Page MenuHomeFreeBSD

stand: module: unlink the entire tail when dependencies fail to load
ClosedPublic

Authored by kevans on Tue, Jun 25, 4:07 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Jun 27, 2:10 PM
Unknown Object (File)
Wed, Jun 26, 4:26 PM
Unknown Object (File)
Tue, Jun 25, 8:38 PM
Subscribers

Details

Summary

Assume you have loader configured to load linux64, which has a
dependency on both linux_common and mqueuefs but neither the kernel
nor kernel config in question have the mqueuefs module included.

When the load command for linux64 fails to find mqueuefs, it will
free both linux64 and linux_common as they were loaded first, but only
linux64 gets removed from the module list. As a result, future
traversals hit an easy use-after-free with linux_common.

Fix it so that we unlink the entire tail of the list. Anything after
the initially loaded module is, by definition, a dependency on the
loaded module while we're still in the load command, so we can just
discard the entire tail. If linux_common were loaded before linux64, it
should not move to a position during this load where it would suddenly
be missing from the view presented to the kernel.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

I had this diff sitting in a branch for some reason but never sent it for review, but it fixes a problem recently observed again in the cluster. I think I wrote this in response to a similar scenario hit by @sjg back in March 2023, but I don't really have records of that.

This looks good to me

This revision is now accepted and ready to land.Tue, Jun 25, 4:11 PM

Looks good to me. Do you need me to test it on aarch64?

Looks good to me. Do you need me to test it on aarch64?

If you'd like to, but imo it's not strictly necessary