GitHub-Mirror/linux-bl808
2
0
Fork 0
mirror of https://github.com/Fishwaldo/linux-bl808.git synced 2025-04-04 05:13:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

module: fix refptr allocation and release order

Browse source 
Impact: fix ref-after-free crash on failed module load

Fix refptr bug: Change refptr allocation and release order not to access a module
data structure pointed by 'mod' after freeing mod->module_core.
This bug will cause kernel panic(e.g. failed to find undefined symbols).

This bug was reported on systemtap bugzilla.
http://sources.redhat.com/bugzilla/show_bug.cgi?id=9927

Signed-off-by: Masami Hiramatsu <mhiramat@redhat.com>
Cc: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is contained in:
Masami Hiramatsu 2009-03-16 18:13:36 -04:00 • committed by Rusty Russell
parent ee568b25ee
commit 6e2b75740b
1 changed files with 17 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
kernel/module.c
View file

@ -2015,14 +2015,6 @@ static noinline struct module *load_module(void __user *umod,
if (err < 0) if (err < 0)
goto free_mod; goto free_mod;
#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
mod->refptr = percpu_modalloc(sizeof(local_t), __alignof__(local_t),
mod->name);
if (!mod->refptr) {
err = -ENOMEM;
goto free_mod;
}
#endif
if (pcpuindex) { if (pcpuindex) {
/* We have a special allocation for this section. */ /* We have a special allocation for this section. */
percpu = percpu_modalloc(sechdrs[pcpuindex].sh_size, percpu = percpu_modalloc(sechdrs[pcpuindex].sh_size,
@ -2030,7 +2022,7 @@ static noinline struct module *load_module(void __user *umod,
mod->name); mod->name);
if (!percpu) { if (!percpu) {
err = -ENOMEM; err = -ENOMEM;
goto free_percpu; goto free_mod;
} }
sechdrs[pcpuindex].sh_flags &= ~(unsigned long)SHF_ALLOC; sechdrs[pcpuindex].sh_flags &= ~(unsigned long)SHF_ALLOC;
mod->percpu = percpu; mod->percpu = percpu;
@ -2082,6 +2074,14 @@ static noinline struct module *load_module(void __user *umod,
/* Module has been moved. */ /* Module has been moved. */
mod = (void *)sechdrs[modindex].sh_addr; mod = (void *)sechdrs[modindex].sh_addr;
#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
mod->refptr = percpu_modalloc(sizeof(local_t), __alignof__(local_t),
mod->name);
if (!mod->refptr) {
err = -ENOMEM;
goto free_init;
}
#endif
/* Now we've moved module, initialize linked lists, etc. */ /* Now we've moved module, initialize linked lists, etc. */
module_unload_init(mod); module_unload_init(mod);
@ -2288,15 +2288,17 @@ static noinline struct module *load_module(void __user *umod,
ftrace_release(mod->module_core, mod->core_size); ftrace_release(mod->module_core, mod->core_size);
free_unload: free_unload:
module_unload_free(mod); module_unload_free(mod);
module_free(mod, mod->module_init); free_init:
free_core:
module_free(mod, mod->module_core);
free_percpu:
if (percpu)
percpu_modfree(percpu);
#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP) #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
percpu_modfree(mod->refptr); percpu_modfree(mod->refptr);
#endif #endif
module_free(mod, mod->module_init);
free_core:
module_free(mod, mod->module_core);
/* mod will be freed with core. Don't access it beyond this line! */
free_percpu:
if (percpu)
percpu_modfree(percpu);
free_mod: free_mod:
kfree(args); kfree(args);
free_hdr: free_hdr: