On Thu, Jul 23, 2026 at 10:25:52AM +0200, Petr Pavlu wrote:
> The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed
> only after it is no longer referenced. When releasing an instance, the
> kmod_dup_request_delete() function removes the kmod_dup_req from the
> dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it.
> However, this doesn't work correctly because parallel users referencing the
> instance in kmod_dup_request_exists_wait() don't enter an RCU read-side
> critical section. This can result in a use-after-free.
>
> The kmod_dup_request_exists_wait() function may need to hold a valid
> reference to a kmod_dup_req instance across a blocking wait until the
> corresponding modprobe command completes. This makes it unsuitable for RCU.
>
> Fix the issue by changing the lifecycle management of kmod_dup_req to use
> reference counting.
>
> Fixes: 8660484ed1cf ("module: add debugging auto-load duplicate module
> support")
> Signed-off-by: Petr Pavlu <[email protected]>
> ---
> kernel/module/dups.c | 56
> +++++++++++++++++++++++++++++++++++++---------------
> 1 file changed, 40 insertions(+), 16 deletions(-)
Reviewed-by: Aaron Tomlin <[email protected]>
--
Aaron Tomlin
