linux-stable.git/kernel/module, branch v7.2.6

module/dups: Fix use-after-free in kmod_dup_req lifetime handling

2026-09-14T11:40:24+00:00

[ Upstream commit 5eecb11b543f9f417bcf0dea239ff99c6af65dbd ]

The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed
only after it is no longer referenced. When releasing an instance, the
kmod_dup_request_delete() function removes the kmod_dup_req from the
dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it.
However, this doesn't work correctly because parallel users referencing the
instance in kmod_dup_request_exists_wait() don't enter an RCU read-side
critical section. This can result in a use-after-free.

The kmod_dup_request_exists_wait() function may need to hold a valid
reference to a kmod_dup_req instance across a blocking wait until the
corresponding modprobe command completes. This makes it unsuitable for RCU.

Fix the issue by changing the lifecycle management of kmod_dup_req to use
reference counting.

Fixes: 8660484ed1cf ("module: add debugging auto-load duplicate module support")
Reviewed-by: Aaron Tomlin 
Signed-off-by: Petr Pavlu 
Signed-off-by: Sasha Levin

module/dups: Inform duplicate requests about the result directly

2026-09-14T11:40:24+00:00

[ Upstream commit d258ed8a86bb46bbbbc84fb914478259a1e694a4 ]

When kmod_dup_request_announce() announces the completion of
a request_module() call to duplicate waiters, it queues a work item to
invoke kmod_dup_request_complete(), and only that function calls
complete_all().

This adds an arbitrary delay that is unnecessary and provides little
benefit. Call complete_all() directly from kmod_dup_request_announce()
instead.

Signed-off-by: Petr Pavlu 
Stable-dep-of: 5eecb11b543f ("module/dups: Fix use-after-free in kmod_dup_req lifetime handling")
Signed-off-by: Sasha Levin

module: use strscpy() to copy module names in stats and dup tracking

2026-09-14T11:40:24+00:00

[ Upstream commit 93c29ebd1622fb0670701e1c1b3a978a5cac08b7 ]

Both try_add_failed_module() and kmod_dup_request_exists_wait() use
memcpy() with strlen() to copy module names into fixed-size
char[MODULE_NAME_LEN] buffers. Neither performs a bounds check on the
copy. Current callers always pass names originating from
mod->name (itself char[MODULE_NAME_LEN]), so this is not exploitable
today. However both functions accept a plain const char * with no
documented length contract, making them latent buffer overflows if a
future caller passes a longer string.

Replace memcpy() with strscpy() in both sites, which bounds the copy
to MODULE_NAME_LEN and always NUL-terminates.

Signed-off-by: Naveen Kumar Chaudhary 
Reviewed-by: Petr Pavlu 
Signed-off-by: Petr Pavlu 
Stable-dep-of: 5eecb11b543f ("module/dups: Fix use-after-free in kmod_dup_req lifetime handling")
Signed-off-by: Sasha Levin

module/kallsyms: fix nextval for data symbol lookup

2026-09-07T15:36:59+00:00

commit 0e9f090a4e9bfae5a190ccf89eab3bf14f6b0f96 upstream.

The symbol lookup code assumes the queried address resides in either
MOD_TEXT or MOD_INIT_TEXT. This breaks for addresses in other module
memory regions (e.g. rodata or data), resulting in incorrect upper
bounds and wrong symbol size.

Select the module memory region the address belongs to instead of
hardcoding text sections. Also initialize the lower bound to the start
of that region, as searching from address 0 is unnecessary.

Cc: stable@vger.kernel.org
Signed-off-by: Stanislaw Gruszka 
Reviewed-by: Petr Pavlu 
Signed-off-by: Petr Pavlu 
Signed-off-by: Greg Kroah-Hartman

module: validate string table section types

2026-09-07T15:36:59+00:00

commit 9a5ff45689329835f874cefe5174e577d141d423 upstream.

In elf_validity_cache_sechdrs, section sizes and offsets are validated,
unless the section type is SHT_NULL or SHT_NOBITS.

Later, elf_validity_cache_secstrings and elf_validity_cache_index_str
access the section name table (.shstrtab) and symbol string table
(.strtab) headers without first ensuring that their types are
SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has
not been validated and may reference out-of-bounds memory when
dereferenced in elf_validity_cache_secstrings or
elf_validity_cache_strtab.

Validate that both string section headers are of type SHT_STRTAB before
caching them.

Cc: stable@vger.kernel.org
Signed-off-by: Thiébaud Weksteen 
Reviewed-by: Aaron Tomlin 
Reviewed-by: Petr Pavlu 
Signed-off-by: Petr Pavlu 
Signed-off-by: Greg Kroah-Hartman

module: decompress: check return value of module_extend_max_pages()

2026-06-04T16:37:32+00:00

module_extend_max_pages() calls kvrealloc() internally and returns
-ENOMEM on allocation failure. The return value is never checked.

If the initial allocation fails, info->pages remains NULL and
info->max_pages remains 0. Subsequent calls to module_get_next_page()
will attempt to dynamically grow the array by calling
module_extend_max_pages(info, 0) since info->used_pages is 0. This
results in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated
as a success, leading to a dereference of ZERO_SIZE_PTR and a kernel
oops.

Fix: add the missing error check after module_extend_max_pages() and
return immediately on failure. This matches the pattern used by every
other kvrealloc() caller in the module loading path.

Fixes: b1ae6dc41eaa ("module: add in-kernel support for decompressing")
Cc: Dmitry Torokhov 
Cc: Luis Chamberlain 
Cc: stable@vger.kernel.org
Signed-off-by: Andrii Kuchmenko 
Reviewed-by: Christophe Leroy (CS GROUP) 
[Sami: Corrected the analysis in the commit message.]
Signed-off-by: Sami Tolvanen

module: Simplify warning on positive returns from module_init()

2026-04-04T00:04:48+00:00

It should now be rare to trigger this warning - it doesn't need to be so
verbose. Make it follow the usual style in the module loading code.

For the same reason, drop the dump_stack().

Suggested-by: Petr Pavlu 
Signed-off-by: Lucas De Marchi 
Reviewed-by: Aaron Tomlin 
Reviewed-by: Petr Pavlu 
Reviewed-by: Daniel Gomez 
Signed-off-by: Sami Tolvanen

module: Override -EEXIST module return

2026-04-04T00:04:42+00:00

The -EEXIST errno is reserved by the module loading functionality. When
userspace calls [f]init_module(), it expects a -EEXIST to mean that the
module is already loaded in the kernel. If module_init() returns it,
that is not true anymore.

Override the error when returning to userspace: it doesn't make sense to
change potentially long error propagation call chains just because it's
will end up as the return of module_init().

Closes: https://lore.kernel.org/all/aKLzsAX14ybEjHfJ@orbyte.nwl.cc/
Cc: Greg Kroah-Hartman 
Cc: Aaron Tomlin 
Cc: Petr Pavlu 
Cc: Daniel Gomez 
Cc: Phil Sutter 
Cc: Christophe Leroy 
Signed-off-by: Lucas De Marchi 
[Sami: Fixed a typo.]
Signed-off-by: Sami Tolvanen

module: deprecate usage of *_gpl sections in module loader

2026-03-31T23:42:52+00:00

The *_gpl section are not being used populated by modpost anymore. Hence
the module loader doesn't need to find and process these sections in
modules.

This patch also simplifies symbol finding logic in module loader since
*_gpl sections don't have to be searched anymore.

Signed-off-by: Siddharth Nayyar 
Reviewed-by: Petr Pavlu 
Signed-off-by: Sami Tolvanen

module: use kflagstab instead of *_gpl sections

2026-03-31T23:42:52+00:00

Read kflagstab section for vmlinux and modules to determine whether
kernel symbols are GPL only.

This patch eliminates the need for fragmenting the ksymtab for infering
the value of GPL-only symbol flag, henceforth stop populating *_gpl
versions of the ksymtab and kcrctab in modpost.

Signed-off-by: Siddharth Nayyar 
Reviewed-by: Petr Pavlu 
Signed-off-by: Sami Tolvanen