Re: [PATCH] module: Fix use-after-free in module_put() tracepoint

[Petr Pavlu <petr.pavlu@suse.com>]

On 10/19/26 5:48 AM, Aaron Tomlin wrote:
> A use-after-free condition can arise in module_put() should a thread be
> preempted immediately after decrementing the module's reference count
> while the module is concurrently being unloaded.
> 
> In module_put(), the module's reference count is decremented via
> atomic_dec_if_positive() before the module pointer is passed to
> trace_module_put(). Consider a scenario where CPU 0 decrements the
> reference count without reaching the baseline MODULE_REF_BASE level and
> is immediately preempted: it relinquishes its reference while still
> retaining a local pointer to the module. If a concurrent CPU 1
> subsequently drops the final active reference, the module's reference
> count reaches MODULE_REF_BASE. This permits the module unload sequence
> (via delete_module() or the initialisation-failure tear-down path) to
> proceed and invoke free_module().
> 
> Function free_module() invokes synchronize_rcu() and subsequently
> releases the memory backing struct module via free_mod_mem(). Because
> CPU 0 was preempted outside an RCU read-side critical section,
> synchronize_rcu() does not await CPU 0. When CPU 0 eventually resumes
> execution, it passes the dangling module pointer to trace_module_put(),
> which dereferences mod->name and mod->refcnt, culminating in a
> use-after-free. This sequence of events is illustrated below:
> 
>     CPU 0                                       CPU 1
>     -----                                       -----
> 
>     module_put(module)
>       atomic_dec_if_positive()
>       [preempted]
>                                         module_put(module)
>                                           atomic_dec_if_positive()
>                                           // drops final reference
>                                         free_module(module)
>                                           synchronize_rcu()
>                                           free_mod_mem(module)
>       trace_module_put(module, ...)
>         mod->name
> 
> Resolve this by acquiring an RCU read-side critical section via
> guard(rcu)() in module_put(). This ensures that synchronize_rcu() in
> free_module() blocks until trace_module_put() has run to completion, even
> across preemption under PREEMPT_RCU configurations, while avoiding the need
> to disable preemption and preserving the post-decrement reference count
> tracing semantics.
> 
> Fixes: cb0b50b813f6 ("module: Remove preempt_disable() from module reference counting.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
> ---
>  kernel/module/main.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/kernel/module/main.c b/kernel/module/main.c
> index d0e1e0bd2ad0..8e2d0ab96e6e 100644
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c
> @@ -953,6 +953,7 @@ void module_put(struct module *module)
>  	int ret;
>  
>  	if (module) {
> +		guard(rcu)();
>  		ret = atomic_dec_if_positive(&module->refcnt);
>  		WARN_ON(ret < 0);	/* Failed to put refcount */
>  		trace_module_put(module, _RET_IP_);

I think a simpler fix is to move the trace_module_put() call before
atomic_dec_if_positive(). It would change the refcnt recorded in the
trace from the post-decrement count to the pre-decrement value, but that
isn't particularly important. For instance, xfs_group_put() and
objagg_obj_put() take the same approach.

-- 
Thanks,
Petr