[PATCH] livepatch: Fix NULL pointer dereference in klp_find_func()

[PATCH] livepatch: Fix NULL pointer dereference in klp_find_func()

[Yafang Shao]

A NULL old_name in a newly loaded livepatch's function entry causes a
NULL pointer dereference in strcmp():

  klp_init_patch()
    klp_add_nops()
      klp_find_func()
        strcmp(old_func->old_name, func->old_name)

Add a sanity check at the beginning of klp_enable_patch() to reject
patches with NULL old_name before they reach this code path.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/live-patching/20260529040130.95A9C1F00893@smtp.kernel.org/
Suggested-by: Petr Mladek <pmladek@suse.com>
Suggested-by: Miroslav Benes <mbenes@suse.cz>
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
---
 kernel/livepatch/core.c | 34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index 28d15ba58a26..a240d1144e89 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -799,9 +799,6 @@ void klp_free_replaced_patches_async(struct klp_patch *new_patch)
 
 static int klp_init_func(struct klp_object *obj, struct klp_func *func)
 {
-	if (!func->old_name)
-		return -EINVAL;
-
 	/*
 	 * NOPs get the address later. The patched module must be loaded,
 	 * see klp_init_object_loaded().
@@ -1092,6 +1089,25 @@ static int __klp_enable_patch(struct klp_patch *patch)
 	return ret;
 }
 
+static int klp_check_patch(struct klp_patch *patch)
+{
+	struct klp_object *obj;
+	struct klp_func *func;
+
+	if (!patch || !patch->mod || !patch->objs)
+		return -EINVAL;
+
+	klp_for_each_object_static(patch, obj) {
+		if (!obj->funcs)
+			return -EINVAL;
+		klp_for_each_func_static(obj, func) {
+			if (!func->old_name)
+				return -EINVAL;
+		}
+	}
+	return 0;
+}
+
 /**
  * klp_enable_patch() - enable the livepatch
  * @patch:	patch to be enabled
@@ -1108,16 +1124,10 @@ static int __klp_enable_patch(struct klp_patch *patch)
 int klp_enable_patch(struct klp_patch *patch)
 {
 	int ret;
-	struct klp_object *obj;
-
-	if (!patch || !patch->mod || !patch->objs)
-		return -EINVAL;
-
-	klp_for_each_object_static(patch, obj) {
-		if (!obj->funcs)
-			return -EINVAL;
-	}
 
+	ret = klp_check_patch(patch);
+	if (ret)
+		return ret;
 
 	if (!is_livepatch_module(patch->mod)) {
 		pr_err("module %s is not marked as a livepatch module\n",
-- 
2.52.0

Re: [PATCH] livepatch: Fix NULL pointer dereference in klp_find_func()

[Miroslav Benes]

On Tue, 23 Jun 2026, Yafang Shao wrote:

> A NULL old_name in a newly loaded livepatch's function entry causes a
> NULL pointer dereference in strcmp():
> 
>   klp_init_patch()
>     klp_add_nops()
>       klp_find_func()
>         strcmp(old_func->old_name, func->old_name)
> 
> Add a sanity check at the beginning of klp_enable_patch() to reject
> patches with NULL old_name before they reach this code path.

The changelog could also mention the introduction of klp_check_patch().

Acked-by: Miroslav Benes <mbenes@suse.cz>

M

[PATCH v2] livepatch: Fix NULL pointer dereference in klp_find_func()

[Yafang Shao]

A NULL old_name in a newly loaded livepatch's function entry causes a
NULL pointer dereference in strcmp():

  klp_init_patch()
    klp_add_nops()
      klp_find_func()
        strcmp(old_func->old_name, func->old_name)

Add klp_check_patch() at the beginning of klp_enable_patch() to reject
patches with NULL old_name before they reach this code path.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/live-patching/20260529040130.95A9C1F00893@smtp.kernel.org/
Suggested-by: Petr Mladek <pmladek@suse.com>
Suggested-by: Miroslav Benes <mbenes@suse.cz>
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Miroslav Benes <mbenes@suse.cz>
---
 kernel/livepatch/core.c | 34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index 28d15ba58a26..a240d1144e89 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -799,9 +799,6 @@ void klp_free_replaced_patches_async(struct klp_patch *new_patch)
 
 static int klp_init_func(struct klp_object *obj, struct klp_func *func)
 {
-	if (!func->old_name)
-		return -EINVAL;
-
 	/*
 	 * NOPs get the address later. The patched module must be loaded,
 	 * see klp_init_object_loaded().
@@ -1092,6 +1089,25 @@ static int __klp_enable_patch(struct klp_patch *patch)
 	return ret;
 }
 
+static int klp_check_patch(struct klp_patch *patch)
+{
+	struct klp_object *obj;
+	struct klp_func *func;
+
+	if (!patch || !patch->mod || !patch->objs)
+		return -EINVAL;
+
+	klp_for_each_object_static(patch, obj) {
+		if (!obj->funcs)
+			return -EINVAL;
+		klp_for_each_func_static(obj, func) {
+			if (!func->old_name)
+				return -EINVAL;
+		}
+	}
+	return 0;
+}
+
 /**
  * klp_enable_patch() - enable the livepatch
  * @patch:	patch to be enabled
@@ -1108,16 +1124,10 @@ static int __klp_enable_patch(struct klp_patch *patch)
 int klp_enable_patch(struct klp_patch *patch)
 {
 	int ret;
-	struct klp_object *obj;
-
-	if (!patch || !patch->mod || !patch->objs)
-		return -EINVAL;
-
-	klp_for_each_object_static(patch, obj) {
-		if (!obj->funcs)
-			return -EINVAL;
-	}
 
+	ret = klp_check_patch(patch);
+	if (ret)
+		return ret;
 
 	if (!is_livepatch_module(patch->mod)) {
 		pr_err("module %s is not marked as a livepatch module\n",
-- 
2.52.0

Re: [PATCH v2] livepatch: Fix NULL pointer dereference in klp_find_func()

[Petr Mladek]

On Sun 2026-06-28 19:46:35, Yafang Shao wrote:
> A NULL old_name in a newly loaded livepatch's function entry causes a
> NULL pointer dereference in strcmp():
> 
>   klp_init_patch()
>     klp_add_nops()
>       klp_find_func()
>         strcmp(old_func->old_name, func->old_name)
> 
> Add klp_check_patch() at the beginning of klp_enable_patch() to reject
> patches with NULL old_name before they reach this code path.
> 
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/live-patching/20260529040130.95A9C1F00893@smtp.kernel.org/
> Suggested-by: Petr Mladek <pmladek@suse.com>
> Suggested-by: Miroslav Benes <mbenes@suse.cz>
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> Acked-by: Miroslav Benes <mbenes@suse.cz>

Looks good to me:

Reviewed-by: Petr Mladek <pmladek@suse.com>
Tested-by: Petr Mladek <pmladek@suse.com>

I think whether to rush this into 7.2-rcX or wait for 7.3.
On one hand, it is a possible security fix. On the other hand,
broken module could never get loaded and pass even a minimal QA.

I tend to push it for 7.2-rcX just to avoid questions from people
who ignore the real life vulnerabilty aspect.

Also see a nit below.

> --- a/kernel/livepatch/core.c
> +++ b/kernel/livepatch/core.c
> @@ -1092,6 +1089,25 @@ static int __klp_enable_patch(struct klp_patch *patch)
>  	return ret;
>  }
>  
> +static int klp_check_patch(struct klp_patch *patch)
> +{
> +	struct klp_object *obj;
> +	struct klp_func *func;
> +
> +	if (!patch || !patch->mod || !patch->objs)
> +		return -EINVAL;
> +
> +	klp_for_each_object_static(patch, obj) {
> +		if (!obj->funcs)
> +			return -EINVAL;

Nit: I would add an empty line here to make it better readable.
     Of course, this is a personal preference. But it seems that
     most contributors to this code prefer visual separators
     between misc code sections as well.

     No need for v3. I could add the empty line when pushing
     the change.

> +		klp_for_each_func_static(obj, func) {
> +			if (!func->old_name)
> +				return -EINVAL;
> +		}
> +	}
> +	return 0;
> +}
> +
>  /**
>   * klp_enable_patch() - enable the livepatch
>   * @patch:	patch to be enabled

Best Regards,
Petr