linux-kernel - Re: [PATCH] fix error handling in load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4AB78C67.4060304@kernel.org>
Date:	Mon, 21 Sep 2009 23:23:35 +0900
From:	Tejun Heo <tj@...nel.org>
To:	Rusty Russell <rusty@...tcorp.com.au>
CC:	Andrew Morton <akpm@...ux-foundation.org>,
	Kamalesh Babulal <kamalesh@...ux.vnet.ibm.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] fix error handling in load_module()

Hello, Rusty.

Rusty Russell wrote:
>> My reverse engineering of the secret, undocumented percpu_modfree()
>> indicates that its mad inventor intended that percpu_modfree(NULL) be a
>> valid thing to do.
> 
> Yes, percpu_modfree() should handle NULL.  If it doesn't, that's the bug.

Hmm... It seems the report was against pre-2.6.32-rcX window.  ppc is
still using the original percpu_modfree() and I don't think the it
ever supported NULL free.  In the current linus tree, the triggering
BUG() would be at line 500 which is inside percpu_modfree() which
checks @freeme matches any allocated address and if not triggers
BUG().

I think something like the following should fix it.

 kernel/module.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/module.c b/kernel/module.c
index 05ce49c..eed1f9e 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -490,6 +490,9 @@ static void percpu_modfree(void *freeme)
 	void *ptr = __per_cpu_start + block_size(pcpu_size[0]);
 	int cpu;

+	if (unlikely(!freeme))
+		return;
+
 	/* First entry is core kernel percpu data. */
 	for (i = 1; i < pcpu_num_used; ptr += block_size(pcpu_size[i]), i++) {
 		if (ptr == freeme) {

-- 
tejun
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/