From: Sean Christopherson <seanjc@google.com> mainline inclusion from mainline-v6.17 commit fa079a0616edbcdad538128306abbc19b68a9863 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9782 CVE: NA Reference: https://github.com/kvm-x86/linux/commit/fa079a0616ed -------------------------------- Drop irqbypass.ko's superfluous and misleading get/put calls on THIS_MODULE. A module taking a reference to itself is useless; no amount of checks will prevent doom and destruction if the caller hasn't already guaranteed the liveliness of the module (this goes for any module). E.g. if try_module_get() fails because irqbypass.ko is being unloaded, then the kernel has already hit a use-after-free by virtue of executing code whose lifecycle is tied to irqbypass.ko. Reviewed-by: Kevin Tian <kevin.tian@intel.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Alex Williamson <alex.williamson@redhat.com> Link: https://lore.kernel.org/r/20250516230734.2564775-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Qiqi Li <liqiqi23@huawei.com> --- virt/lib/irqbypass.c | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/virt/lib/irqbypass.c b/virt/lib/irqbypass.c index 28fda42e471b..080c706f3b01 100644 --- a/virt/lib/irqbypass.c +++ b/virt/lib/irqbypass.c @@ -92,9 +92,6 @@ int irq_bypass_register_producer(struct irq_bypass_producer *producer) might_sleep(); - if (!try_module_get(THIS_MODULE)) - return -ENODEV; - mutex_lock(&lock); list_for_each_entry(tmp, &producers, node) { @@ -120,7 +117,6 @@ int irq_bypass_register_producer(struct irq_bypass_producer *producer) return 0; out_err: mutex_unlock(&lock); - module_put(THIS_MODULE); return ret; } EXPORT_SYMBOL_GPL(irq_bypass_register_producer); @@ -142,9 +138,6 @@ void irq_bypass_unregister_producer(struct irq_bypass_producer *producer) might_sleep(); - if (!try_module_get(THIS_MODULE)) - return; /* nothing in the list anyway */ - mutex_lock(&lock); list_for_each_entry(tmp, &producers, node) { @@ -159,13 +152,10 @@ void irq_bypass_unregister_producer(struct irq_bypass_producer *producer) } list_del(&producer->node); - module_put(THIS_MODULE); break; } mutex_unlock(&lock); - - module_put(THIS_MODULE); } EXPORT_SYMBOL_GPL(irq_bypass_unregister_producer); @@ -188,9 +178,6 @@ int irq_bypass_register_consumer(struct irq_bypass_consumer *consumer) might_sleep(); - if (!try_module_get(THIS_MODULE)) - return -ENODEV; - mutex_lock(&lock); list_for_each_entry(tmp, &consumers, node) { @@ -216,7 +203,6 @@ int irq_bypass_register_consumer(struct irq_bypass_consumer *consumer) return 0; out_err: mutex_unlock(&lock); - module_put(THIS_MODULE); return ret; } EXPORT_SYMBOL_GPL(irq_bypass_register_consumer); @@ -238,9 +224,6 @@ void irq_bypass_unregister_consumer(struct irq_bypass_consumer *consumer) might_sleep(); - if (!try_module_get(THIS_MODULE)) - return; /* nothing in the list anyway */ - mutex_lock(&lock); list_for_each_entry(tmp, &consumers, node) { @@ -255,12 +238,9 @@ void irq_bypass_unregister_consumer(struct irq_bypass_consumer *consumer) } list_del(&consumer->node); - module_put(THIS_MODULE); break; } mutex_unlock(&lock); - - module_put(THIS_MODULE); } EXPORT_SYMBOL_GPL(irq_bypass_unregister_consumer); -- 2.43.0