Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-13 23:51:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

module: Fix use-after-free bug in read_file_mod_stats()

Browse Source 
Smatch warns:
	kernel/module/stats.c:394 read_file_mod_stats()
	warn: passing freed memory 'buf'

We are passing 'buf' to simple_read_from_buffer() after freeing it.

Fix this by changing the order of 'simple_read_from_buffer' and 'kfree'.

Fixes: df3e764d8e ("module: add debug stats to help identify memory pressure")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
This commit is contained in:
Harshit Mogalapalli 2023-04-27 22:59:33 -07:00 committed by Luis Chamberlain
parent 44c026a73b
commit d36f6efbe0
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
kernel/module/stats.c
View File

@ -276,6 +276,7 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf,
struct mod_fail_load *mod_fail; struct mod_fail_load *mod_fail;
unsigned int len, size, count_failed = 0; unsigned int len, size, count_failed = 0;
char *buf; char *buf;
int ret;
u32 live_mod_count, fkreads, fdecompress, fbecoming, floads; u32 live_mod_count, fkreads, fdecompress, fbecoming, floads;
unsigned long total_size, text_size, ikread_bytes, ibecoming_bytes, unsigned long total_size, text_size, ikread_bytes, ibecoming_bytes,
idecompress_bytes, imod_bytes, total_virtual_lost; idecompress_bytes, imod_bytes, total_virtual_lost;
@ -390,8 +391,9 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf,
out_unlock: out_unlock:
mutex_unlock(&module_mutex); mutex_unlock(&module_mutex);
out: out:
ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
kfree(buf); kfree(buf);
return simple_read_from_buffer(user_buf, count, ppos, buf, len); return ret;
} }
#undef MAX_PREAMBLE #undef MAX_PREAMBLE
#undef MAX_FAILED_MOD_PRINT #undef MAX_FAILED_MOD_PRINT