CVE-2024-50002: static_call: Handle module init failure correctly in static_call_del_module()

In the Linux kernel, the following vulnerability has been resolved:

staticcall: Handle module init failure correctly in staticcalldelmodule()

Module insertion invokes staticcalladdmodule() to initialize the static calls in a module. staticcalladdmodule() invokes staticcallinit(), which allocates a struct staticcallmod to either encapsulate the built-in static call sites of the associated key into it so further modules can be added or to append the module to the module chain.

If that allocation fails the function returns with an error code and the module core invokes staticcalldelmodule() to clean up eventually added staticcallmod entries.

This works correctly, when all keys used by the module were converted over to a module chain before the failure. If not then staticcalldelmodule() causes a #GP as it blindly assumes that key::mods points to a valid struct staticcallmod.

The problem is that key::mods is not a individual struct member of struct staticcallkey, it's part of a union to save space:

union { / bit 0: 0 = mods, 1 = sites / unsigned long type; struct staticcallmod mods; struct staticcallsite sites; };

key::sites is a pointer to the list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A mods pointer has the bit clear, the sites pointer has the bit set.

As staticcalldelmodule() blidly assumes that the pointer is a valid staticcallmod type, it fails to check for this failure case and dereferences the pointer to the list of built-in call sites, which is obviously bogus.

Cure it by checking whether the key has a sites or a mods pointer.

If it's a sites pointer then the key is not to be touched. As the sites are walked in the same order as in staticcallinit() the site walk can be terminated because all subsequent sites have not been touched by the init code due to the error exit.

If it was converted before the allocation fail, then the inner loop which searches for a module match will find nothing.

A fail in the second allocation in staticcallinit() is harmless and does not require special treatment. The first allocation succeeded and converted the key to a module chain. That first entry has mod::mod == NULL and mod::next == NULL, so the inner loop of staticcalldelmodule() will neither find a module match nor a module chain. The next site in the walk was either already converted, but can't match the module, or it will exit the outer loop because it has a staticcallsite pointer and not a staticcallmod pointer.