On 30/06/2025 16.32, Petr Pavlu wrote: > Passing a module name longer than MODULE_NAME_LEN to the delete_module > syscall results in its silent truncation. This really isn't much of > a problem in practice, but it could theoretically lead to the removal of an > incorrect module. It is more sensible to return ENAMETOOLONG or ENOENT in > such a case. > > Update the syscall to return ENOENT, as documented in the delete_module(2) > man page to mean "No module by that name exists." This is appropriate > because a module with a name
Including the NUL byte... > longer than MODULE_NAME_LEN cannot be loaded > in the first place. > > Signed-off-by: Petr Pavlu <petr.pa...@suse.com> > --- > kernel/module/main.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/kernel/module/main.c b/kernel/module/main.c > index 413ac6ea3702..933a9854cb7d 100644 > --- a/kernel/module/main.c > +++ b/kernel/module/main.c > @@ -751,14 +751,16 @@ SYSCALL_DEFINE2(delete_module, const char __user *, > name_user, > struct module *mod; > char name[MODULE_NAME_LEN]; > char buf[MODULE_FLAGS_BUF_SIZE]; > - int ret, forced = 0; > + int ret, len, forced = 0; > > if (!capable(CAP_SYS_MODULE) || modules_disabled) > return -EPERM; > > - if (strncpy_from_user(name, name_user, MODULE_NAME_LEN-1) < 0) > - return -EFAULT; > - name[MODULE_NAME_LEN-1] = '\0'; > + len = strncpy_from_user(name, name_user, MODULE_NAME_LEN); > + if (len == 0 || len == MODULE_NAME_LEN) > + return -ENOENT; > + if (len < 0) > + return len; This looks correct to me. The new code not only returns the correct errors indicated in delete_module(2) but also checks for the case user passes an empty string and the case where NUL char is not found when copying (with len == MODULE_NAME_LEN) as well as it's using the correct length (MODULE_NAME_LEN) for copying. Reviewed-by: Daniel Gomez <da.go...@samsung.com>
