Re: [PATCH v12 4/9] livepatch: Call klp_init_patch_early() earlier

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] livepatch: UAF on module unload if klp_is_patch_compatible() fails with DEBUG_KOBJECT_RELEASE
--

commit bd925cd8bf4694e6331eda23e1ebe254ec598efe
Author: Yafang Shao <laoar.shao@gmail.com>

livepatch: Call klp_init_patch_early() earlier

Invoke klp_init_patch_early() during early initialization to avoid mixing
for_each_() and for_each_*_static() variants later in the code. This prepares
the code for an upcoming patch.

> diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
> index c34306ecfb0bb..f088955de8557 100644
> --- a/kernel/livepatch/core.c
> +++ b/kernel/livepatch/core.c
> @@ -1145,13 +1145,6 @@ int klp_enable_patch(struct klp_patch *patch)
>  
>  	mutex_lock(&klp_mutex);
>  
> -	if (!klp_is_patch_compatible(patch)) {
> -		pr_err("Livepatch patch (%s) is not compatible with the already installed livepatches.\n",
> -			patch->mod->name);
> -		mutex_unlock(&klp_mutex);
> -		return -EINVAL;
> -	}
> -
>  	if (!try_module_get(patch->mod)) {
>  		mutex_unlock(&klp_mutex);
>  		return -ENODEV;
> @@ -1159,6 +1152,13 @@ int klp_enable_patch(struct klp_patch *patch)
>  
>  	klp_init_patch_early(patch);
>  
> +	if (!klp_is_patch_compatible(patch)) {
> +		pr_err("Livepatch patch (%s) is not compatible with the already installed livepatches.\n",
> +			patch->mod->name);
> +		ret = -EINVAL;
> +		goto err;

[Severity: Medium]
Can this sequence lead to a use-after-free regression during module unload if
CONFIG_DEBUG_KOBJECT_RELEASE is enabled?

If klp_is_patch_compatible() fails, we jump to err. This triggers kobject
teardown for objects that were initialized but never linked to a parent:

err:
    klp_free_patch_start(patch);
    ...
    klp_free_patch_finish(patch);

Because the child kobjects lack a parent linkage at this early stage, waiting
on patch->finish completes without waiting for the child kobjects to be fully
released.

If CONFIG_DEBUG_KOBJECT_RELEASE is enabled, the release is delayed. The
function returns and the livepatch module is unloaded, freeing its static
memory. Later, the delayed release work executes:

kernel/livepatch/core.c:klp_kobj_release_object()
    obj = container_of(kobj, struct klp_object, kobj);
    if (obj->dynamic)

Accessing obj->dynamic here would cause a use-after-free on the freed module
memory.

Should we ensure all child kobjects are fully released before returning, or
handle the initialization state differently?

> +	}
> +
>  	ret = klp_init_patch(patch);
>  	if (ret)
>  		goto err;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016053708.47089-1-laoar.shao@gmail.com?part=4