Re: [PATCH v2 2/6] module/dups: Fix use-after-free in kmod_dup_req lifetime handling

[Aaron Tomlin]

On Thu, Jul 23, 2026 at 10:25:52AM +0200, Petr Pavlu wrote:
> The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed
> only after it is no longer referenced. When releasing an instance, the
> kmod_dup_request_delete() function removes the kmod_dup_req from the
> dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it.
> However, this doesn't work correctly because parallel users referencing the
> instance in kmod_dup_request_exists_wait() don't enter an RCU read-side
> critical section. This can result in a use-after-free.
> 
> The kmod_dup_request_exists_wait() function may need to hold a valid
> reference to a kmod_dup_req instance across a blocking wait until the
> corresponding modprobe command completes. This makes it unsuitable for RCU.
> 
> Fix the issue by changing the lifecycle management of kmod_dup_req to use
> reference counting.
> 
> Fixes: 8660484ed1cf ("module: add debugging auto-load duplicate module support")
> Signed-off-by: Petr Pavlu <petr.pavlu@xxxxxxxx>
> ---
>  kernel/module/dups.c | 56 +++++++++++++++++++++++++++++++++++++---------------
>  1 file changed, 40 insertions(+), 16 deletions(-)

Reviewed-by: Aaron Tomlin <atomlin@xxxxxxxxxxx>

-- 
Aaron Tomlin