wireguard-linux/kernel/module, branch davem/net

module: fix lost error code from codetag_load_module()

2026-09-26T20:55:09Z

If codetag_load_module() fails, err is not set to reflect the failure and load_module() returns 0 after the module has been torn down. Also, if the module is a livepatch, mod->klp_info allocated by copy_module_elf() leaks on this error path. Free it via a new livepatch_cleanup label. Link: https://lore.kernel.org/20260827030503.49171-1-hao.ge@linux.dev Fixes: 044d2aee6c57 ("alloc_tag: handle module codetag load errors as module load failures") Signed-off-by: Hao Ge Signed-off-by: Andrew Morton Reported-by: Sashiko Suggested-by: Petr Pavlu Reviewed-by: Bradley Morgan Cc: Aaron Tomlin Cc: Luis Chamberalin Cc: Sami Tolvanen Cc: Suren Baghdasaryan Cc:

module: validate string table section types

2026-08-06T14:44:45Z

In elf_validity_cache_sechdrs, section sizes and offsets are validated, unless the section type is SHT_NULL or SHT_NOBITS. Later, elf_validity_cache_secstrings and elf_validity_cache_index_str access the section name table (.shstrtab) and symbol string table (.strtab) headers without first ensuring that their types are SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has not been validated and may reference out-of-bounds memory when dereferenced in elf_validity_cache_secstrings or elf_validity_cache_strtab. Validate that both string section headers are of type SHT_STRTAB before caching them. Cc: stable@vger.kernel.org Signed-off-by: Thiébaud Weksteen Reviewed-by: Aaron Tomlin Reviewed-by: Petr Pavlu Signed-off-by: Petr Pavlu

module/dups: Clean up includes

2026-08-06T11:29:03Z

The kernel/module/dups.c file relies on the following definitions and associated functions: * module_param() -> linux/moduleparam.h, * DEFINE_MUTEX() -> linux/mutex.h, * LIST_HEAD(), list_for_each_entry(), ... -> linux/list.h, * refcount_t, refcount_inc(), ... -> linux/refcount.h, * MODULE_NAME_LEN -> linux/module.h, * completion, complete_all(), ... -> linux/completion.h, * delayed_work, work_struct, ... -> linux/workqueue.h, * lockdep_assert_held() -> linux/lockdep.h, * strcmp(), memcpy() -> linux/string.h, * container_of() -> linux/container_of.h, * DEFINE_FREE(), __free(), scoped_guard() -> linux/cleanup.h, * kzalloc_obj(), kfree() -> linux/slab.h, * pr_debug(), pr_warn() -> linux/printk.h, * WARN() -> linux/bug.h, * TASK_KILLABLE -> linux/sched.h, * HZ -> linux/param.h. Update the file's include list accordingly. Signed-off-by: Petr Pavlu

module/dups: Use strcmp() to compare module names

2026-08-06T11:29:03Z

Use strcmp() instead of strlen()+memcmp() to compare module names in kmod_dup_request_lookup(), since all strings are NUL-terminated. Reviewed-by: Aaron Tomlin Signed-off-by: Petr Pavlu

module/dups: Use scope-based cleanup helpers

2026-08-06T11:29:03Z

Use scope-based cleanup helpers for kmod_dup_mutex and kmod_req to shorten the code and to clarify where the lock is taken in kmod_dup_request_exists_wait(). Signed-off-by: Petr Pavlu

module/dups: Avoid unnecessary kmod_dup_req allocations

2026-08-06T11:29:03Z

The kmod dups code preallocates kmod_dup_req before taking kmod_dup_mutex to avoid allocating memory while holding the lock. This provides little benefit, since the allocation is fast and can safely be done under the lock. On the other hand, it leads to unnecessary allocations when the request turns out to be a duplicate and slightly complicates the code. Allocate kmod_dup_req only when needed and introduce a helper function alloc_kmod_req() to initialize the structure. Reviewed-by: Aaron Tomlin Signed-off-by: Petr Pavlu

module/dups: Fix use-after-free in kmod_dup_req lifetime handling

2026-08-06T11:29:03Z

The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed only after it is no longer referenced. When releasing an instance, the kmod_dup_request_delete() function removes the kmod_dup_req from the dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it. However, this doesn't work correctly because parallel users referencing the instance in kmod_dup_request_exists_wait() don't enter an RCU read-side critical section. This can result in a use-after-free. The kmod_dup_request_exists_wait() function may need to hold a valid reference to a kmod_dup_req instance across a blocking wait until the corresponding modprobe command completes. This makes it unsuitable for RCU. Fix the issue by changing the lifecycle management of kmod_dup_req to use reference counting. Fixes: 8660484ed1cf ("module: add debugging auto-load duplicate module support") Reviewed-by: Aaron Tomlin Signed-off-by: Petr Pavlu

module/dups: Inform duplicate requests about the result directly

2026-08-06T11:29:03Z

When kmod_dup_request_announce() announces the completion of a request_module() call to duplicate waiters, it queues a work item to invoke kmod_dup_request_complete(), and only that function calls complete_all(). This adds an arbitrary delay that is unnecessary and provides little benefit. Call complete_all() directly from kmod_dup_request_announce() instead. Signed-off-by: Petr Pavlu

module: Remove unnecessary module::args

2026-08-06T11:29:03Z

Historically, various parameter-handling code kept pointers into module::args, most notably the charp support. However, in 2009, commit e180a6b7759a ("param: fix charp parameters set via sysfs") changed charp parameters to kstrdup() the input string as well. As a result, module::args now mostly wastes memory. The last users that still pointed into module::args have now been cleaned up, so remove this data. Reviewed-by: Aaron Tomlin Signed-off-by: Petr Pavlu

module: procfs: use matching type for accumulator in module_total_size()

2026-08-06T11:29:02Z

module_total_size() returns unsigned int but uses a signed int accumulator. While the result is numerically correct, the type mismatch is misleading. Change the accumulator to unsigned int to match the return type. Signed-off-by: Naveen Kumar Chaudhary Reviewed-by: Sami Tolvanen [ppavlu: correct the commit title] Signed-off-by: Petr Pavlu