mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 03:35:32 -04:00
Code Issues Packages Projects Releases Wiki Activity

livepatch: Fix NULL pointer dereference in klp_find_func()

Browse Source 
A NULL old_name in a newly loaded livepatch's function entry causes a
NULL pointer dereference in strcmp():

  klp_init_patch()
    klp_add_nops()
      klp_find_func()
        strcmp(old_func->old_name, func->old_name)

Add klp_check_patch() at the beginning of klp_enable_patch() to reject
patches with NULL old_name before they reach this code path.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/live-patching/20260529040130.95A9C1F00893@smtp.kernel.org/
Suggested-by: Petr Mladek <pmladek@suse.com>
Suggested-by: Miroslav Benes <mbenes@suse.cz>
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Miroslav Benes <mbenes@suse.cz>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Tested-by: Petr Mladek <pmladek@suse.com>
Link: https://patch.msgid.link/20260628114635.33572-1-laoar.shao@gmail.com
Signed-off-by: Petr Mladek <pmladek@suse.com>
This commit is contained in:
Yafang Shao
2026-06-28 19:46:35 +08:00
committed by Petr Mladek
parent 0839c8963b
commit 1a38fd13c3
1 changed files with 22 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
kernel/livepatch/core.c
View File

@@ -799,9 +799,6 @@ void klp_free_replaced_patches_async(struct klp_patch *new_patch)
static int klp_init_func(struct klp_object *obj, struct klp_func *func)
{
if (!func->old_name)
return -EINVAL;
/*
* NOPs get the address later. The patched module must be loaded,
* see klp_init_object_loaded().
@@ -1092,6 +1089,25 @@ static int __klp_enable_patch(struct klp_patch *patch)
return ret;
}
static int klp_check_patch(struct klp_patch *patch)
{
struct klp_object *obj;
struct klp_func *func;
if (!patch || !patch->mod || !patch->objs)
return -EINVAL;
klp_for_each_object_static(patch, obj) {
if (!obj->funcs)
return -EINVAL;
klp_for_each_func_static(obj, func) {
if (!func->old_name)
return -EINVAL;
}
}
return 0;
}
/**
* klp_enable_patch() - enable the livepatch
* @patch: patch to be enabled
@@ -1108,16 +1124,10 @@ static int __klp_enable_patch(struct klp_patch *patch)
int klp_enable_patch(struct klp_patch *patch)
{
int ret;
struct klp_object *obj;
if (!patch || !patch->mod || !patch->objs)
return -EINVAL;
klp_for_each_object_static(patch, obj) {
if (!obj->funcs)
return -EINVAL;
}
ret = klp_check_patch(patch);
if (ret)
return ret;
if (!is_livepatch_module(patch->mod)) {
pr_err("module %s is not marked as a livepatch module\n",