libkmod: fix NULL deref in module_options_concat(); merge multiple softdep/weakdep stanzas - #459
Open
prabhakarpujeri wants to merge 4 commits into
Open
prabhakarpujeri wants to merge 4 commits into
prabhakarpujeri wants to merge 4 commits into
Conversation
added 4 commits
August 31, 2026 15:35
module_options_concat() dereferences the result of malloc() without checking it, so modprobe can crash when the allocation fails. NULL already means that neither source supplied any options. Return a status separately from the allocated string so an allocation failure can be reported as -ENOMEM. This avoids both the crash and loading a module without options that the caller requested. Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
kmod_module_get_softdeps() and kmod_module_get_weakdeps() stop at the first matching configuration stanza. Additional dependency lines for the same module are therefore ignored. A generated modules.softdep entry can also prevent a matching entry in modprobe.d from taking effect. Append dependencies from every matching stanza, as lookup_dep() already does for its per-module lists. Enable the existing multi-softdep test and extend the weakdep fixture to cover two matching stanzas. Link: kmod-project#33 Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
The long option table accepts both --show and --dry-run as aliases of -n and the man page documents "-n, --show, --dry-run", but the help text only mentions --show. Add the --dry-run alias to match, wrapping the description onto the next line as done for the other options that don't fit the description column. Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
The help text lists -i twice, once for --ignore-install and once for --ignore-remove, while both long options map to the same flag and the man page documents them jointly as "-i, --ignore-install, --ignore-remove". Merge into a single entry, following the man page wording. Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
prabhakarpujeri
force-pushed
the
fixes
branch
from
September 1, 2026 13:13
dc1708c to
2775d1b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four small fixes:
1. libkmod: fix NULL dereference in module_options_concat()
The
malloc()return value is dereferenced unguarded; on OOM this NULL-derefsin the
kmod_module_probe_insert_module()(modprobe) path. The function'scontract treats NULL as "no options" (the sole caller passes the result on to
kmod_module_insert_module()/module_do_install_commands()which bothaccept NULL), so the fix returns NULL on OOM and documents this contract in a
comment rather than inventing a new error path.
2. libkmod: merge all matching softdep and weakdep config stanzas (fixes #33)
kmod_module_get_softdeps()/kmod_module_get_weakdeps()broke out of theconfig iteration after the first matching stanza, silently dropping deps from
additional
softdep/weakdeplines for the same module. Now every matchingstanza is accumulated, mirroring
lookup_dep()itself. Themulti_softdeptestsuite case was marked
expected_failwith a FIXME referencing #33; withthis fix it becomes a normal passing test, verified with
meson test(
TESTSUITE: PASSED: multi_softdep, full suite 7/7, plus an ASan+UBSan build).3. depmod: add missing --dry-run to --help output
-nis accepted as both--showand--dry-run(and documented as such indepmod(8)) but the help text only listed
--show.4. modprobe: merge duplicated -i lines in --help output
The help output printed
-itwice (for--ignore-installand--ignore-remove); merged into one line matching modprobe(8)'s joint wording.All commits build warning-free (
-Dwerror=true) and the full testsuite passes(7/7 in both the regular and sanitizer builds; patches also round-trip cleanly
via
git amon pristine master).