Messages in this thread Patch in this message | | | Subject | [PATCH] Fix use-after-free when trying to load an invalid module | From | Luca Barbieri <> | Date | 14 Jun 2003 14:08:32 +0200 |
| |
mod->module_core contains the mod structure, so it must be freed after mod->percpu. However, initialization happens in the opposite order because mod is moved after that, so we need to initialize module_core to 0 and check it later.
--- linux-2.5.70/kernel/module.c~ 2003-06-02 10:50:57.000000000 +0200 +++ linux-2.5.70/kernel/module.c 2003-06-11 18:08:47.000000000 +0200 @@ -1417,6 +1417,7 @@ static struct module *load_module(void _ if (err < 0) goto free_mod; + mod->module_core = NULL; if (pcpuindex) { /* We have a special allocation for this section. */ mod->percpu = percpu_modalloc(sechdrs[pcpuindex].sh_size, @@ -1565,10 +1566,12 @@ static struct module *load_module(void _ module_unload_free(mod); module_free(mod, mod->module_init); free_core: - module_free(mod, mod->module_core); free_percpu: if (mod->percpu) percpu_modfree(mod->percpu); + + if(mod->module_core) + module_free(mod, mod->module_core); free_mod: kfree(args); free_hdr:
-- Luca Barbieri <lb@lb.ods.org> - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |