linux-kernel - [PATCH] ibmphp: Fix module ref count underflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081210194334.GA25257@hmsreliant.think-freely.org>
Date:	Wed, 10 Dec 2008 14:43:34 -0500
From:	Neil Horman <nhorman@...driver.com>
To:	greg@...ah.com, linux-pci@...r.kernel.org,
	linux-kernel@...r.kernel.org, akpm@...ux-foundation.org
Cc:	nhorman@...driver.com
Subject: [PATCH] ibmphp: Fix module ref count underflow

Hey-
	I happened to notice that the ibmphp hotplug driver does something
rather silly in its init routine.  It purposely calls module_put so as to
underflow its module ref count to avoid being removed from the kernel.  This is
bad practice, and wrong, since it provides a window for subsequent module_gets
to reset the refcount to zero, allowing an unload to race in and cause all sorts
of mysterious panics.  If the module is unsafe to load, it should inform the
kernel as such with a call to __unsafe.  The patch below does that.

Regards
Neil

Signed-off-by: Neil Horman <nhorman@...driver.com>

 ibmphp_core.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)


diff --git a/drivers/pci/hotplug/ibmphp_core.c b/drivers/pci/hotplug/ibmphp_core.c
index c892daa..3706d4e 100644
--- a/drivers/pci/hotplug/ibmphp_core.c
+++ b/drivers/pci/hotplug/ibmphp_core.c
@@ -1402,9 +1402,11 @@ static int __init ibmphp_init(void)
 		goto error;
 	}
 
-	/* lock ourselves into memory with a module 
-	 * count of -1 so that no one can unload us. */
-	module_put(THIS_MODULE);
+	/*
+	 * Its unsafe to unload this module, so tell
+	 * the kernel to avoid inadvertent unloads
+	 */
+	__unsafe(THIS_MODULE);
 
 exit:
 	return rc;
-- 
/****************************************************
 * Neil Horman <nhorman@...driver.com>
 * Software Engineer, Red Hat
 ****************************************************/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/