linux-kernel - [PATCH] kallsyms: Always null-initialize modbuildid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251208214110.143607-1-mhi@mailbox.org>
Date: Mon,  8 Dec 2025 22:41:10 +0100
From: Maurice Hieronymus <mhi@...lbox.org>
To: yangfeng@...inos.cn,
	brgerst@...il.com,
	mingo@...nel.org,
	gary@...yguo.net,
	zhengyejian@...weicloud.com
Cc: linux-kernel@...r.kernel.org,
	georges.aureau@....com,
	Maurice Hieronymus <mhi@...lbox.org>
Subject: [PATCH] kallsyms: Always null-initialize modbuildid

modbuildid is never set when kallsyms_lookup_buildid is returning via
successful ftrace_mod_address_lookup.

This leads to an uninitialized pointer dereference on x86 when
CONFIG_STACKTRACE_BUILD_ID=y inside __sprint_symbol.

Prevent this by always initializing modbuildid and modname with NULL.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220717
Signed-off-by: Maurice Hieronymus <mhi@...lbox.org>
---
 kernel/kallsyms.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 049e296f586c..f83ee976e7d5 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -358,6 +358,12 @@ static int kallsyms_lookup_buildid(unsigned long addr,
 	namebuf[KSYM_NAME_LEN - 1] = 0;
 	namebuf[0] = 0;
 
+	/* Some code paths leave modname/modbuildid uninitialized; set to NULL */
+	if (modname)
+		*modname = NULL;
+	if (modbuildid)
+		*modbuildid = NULL;
+
 	if (is_ksym_addr(addr)) {
 		unsigned long pos;
 
@@ -365,10 +371,6 @@ static int kallsyms_lookup_buildid(unsigned long addr,
 		/* Grab name */
 		kallsyms_expand_symbol(get_symbol_offset(pos),
 				       namebuf, KSYM_NAME_LEN);
-		if (modname)
-			*modname = NULL;
-		if (modbuildid)
-			*modbuildid = NULL;
 
 		return strlen(namebuf);
 	}

base-commit: c2f2b01b74be8b40a2173372bcd770723f87e7b2
-- 
2.50.1