a memory
leak?

[Severity: High]
In lib/livepatch/klp_test_vmlinux.c, inside klp_test_vmlinux_init() at
lines 105 and 126, there are error paths where klp_test_kobj is freed via
kobject_put(klp_test_kobj). However, the globally exported pointer
klp_test_kobj is not reset to NULL.

Since klp_test_vmlinux_init() is a late_initcall, an error here does not
halt the system boot. Later, when the klp_test_module is loaded,
klp_test_module_init() in lib/livepatch/klp_test_module.c at line 90
attempts to pass this dangling klp_test_kobj pointer to
kobject_create_and_add() as the parent.

Could this sequence trigger a use-after-free when the kobject core attempts
to access the freed parent's refcount? Should klp_test_kobj be explicitly
set to NULL on the error paths in klp_test_vmlinux_init(), and should
klp_test_module_init() check if klp_test_kobj is valid before using it?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261003220433.1539629-1-song@kernel.org?part=1