Re: [PATCH 02/14] objtool/klp: Normalize Module.symvers paths to module names

On Mon, Aug 03, 2026 at 03:37:11AM +0000, [email protected] wrote:
> [Severity: Medium]
> Does this assignment leak the original pointer returned by strdup()?
> 
> Looking at read_exports(), export->mod is allocated via strdup() right
> before this check:
> 
>         export->mod = strdup(mod);
>         if (!export->mod) {
>                 ERROR_GLIBC("strdup");
>                 return -1;
>         }
> 
>         if (strcmp(export->mod, "vmlinux"))
>                 export->mod = normalize_modname(export->mod);
> 
> When processing module paths with a slash, normalize_modname() returns
> an interior pointer (slash + 1).
> 
> If this offset pointer overwrites export->mod, the original base
> address from strdup() is permanently lost. 
> 
> While objtool often relies on process termination for cleanup, if these
> strings are ever freed later, passing an interior pointer to free() will
> cause an invalid free crash.
> 
> Could this be avoided by shifting the string contents in-place with
> memmove() instead?

Perhaps, but these are small memory leaks and klp diff frees all its
memory when it exits so I'm not sure we care.

-- 
Josh