On 10/19/26 5:48 AM, Aaron Tomlin wrote:
> A use-after-free condition can arise in module_put() should a thread be
> preempted immediately after decrementing the module's reference count
> while the module is concurrently being unloaded.
>
> In module_put(), the module's reference count is decremented via
> atomic_dec_if_positive() before the module pointer is passed to
> trace_module_put(). Consider a scenario where CPU 0 decrements the
> reference count without reaching the baseline MODULE_REF_BASE level and
> is immediately preempted: it relinquishes its reference while still
> retaining a local pointer to the module. If a concurrent CPU 1
> subsequently drops the final active reference, the module's reference
> count reaches MODULE_REF_BASE. This permits the module unload sequence
> (via delete_module() or the initialisation-failure tear-down path) to
> proceed and invoke free_module().
>
> Function free_module() invokes synchronize_rcu() and subsequently
> releases the memory backing struct module via free_mod_mem(). Because
> CPU 0 was preempted outside an RCU read-side critical section,
> synchronize_rcu() does not await CPU 0. When CPU 0 eventually resumes
> execution, it passes the dangling module pointer to trace_module_put(),
> which dereferences mod->name and mod->refcnt, culminating in a
> use-after-free. This sequence of events is illustrated below:
>
> CPU 0 CPU 1
> ----- -----
>
> module_put(module)
> atomic_dec_if_positive()
> [preempted]
> module_put(module)
> atomic_dec_if_positive()
> // drops final reference
> free_module(module)
> synchronize_rcu()
> free_mod_mem(module)
> trace_module_put(module, ...)
> mod->name
>
> Resolve this by acquiring an RCU read-side critical section via
> guard(rcu)() in module_put(). This ensures that synchronize_rcu() in
> free_module() blocks until trace_module_put() has run to completion, even
> across preemption under PREEMPT_RCU configurations, while avoiding the need
> to disable preemption and preserving the post-decrement reference count
> tracing semantics.
>
> Fixes: cb0b50b813f6 ("module: Remove preempt_disable() from module reference
> counting.")
> Cc: [email protected]
> Signed-off-by: Aaron Tomlin <[email protected]>
> ---
> kernel/module/main.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/kernel/module/main.c b/kernel/module/main.c
> index d0e1e0bd2ad0..8e2d0ab96e6e 100644
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c
> @@ -953,6 +953,7 @@ void module_put(struct module *module)
> int ret;
>
> if (module) {
> + guard(rcu)();
> ret = atomic_dec_if_positive(&module->refcnt);
> WARN_ON(ret < 0); /* Failed to put refcount */
> trace_module_put(module, _RET_IP_);
I think a simpler fix is to move the trace_module_put() call before
atomic_dec_if_positive(). It would change the refcnt recorded in the
trace from the post-decrement count to the pre-decrement value, but that
isn't particularly important. For instance, xfs_group_put() and
objagg_obj_put() take the same approach.
--
Thanks,
Petr
