[PATCH v2] livepatch: Fix NULL pointer dereference in klp_find_func()
Yafang Shao <[email protected]> Sun, 28 Jun 2026 19:46:35 +0800
| Newsgroups | org.kernel.vger.live-patching |
|---|---|
| Message-ID | <[email protected]> |
A NULL old_name in a newly loaded livepatch's function entry causes a
NULL pointer dereference in strcmp():
klp_init_patch()
klp_add_nops()
klp_find_func()
strcmp(old_func->old_name, func->old_name)
Add klp_check_patch() at the beginning of klp_enable_patch() to reject
patches with NULL old_name before they reach this code path.
Reported-by: sashiko-bot <[email protected]>
Closes: https://lore.kernel.org/live-patching/[email protected]/
Suggested-by: Petr Mladek <[email protected]>
Suggested-by: Miroslav Benes <[email protected]>
Signed-off-by: Yafang Shao <[email protected]>
Acked-by: Miroslav Benes <[email protected]>
---
kernel/livepatch/core.c | 34 ++++++++++++++++++++++------------
1 file changed, 22 insertions(+), 12 deletions(-)
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index 28d15ba58a26..a240d1144e89 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -799,9 +799,6 @@ void klp_free_replaced_patches_async(struct klp_patch *new_patch)
static int klp_init_func(struct klp_object *obj, struct klp_func *func)
{
- if (!func->old_name)
- return -EINVAL;
-
/*
* NOPs get the address later. The patched module must be loaded,
* see klp_init_object_loaded().
@@ -1092,6 +1089,25 @@ static int __klp_enable_patch(struct klp_patch *patch)
return ret;
}
+static int klp_check_patch(struct klp_patch *patch)
+{
+ struct klp_object *obj;
+ struct klp_func *func;
+
+ if (!patch || !patch->mod || !patch->objs)
+ return -EINVAL;
+
+ klp_for_each_object_static(patch, obj) {
+ if (!obj->funcs)
+ return -EINVAL;
+ klp_for_each_func_static(obj, func) {
+ if (!func->old_name)
+ return -EINVAL;
+ }
+ }
+ return 0;
+}
+
/**
* klp_enable_patch() - enable the livepatch
* @patch: patch to be enabled
@@ -1108,16 +1124,10 @@ static int __klp_enable_patch(struct klp_patch *patch)
int klp_enable_patch(struct klp_patch *patch)
{
int ret;
- struct klp_object *obj;
-
- if (!patch || !patch->mod || !patch->objs)
- return -EINVAL;
-
- klp_for_each_object_static(patch, obj) {
- if (!obj->funcs)
- return -EINVAL;
- }
+ ret = klp_check_patch(patch);
+ if (ret)
+ return ret;
if (!is_livepatch_module(patch->mod)) {
pr_err("module %s is not marked as a livepatch module\n",
--
2.52.0