A use-after-free condition can arise in module_put() should a thread be
preempted immediately after decrementing the module's reference count
while the module is concurrently being unloaded.
In module_put(), the module's reference count is decremented via
atomic_dec_if_positive() before the module pointer is passed to
trace_module_put(). Consider a scenario where CPU 0 decrements the
reference count without reaching the baseline MODULE_REF_BASE level and
is immediately preempted: it relinquishes its reference while still
retaining a local pointer to the module. If a concurrent CPU 1
subsequently drops the final active reference, the module's reference
count reaches MODULE_REF_BASE. This permits the module unload sequence
(via delete_module() or the initialisation-failure tear-down path) to
proceed and invoke free_module().
Function free_module() invokes synchronize_rcu() and subsequently
releases the memory backing struct module via free_mod_mem(). Because
CPU 0 was preempted outside an RCU read-side critical section,
synchronize_rcu() does not await CPU 0. When CPU 0 eventually resumes
execution, it passes the dangling module pointer to trace_module_put(),
which dereferences mod->name and mod->refcnt, culminating in a
use-after-free. This sequence of events is illustrated below:
CPU 0 CPU 1
----- -----
module_put(module)
atomic_dec_if_positive()
[preempted]
module_put(module)
atomic_dec_if_positive()
// drops final reference
free_module(module)
synchronize_rcu()
free_mod_mem(module)
trace_module_put(module, ...)
mod->name
Resolve this by acquiring an RCU read-side critical section via
guard(rcu)() in module_put(). This ensures that synchronize_rcu() in
free_module() blocks until trace_module_put() has run to completion, even
across preemption under PREEMPT_RCU configurations, while avoiding the need
to disable preemption and preserving the post-decrement reference count
tracing semantics.
Fixes: cb0b50b813f6 ("module: Remove preempt_disable() from module reference
counting.")
Cc: [email protected]
Signed-off-by: Aaron Tomlin <[email protected]>
---
kernel/module/main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/module/main.c b/kernel/module/main.c
index d0e1e0bd2ad0..8e2d0ab96e6e 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -953,6 +953,7 @@ void module_put(struct module *module)
int ret;
if (module) {
+ guard(rcu)();
ret = atomic_dec_if_positive(&module->refcnt);
WARN_ON(ret < 0); /* Failed to put refcount */
trace_module_put(module, _RET_IP_);
--
2.55.0
