Messages in this thread | | | From | Rusty Russell <> | Subject | Re: [PATCH] fix error handling in load_module() | Date | Mon, 21 Sep 2009 20:30:03 +0930 |
| |
On Fri, 11 Sep 2009 06:44:30 am Andrew Morton wrote: > On Mon, 7 Sep 2009 19:45:58 +0530 > Kamalesh Babulal <kamalesh@linux.vnet.ibm.com> wrote: > > Once the percpu_modalloc fails, percpu_modfree(mod->refptr) is called on a NULL pointer. > > We try calling it on a NULL pointer. The following patch fixes the problem by introducing > > a check for mod->refptr before calling percpu_modfree. > > Where did it crash and why did it crash? That trace is pretty unclear. > > > diff --git a/kernel/module.c b/kernel/module.c > > index 2d53718..7f89258 100644 > > --- a/kernel/module.c > > +++ b/kernel/module.c > > @@ -2379,7 +2379,8 @@ static noinline struct module *load_module(void __user *umod, > > module_unload_free(mod); > > #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP) > > free_init: > > - percpu_modfree(mod->refptr); > > + if (mod->refptr) > > + percpu_modfree(mod->refptr); > > #endif > > module_free(mod, mod->module_init); > > free_core: > > My reverse engineering of the secret, undocumented percpu_modfree() > indicates that its mad inventor intended that percpu_modfree(NULL) be a > valid thing to do.
Yes, percpu_modfree() should handle NULL. If it doesn't, that's the bug.
Confused, Rusty.
| |