On 7/8/26 4:00 AM, Aaron Tomlin wrote:
> Currently, the "module_blacklist=" command-line parameter only applies
> to loadable modules. If a module is built-in, the parameter is silently
> ignored. This patch extends the blacklisting functionality to built-in
> modules by intercepting their initialisation routines during early boot.
>
> To preserve the existing user-space ABI, "module_blacklist=" is kept
> as a legacy alias pointing to the same module_denylist variable.
>
> To achieve this, we introduce a new ".initcall.modnames" memory section.
> For each built-in module, we use a standard C structure (i.e., struct
> initcall_modname) to map its initcall function pointer to its associated
> KBUILD_MODNAME string.
>
> During boot, do_one_initcall() cross-references the initcall function
> pointer against this table. If a match is found and the module is
> present in the denylist, the initcall is skipped.
>
> To make the denylist functional on monolithic kernels, the command-line
> parameter parsing and the module_is_denylisted() lookup function are
> decoupled from the loadable module subsystem and moved to init/main.c.
> This enables "module_denylist=" and "module_blacklist=" to intercept
> built-in modules even on kernels built with CONFIG_MODULES=n.
>
> Design Considerations and Trade-offs:
>
> 1. LTO and CFI Compatibility vs. PREL32
>
> Previous iterations of this patch attempted to use top-level
> inline assembly to generate 32-bit relative offsets (PREL32) to
> save memory. However, raw inline assembly operates blindly
> outside of the C compiler's visibility. When compiled with
> CONFIG_LTO_CLANG or CONFIG_CFI_CLANG, the compiler applies
> symbol renaming and generates Control Flow Integrity stubs.
> The raw assembly string-matching fails to track these changes,
> resulting in undefined references or runtime address mismatches.
>
> To resolve this, we strictly use standard C structures to hold
> the function pointers. This natively allows the compiler to
> resolve LTO renaming and map CFI stubs correctly. We trade the
> minor spatial optimisation of PREL32 (using absolute 64-bit
> pointers instead) to guarantee architectural safety under modern
> compiler protections. Because this metadata is placed in an
> ".init" section and freed entirely after boot, the temporary
> memory overhead is negligible.
>
> 2. Prevention of UAF (Use-After-Free) via temporal and spatial
> boundaries:
>
> Because do_one_initcall() is a shared path invoked by both the
> early boot process and runtime module loading (i.e.,
> do_init_module()), we must prevent loadable modules from
> attempting to scan the ".initcall.modnames" section after it has
> been reclaimed by free_initmem().
>
> To ensure safety, we employ a two-fold validation check:
> - A temporal check using 'system_state >= SYSTEM_FREEING_INITMEM'
> to immediately return NULL once init memory is freed.
> - A spatial check using 'is_kernel_text()' and
> 'is_kernel_inittext()' to confirm the function resides in core
> kernel text.
>
> Since dynamically loaded modules reside in separately allocated
> module memory outside these ranges, they bypass the table lookup
> entirely. This makes the lookup lockless, race-free, and safe
> from UAF vulnerabilities.
>
> Signed-off-by: Aaron Tomlin <[email protected]>
> ---
> Changes since v3:
>
> - Renamed the external function prototype and internal helper to
> module_is_denylisted(), while updating the backing variable in
> main.c to module_denylist. To preserve user-space compatibility
> while adopting modern terminology, separate core_param entries have
> been introduced, allowing both the preferred module_denylist=
> parameter and the legacy module_blacklist= parameter to resolve to
> the same underlying variable (Andrew Morton)
>
> - I introduced the __initcall_fn_ptr() macro helper to dynamically
> resolve the initcall pointer configuration:
> - For architectures with relative 32-bit relocations
> (CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y), it resolves to the
> relocation stub pointer __initcall_stub(fn, __iid, id)
> - For architectures without PREL32 relocations, it resolves
> directly to the function pointer fn
>
> - Decoupled the module_denylist parameter parsing and the
> module_is_denylisted() function from CONFIG_MODULES, moving the
> logic to init/main.c. This ensures the denylist works for built-in
> modules even on monolithic kernels built without loadable module
> support (CONFIG_MODULES=n)
>
> - Removed the conditional stub implementation of
> module_is_denylisted() in module.h and replaced it with a single,
> unconditional declaration outside of the #ifdef CONFIG_MODULES block.
> This prevents compiler warnings about missing prototypes and ensures
> visibility under a monolithic configuration
>
> - Replaced the initmem_freed state variable and its synchronisation
> logic in kernel_init() with race-free spatial boundary checks using
> is_kernel_text() and is_kernel_inittext() in initcall_get_modname()
>
> - Aligned the .initcall_modnames table with relocations by assigning
> .initcall_fn using the __initcall_stub() helper in
> ___define_initcall(). This ensures the lookup matches the actual stub
> pointer passed to do_one_initcall() when
> CONFIG_HAVE_ARCH_PREL32_RELOCATIONS is enabled. Passed the preprocessor
> __iid argument to ____define_initcall_modname once to avoid double
> evaluation of __COUNTER__ (which caused build failures with LTO)
>
> - Updated initcall_get_modname() in main.c to resolve the function
> pointer fn using dereference_function_descriptor(fn) prior to
> checking the .text and .init.text boundaries, and dereference both
> fn and p->initcall_fn in the comparison loop to support descriptor-based
> architectures (e.g., PPC64)
>
> - Linked to v3:
> https://lore.kernel.org/lkml/[email protected]/
>
> Changes since v2:
>
> - Avoided relative 32-bit offsets (PREL32) with inline assembly, opting
> instead for standard C structures with absolute pointers. This fixes LTO
> and CFI compatibility issues (e.g., under Clang) where raw inline assembly
> fails to track compiler-generated symbols and CFI stubs
>
> - Placed module name strings into the ".init.rodata" section via a dedicated
> static array to ensure they are freed from memory after boot
>
> - Avoided Use-After-Free (UAF) bugs post-boot when loading dynamic modules:
> - Added an 'initmem_freed' flag, marked as '__ro_after_init', set after
> free_initmem() to skip table lookups for dynamically loaded modules
> - Added a blacklist check in do_init_module() for dynamic modules
>
> - Simplified the linker script using the BOUNDED_SECTION_PRE_LABEL() macro
> to define the ".initcall.modnames" section boundary
>
> - Added a dummy/stub implementation of module_is_blacklisted() when
> CONFIG_MODULES is disabled to avoid build errors
>
> - Linked to v2:
> https://lore.kernel.org/lkml/[email protected]/
>
> Changes since v1:
>
> - Pivoted entirely from exposing built-in initcalls and their blacklist
> status via a debugfs interface to directly extending the existing
> "module_blacklist=" and new "module_blacklist=" to intercept built-in
> modules at boot (Petr Pavlu)
>
> - Implemented 32-bit relative offsets (CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)
> to store the mappings, preventing binary bloat and preserving KASLR
> efficacy
>
> - Linked to v1:
> https://lore.kernel.org/lkml/[email protected]/
> ---
> include/asm-generic/vmlinux.lds.h | 4 ++-
> include/linux/init.h | 26 +++++++++++++--
> include/linux/module.h | 2 ++
> init/main.c | 53 +++++++++++++++++++++++++++++++
> kernel/module/main.c | 24 ++------------
> 5 files changed, 84 insertions(+), 25 deletions(-)
>
> diff --git a/include/asm-generic/vmlinux.lds.h
> b/include/asm-generic/vmlinux.lds.h
> index 5659f4b5a125..fc863595743e 100644
> --- a/include/asm-generic/vmlinux.lds.h
> +++ b/include/asm-generic/vmlinux.lds.h
> @@ -734,7 +734,9 @@
> EARLYCON_TABLE() \
> LSM_TABLE() \
> EARLY_LSM_TABLE() \
> - KUNIT_INIT_TABLE()
> + KUNIT_INIT_TABLE() \
> + . = ALIGN(8); \
Is ALIGN(8) sufficient, or is STRUCT_ALIGN() needed instead?
> + BOUNDED_SECTION_PRE_LABEL(.initcall.modnames, initcall_modnames,
> __start_, __stop_)
Nit: I think this can be shortened to:
BOUNDED_SECTION_BY(.initcall.modnames, _initcall_modnames)
>
> #define INIT_TEXT \
> *(.init.text .init.text.*) \
> diff --git a/include/linux/init.h b/include/linux/init.h
> index 40331923b9f4..9c78b6c30361 100644
> --- a/include/linux/init.h
> +++ b/include/linux/init.h
> @@ -271,8 +271,30 @@ extern struct module __this_module;
> __initcall_name(initcall, __iid, id), \
> __initcall_section(__sec, __iid))
>
> -#define ___define_initcall(fn, id, __sec) \
> - __unique_initcall(fn, id, __sec, __initcall_id(fn))
> +#ifdef CONFIG_HAVE_ARCH_PREL32_RELOCATIONS
> +#define __initcall_fn_ptr(fn, __iid, id) __initcall_stub(fn, __iid, id)
> +#else
> +#define __initcall_fn_ptr(fn, __iid, id) fn
> +#endif
> +
> +struct initcall_modname {
> + initcall_t initcall_fn;
> + const char *modname;
> +};
> +
> +#define ____define_initcall_modname(fn, id, __sec, __iid) \
> + __unique_initcall(fn, id, __sec, __iid) \
> + static const char __initstr_##fn[] __used __aligned(1) \
> + __section(".init.rodata") = KBUILD_MODNAME; \
> + static const struct initcall_modname __modname_##fn __used \
> + __section(".initcall.modnames") = { \
> + .initcall_fn = __initcall_fn_ptr(fn, __iid, id), \
> + .modname = __initstr_##fn \
> + };
All initcalls are ultimately defined via ____define_initcall_modname(),
including initcalls in vmlinux code that can never be built as modules.
In such a case, KBUILD_MODNAME is set to the target's basename (same as
KBUILD_BASENAME).
This wastes memory and also allows the module_blacklist parameter to
match initcalls that are unrelated to built-in modules.
> +
> +#define ___define_initcall(fn, id, __sec) \
> + ____define_initcall_modname(fn, id, __sec, __initcall_id(fn))
> +
>
> #define __define_initcall(fn, id) ___define_initcall(fn, id, .initcall##id)
>
> diff --git a/include/linux/module.h b/include/linux/module.h
> index 7566815fabbe..bc2968c225e1 100644
> --- a/include/linux/module.h
> +++ b/include/linux/module.h
> @@ -883,6 +883,8 @@ static inline void module_for_each_mod(int(*func)(struct
> module *mod, void *data
> }
> #endif /* CONFIG_MODULES */
>
> +extern bool module_is_denylisted(const char *module_name);
> +
Nit: The extern keyword in function declarations is unnecessary. See
Documentation/process/coding-style.rst.
> #ifdef CONFIG_SYSFS
> extern struct kset *module_kset;
> extern const struct kobj_type module_ktype;
> diff --git a/init/main.c b/init/main.c
> index e363232b428b..af71811d24e3 100644
> --- a/init/main.c
> +++ b/init/main.c
> @@ -1334,12 +1334,65 @@ static inline void do_trace_initcall_level(const char
> *level)
> }
> #endif /* !TRACEPOINTS_ENABLED */
>
> +extern struct initcall_modname __start_initcall_modnames[];
> +extern struct initcall_modname __stop_initcall_modnames[];
> +
> +/* module_denylist is a comma-separated list of module names */
> +static char *module_denylist;
> +bool module_is_denylisted(const char *module_name)
module_is_denylisted() should be __init_or_module.
> +{
> + const char *p;
> + size_t len;
> +
> + if (!module_denylist)
> + return false;
> +
> + for (p = module_denylist; *p; p += len) {
> + len = strcspn(p, ",");
> + if (strlen(module_name) == len && !memcmp(module_name, p, len))
> + return true;
> + if (p[len] == ',')
> + len++;
> + }
> + return false;
> +}
> +core_param(module_denylist, module_denylist, charp, 0400);
> +core_param(module_blacklist, module_denylist, charp, 0400);
> +
> +static const char *initcall_get_modname(initcall_t fn)
initcall_get_modname() should ideally be __init.
Nit: I think a better name would be something like get_builtin_modname()
to make clear that the function returns a module name only for built-in
modules, not regular ones.
> +{
> + struct initcall_modname *p;
> + unsigned long addr = (unsigned long)dereference_function_descriptor(fn);
> +
> + if (system_state >= SYSTEM_FREEING_INITMEM)
> + return NULL;
> +
> + if (!is_kernel_text(addr) &&
> + !is_kernel_inittext(addr))
> + return NULL;
I believe these checks could be avoided if the code was reorganized to
avoid reaching this logic on the do_init_module() path in the first
place.
> +
> + for (p = __start_initcall_modnames; p < __stop_initcall_modnames; p++) {
> + if (dereference_function_descriptor(p->initcall_fn) ==
> + dereference_function_descriptor(fn))
> + return p->modname;
> + }
> + return NULL;
> +}
> +
> int __init_or_module do_one_initcall(initcall_t fn)
> {
> int count = preempt_count();
> char msgbuf[64];
> + const char *modname;
> int ret;
>
> + modname = initcall_get_modname(fn);
> + if (modname && module_is_denylisted(modname)) {
> + pr_info("Skipping initcall for blacklisted built-in module
> %s\n",
> + modname);
> + return 0;
> + }
> +
> if (initcall_blacklisted(fn))
> return -EPERM;
>
> diff --git a/kernel/module/main.c b/kernel/module/main.c
> index 46dd8d25a605..e6d9c52b9786 100644
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c
> @@ -2919,26 +2919,6 @@ int __weak module_frob_arch_sections(Elf_Ehdr *hdr,
> return 0;
> }
>
> -/* module_blacklist is a comma-separated list of module names */
> -static char *module_blacklist;
> -static bool blacklisted(const char *module_name)
> -{
> - const char *p;
> - size_t len;
> -
> - if (!module_blacklist)
> - return false;
> -
> - for (p = module_blacklist; *p; p += len) {
> - len = strcspn(p, ",");
> - if (strlen(module_name) == len && !memcmp(module_name, p, len))
> - return true;
> - if (p[len] == ',')
> - len++;
> - }
> - return false;
> -}
> -core_param(module_blacklist, module_blacklist, charp, 0400);
>
> static struct module *layout_and_allocate(struct load_info *info, int flags)
> {
> @@ -3389,9 +3369,9 @@ static int early_mod_check(struct load_info *info, int
> flags)
>
> /*
> * Now that we know we have the correct module name, check
> - * if it's blacklisted.
> + * if it's denylisted.
> */
> - if (blacklisted(info->name)) {
> + if (module_is_denylisted(info->name)) {
> pr_err("Module %s is blacklisted\n", info->name);
> return -EPERM;
> }
--
Cheers,
Petr
