2019-08-06 07:49:00

by chenzefeng

Subject: [PATCH] ia64:unwind: fix double free for mod->arch.init_unw_table

The function free_module in file kernel/module.c as follow:

void free_module(struct module *mod) {
......
module_arch_cleanup(mod);
......
module_arch_freeing_init(mod);
......
}

Both module_arch_cleanup and module_arch_freeing_init function
would free the mod->arch.init_unw_table, which cause double free.

Here, set mod->arch.init_unw_table = NULL after remove the unwind
table to avoid double free.

Signed-off-by: chenzefeng <[email protected]>
---
arch/ia64/kernel/module.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
index 326448f..1a42ba8 100644
--- a/arch/ia64/kernel/module.c
+++ b/arch/ia64/kernel/module.c
@@ -914,10 +914,14 @@ struct plt_entry {
void
module_arch_cleanup (struct module *mod)
{
- if (mod->arch.init_unw_table)
+ if (mod->arch.init_unw_table) {
unw_remove_unwind_table(mod->arch.init_unw_table);
- if (mod->arch.core_unw_table)
+ mod->arch.init_unw_table = NULL;
+ }
+ if (mod->arch.core_unw_table) {
unw_remove_unwind_table(mod->arch.core_unw_table);
+ mod->arch.core_unw_table = NULL;
+ }
}

void *dereference_module_function_descriptor(struct module *mod, void *ptr)
--
1.8.5.6

2019-08-06 08:00:12

by Greg Kroah-Hartman

Subject: Re: [PATCH] ia64:unwind: fix double free for mod->arch.init_unw_table

On Tue, Aug 06, 2019 at 03:46:33PM +0800, chenzefeng wrote:
> The function free_module in file kernel/module.c as follow:
>
> void free_module(struct module *mod) {
> ......
> module_arch_cleanup(mod);
> ......
> module_arch_freeing_init(mod);
> ......
> }
>
> Both module_arch_cleanup and module_arch_freeing_init function
> would free the mod->arch.init_unw_table, which cause double free.
>
> Here, set mod->arch.init_unw_table = NULL after remove the unwind
> table to avoid double free.
>
> Signed-off-by: chenzefeng <[email protected]>
> ---
> arch/ia64/kernel/module.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree. Please read:
https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>

2019-08-06 17:33:04

by Luck, Tony

Subject: RE: [PATCH] ia64:unwind: fix double free for mod->arch.init_unw_table

> Here, set mod->arch.init_unw_table = NULL after remove the unwind
> table to avoid double free.

Applied. Thanks.

-Tony