linux-stable.git/kernel/module, branch v7.2.4

module/kallsyms: fix nextval for data symbol lookup

2026-09-07T15:36:59+00:00

commit 0e9f090a4e9bfae5a190ccf89eab3bf14f6b0f96 upstream.

The symbol lookup code assumes the queried address resides in either
MOD_TEXT or MOD_INIT_TEXT. This breaks for addresses in other module
memory regions (e.g. rodata or data), resulting in incorrect upper
bounds and wrong symbol size.

Select the module memory region the address belongs to instead of
hardcoding text sections. Also initialize the lower bound to the start
of that region, as searching from address 0 is unnecessary.

Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka 
Reviewed-by: Petr Pavlu 
Signed-off-by: Petr Pavlu 
Signed-off-by: Greg Kroah-Hartman

module: validate string table section types

2026-09-07T15:36:59+00:00

commit 9a5ff45689329835f874cefe5174e577d141d423 upstream.

In elf_validity_cache_sechdrs, section sizes and offsets are validated,
unless the section type is SHT_NULL or SHT_NOBITS.

Later, elf_validity_cache_secstrings and elf_validity_cache_index_str
access the section name table (.shstrtab) and symbol string table
(.strtab) headers without first ensuring that their types are
SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has
not been validated and may reference out-of-bounds memory when
dereferenced in elf_validity_cache_secstrings or
elf_validity_cache_strtab.

Validate that both string section headers are of type SHT_STRTAB before
caching them.

Cc: stable@vger.kernel.org
Signed-off-by: Thiébaud Weksteen 
Reviewed-by: Aaron Tomlin 
Reviewed-by: Petr Pavlu 
Signed-off-by: Petr Pavlu 
Signed-off-by: Greg Kroah-Hartman

module: decompress: check return value of module_extend_max_pages()

2026-06-04T16:37:32+00:00

module_extend_max_pages() calls kvrealloc() internally and returns
-ENOMEM on allocation failure. The return value is never checked.

If the initial allocation fails, info->pages remains NULL and
info->max_pages remains 0. Subsequent calls to module_get_next_page()
will attempt to dynamically grow the array by calling
module_extend_max_pages(info, 0) since info->used_pages is 0. This
results in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated
as a success, leading to a dereference of ZERO_SIZE_PTR and a kernel
oops.

Fix: add the missing error check after module_extend_max_pages() and
return immediately on failure. This matches the pattern used by every
other kvrealloc() caller in the module loading path.

Fixes: b1ae6dc41eaa ("module: add in-kernel support for decompressing")
Cc: Dmitry Torokhov 
Cc: Luis Chamberlain 
Cc: stable@vger.kernel.org
Signed-off-by: Andrii Kuchmenko 
Reviewed-by: Christophe Leroy (CS GROUP) 
[Sami: Corrected the analysis in the commit message.]
Signed-off-by: Sami Tolvanen

module: Simplify warning on positive returns from module_init()

2026-04-04T00:04:48+00:00

It should now be rare to trigger this warning - it doesn't need to be so
verbose. Make it follow the usual style in the module loading code.

For the same reason, drop the dump_stack().

Suggested-by: Petr Pavlu 
Signed-off-by: Lucas De Marchi 
Reviewed-by: Aaron Tomlin 
Reviewed-by: Petr Pavlu 
Reviewed-by: Daniel Gomez 
Signed-off-by: Sami Tolvanen

module: Override -EEXIST module return

2026-04-04T00:04:42+00:00

The -EEXIST errno is reserved by the module loading functionality. When
userspace calls [f]init_module(), it expects a -EEXIST to mean that the
module is already loaded in the kernel. If module_init() returns it,
that is not true anymore.

Override the error when returning to userspace: it doesn't make sense to
change potentially long error propagation call chains just because it's
will end up as the return of module_init().

Closes: https://lore.kernel.org/all/aKLzsAX14ybEjHfJ@orbyte.nwl.cc/
Cc: Greg Kroah-Hartman 
Cc: Aaron Tomlin 
Cc: Petr Pavlu 
Cc: Daniel Gomez 
Cc: Phil Sutter 
Cc: Christophe Leroy 
Signed-off-by: Lucas De Marchi 
[Sami: Fixed a typo.]
Signed-off-by: Sami Tolvanen

module: deprecate usage of *_gpl sections in module loader

2026-03-31T23:42:52+00:00

The *_gpl section are not being used populated by modpost anymore. Hence
the module loader doesn't need to find and process these sections in
modules.

This patch also simplifies symbol finding logic in module loader since
*_gpl sections don't have to be searched anymore.

Signed-off-by: Siddharth Nayyar 
Reviewed-by: Petr Pavlu 
Signed-off-by: Sami Tolvanen

module: use kflagstab instead of *_gpl sections

2026-03-31T23:42:52+00:00

Read kflagstab section for vmlinux and modules to determine whether
kernel symbols are GPL only.

This patch eliminates the need for fragmenting the ksymtab for infering
the value of GPL-only symbol flag, henceforth stop populating *_gpl
versions of the ksymtab and kcrctab in modpost.

Signed-off-by: Siddharth Nayyar 
Reviewed-by: Petr Pavlu 
Signed-off-by: Sami Tolvanen

module: Give MODULE_SIG_STRING a more descriptive name

2026-03-24T21:42:37+00:00

The purpose of the constant it is not entirely clear from its name.

As this constant is going to be exposed in a UAPI header, give it a more
specific name for clarity. As all its users call it 'marker', use that
wording in the constant itself.

Signed-off-by: Thomas Weißschuh 
Reviewed-by: Petr Pavlu 
Reviewed-by: Nicolas Schier 
Signed-off-by: Sami Tolvanen

module: expose imported namespaces via sysfs

2026-03-19T22:24:55+00:00

Add /sys/module/*/import_ns to expose imported namespaces for
currently loaded modules. The file contains one namespace per line and
only exists for modules that import at least one namespace.

Previously, the only way for userspace to inspect the symbol
namespaces a module imports is to locate the .ko on disk and invoke
modinfo(8) to decompress/parse the metadata. The kernel validated
namespaces at load time, but it was otherwise discarded.

Exposing this data via sysfs provides a runtime mechanism to verify
which namespaces are being used by modules. For example, this allows
userspace to audit driver API access in Android GKI, which uses symbol
namespaces to restrict vendor drivers from using specific kernel
interfaces (e.g., direct filesystem access).

Signed-off-by: Nicholas Sielicki 
[Sami: Updated the commit message to explain motivation.]
Signed-off-by: Sami Tolvanen

module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

2026-03-18T21:43:18+00:00

When setting a charp module parameter, the param_set_charp() function
allocates memory to store a copy of the input value. Later, when the module
is potentially unloaded, the destroy_params() function is called to free
this allocated memory.

However, destroy_params() is available only when CONFIG_SYSFS=y, otherwise
only a dummy variant is present. In the unlikely case that the kernel is
configured with CONFIG_MODULES=y and CONFIG_SYSFS=n, this results in
a memory leak of charp values when a module is unloaded.

Fix this issue by making destroy_params() always available when
CONFIG_MODULES=y. Rename the function to module_destroy_params() to clarify
that it is intended for use by the module loader.

Fixes: e180a6b7759a ("param: fix charp parameters set via sysfs")
Signed-off-by: Petr Pavlu 
Signed-off-by: Sami Tolvanen