Thank you for your contribution! Sashiko AI review found 1 potential issue(s) 
to consider:

Pre-existing issues:
- [High] Missing call to codetag_unload_module() in the error path leaves 
dangling module pointers in codetag_types IDR.
--

--- Patch [1]: [PATCH] module: fix lost error code from codetag_load_module() 
---
commit 5006baafc1e00091b0abb9c8d393876e887ccb31
Author: Hao Ge <[email protected]>

module: fix lost error code from codetag_load_module()

This commit fixes a bug where the error code from codetag_load_module()
was previously lost. It ensures load_module() correctly captures the error
and aborts module loading upon failure.

> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c
> @@ -3581,7 +3581,8 @@ static int load_module(struct load_info *info, const 
> char __user *uargs,
>                       goto sysfs_cleanup;
>       }
>  
> -     if (codetag_load_module(mod))
> +     err = codetag_load_module(mod);
> +     if (err)
>               goto sysfs_cleanup;

[Severity: High]
This is a pre-existing issue, but by fixing the error path here, we might
expose a use-after-free bug during module load failures.

If codetag_load_module() fails partway through the list of codetag_types:

lib/codetag.c:codetag_load_module() {
        ...
        list_for_each_entry(cttype, &codetag_types, link) {
                ret = codetag_module_init(cttype, mod);
                if (ret)
                        break;
        }
        ...
}

It returns an error without rolling back the types that were already
successfully initialized. We then jump to sysfs_cleanup, which eventually
calls module_deallocate() in the free_module block to free the module memory.

However, there is no call to codetag_unload_module() anywhere in this cleanup
path to clean up the dangling references from the codetag_types IDR.

Will this leave dangling pointers that result in a use-after-free dereference
of the freed module memory when codetags are later iterated (for example,
when reading from /proc/allocinfo)?

lib/codetag.c:codetag_next_ct() {
        ...
                        ct = get_first_module_ct(cmod);
        ...
}

>  
>       /* Get rid of temporary copy. */

-- 
Sashiko AI review ยท 
https://sashiko.dev/#/patchset/[email protected]?part=1

Reply via email to