Re: [PATCH v5 4/9] livepatch: Implement replace set for scoped atomic replace

On Sun, Aug 9, 2026 at 5:33 PM <[email protected]> wrote:
>
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] The `--provides` argument in `klp-build` lacks input validation, allowing shell command injection during the kernel module build process.
> --
>
> --- Patch [4]: [PATCH v5 4/9] livepatch: Implement replace set for scoped atomic replace ---
> commit 1fb78be5e32d18ecfd4bbeb7fa484d70bf6b9401
> Author: Yafang Shao <[email protected]>
>
> livepatch: Implement replace set for scoped atomic replace
>
> This commit introduces a more flexible model for livepatch replacement by
> adding provides and obsoletes fields, allowing multiple independent
> livepatch sets to coexist on the same system.
>
> > diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
> > index c4a7acf8edc3f..3600f93d9c1c3 100755
> > --- a/scripts/livepatch/klp-build
> > +++ b/scripts/livepatch/klp-build
>
> [ ... ]
>
> > @@ -189,9 +190,26 @@ process_args() {
> >                               NAME="$(module_name_string "$NAME")"
> >                               shift 2
> >                               ;;
> > -                     --no-replace)
> > -                             REPLACE=0
> > -                             shift
> > +                     -p | --provides)
> > +                             PROVIDES="$2"
>
> [Severity: Medium]
> Is there a missing validation check for the provides argument here?
>
> The obsoletes argument below checks for valid integers, but it appears this
> assignment accepts any unvalidated string.

Makes sense
I will update it in the next version.

-- 
Regards
Yafang