From: Rusty Russell <rusty@rustcorp.com.au>
To: Milton Miller <miltonm@bga.com>
Cc: "Adam J. Richter" <adam@yggdrasil.com>
Cc: linux-kernel@vger.kernel.org, torvalds@transmeta.com
Subject: Re: 2.5.70-bk1[23]: load_module crashes when aborting module load
Date: Wed, 11 Jun 2003 15:47:29 +1000 [thread overview]
Message-ID: <20030611054822.F1A872C051@lists.samba.org> (raw)
In-Reply-To: Your message of "Tue, 10 Jun 2003 03:48:02 EST." <200306100848.h5A8m2E1034824@sullivan.realtime.net>
In message <200306100848.h5A8m2E1034824@sullivan.realtime.net> you write:
> Umm, isn't that the problem? Once we get past the point where mod points
> inside the module core (ie where we would goto cleanup), we can't
> reference mod->percpu after freeing mod->mod_core, since that frees mod
> (and hence a the use-after-free bug).
Doh! Good catch.
The problem is that mod is moved to point from the sucked-in
file (always freed last) to the module core, after which time the
"free(mod->core), reference mod->percpu" sequence is bogus, eg. when
the module_init function fails.
This patch keeps the ptr in a local variable, which solves the
problem simply.
Linus, please apply.
diff -urpN --exclude TAGS -X /home/rusty/devel/kernel/kernel-patches/current-dontdiff --minimal linux-2.5.70-bk15/kernel/module.c working-2.5.70-bk15-percpufree/kernel/module.c
--- linux-2.5.70-bk15/kernel/module.c 2003-06-11 12:15:34.000000000 +1000
+++ working-2.5.70-bk15-percpufree/kernel/module.c 2003-06-11 15:39:48.000000000 +1000
@@ -1366,7 +1366,7 @@ static struct module *load_module(void _
long arglen;
struct module *mod;
long err = 0;
- void *ptr = NULL; /* Stops spurious gcc uninitialized warning */
+ void *percpu = NULL, *ptr = NULL; /* Stops spurious gcc warning */
DEBUGP("load_module: umod=%p, len=%lu, uargs=%p\n",
umod, len, uargs);
@@ -1496,13 +1496,14 @@ static struct module *load_module(void _
if (pcpuindex) {
/* We have a special allocation for this section. */
- mod->percpu = percpu_modalloc(sechdrs[pcpuindex].sh_size,
- sechdrs[pcpuindex].sh_addralign);
- if (!mod->percpu) {
+ percpu = percpu_modalloc(sechdrs[pcpuindex].sh_size,
+ sechdrs[pcpuindex].sh_addralign);
+ if (!percpu) {
err = -ENOMEM;
goto free_mod;
}
sechdrs[pcpuindex].sh_flags &= ~(unsigned long)SHF_ALLOC;
+ mod->percpu = percpu;
}
/* Determine total sizes, and put offsets in sh_entsize. For now
@@ -1643,8 +1644,8 @@ static struct module *load_module(void _
free_core:
module_free(mod, mod->module_core);
free_percpu:
- if (mod->percpu)
- percpu_modfree(mod->percpu);
+ if (percpu)
+ percpu_modfree(percpu);
free_mod:
kfree(args);
free_hdr:
--
Anyone who quotes me in their sig is an idiot. -- Rusty Russell.
next prev parent reply other threads:[~2003-06-11 5:34 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-06-09 10:14 Adam J. Richter
2003-06-10 1:39 ` Rusty Russell
2003-06-10 8:48 ` Milton Miller
2003-06-11 5:47 ` Rusty Russell [this message]
2003-06-11 3:44 Randy.Dunlap
2003-06-11 23:43 Adam J. Richter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030611054822.F1A872C051@lists.samba.org \
--to=rusty@rustcorp.com.au \
--cc=adam@yggdrasil.com \
--cc=miltonm@bga.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®