From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757661AbcHYHzB (ORCPT ); Thu, 25 Aug 2016 03:55:01 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:33140 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751420AbcHYHzA (ORCPT ); Thu, 25 Aug 2016 03:55:00 -0400 X-IBM-Helo: d24dlp01.br.ibm.com X-IBM-MailFrom: bauerman@linux.vnet.ibm.com X-IBM-RcptTo: linux-kernel@vger.kernel.org From: Thiago Jung Bauermann To: kexec@lists.infradead.org Cc: Eric Biederman , Dave Young , Vivek Goyal , Baoquan He , linux-kernel@vger.kernel.org, Thiago Jung Bauermann Subject: [PATCH] kexec: Fix double-free when failing to relocate the purgatory. Date: Wed, 24 Aug 2016 21:05:46 -0300 X-Mailer: git-send-email 1.9.1 X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16082500-0020-0000-0000-000002342E5B X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16082500-0021-0000-0000-000030229AC3 Message-Id: <1472083546-23683-1-git-send-email-bauerman@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2016-08-24_14:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=38 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608240262 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If kexec_apply_relocations fails, kexec_load_purgatory frees pi->sechdrs and pi->purgatory_buf. This is redundant, because in case of error kimage_file_prepare_segments calls kimage_file_post_load_cleanup, which will also free those buffers. This causes two warnings like the following, one for pi->sechdrs and the other for pi->purgatory_buf: [ 18.112843] kexec-bzImage64: Loading purgatory failed [ 18.113257] ------------[ cut here ]------------ [ 18.113263] WARNING: CPU: 1 PID: 2119 at mm/vmalloc.c:1490 __vunmap+0xc1/0xd0 [ 18.113264] Trying to vfree() nonexistent vm area (ffffc90000e91000) [ 18.113367] Modules linked in: [ 18.113371] CPU: 1 PID: 2119 Comm: kexec Not tainted 4.8.0-rc3+ #5 [ 18.113372] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 [ 18.113373] 0000000000000000 ffff88003bbb7dc8 ffffffff8132eca8 ffff88003bbb7e18 [ 18.113376] 0000000000000000 ffff88003bbb7e08 ffffffff8105f1bb 000005d281175bf8 [ 18.113377] ffffc90000e91000 0000000000000000 0000000000000001 ffff88003e5f8c00 [ 18.113379] Call Trace: [ 18.113384] [] dump_stack+0x4d/0x65 [ 18.113386] [] __warn+0xcb/0xf0 [ 18.113388] [] warn_slowpath_fmt+0x4f/0x60 [ 18.113390] [] ? find_vmap_area+0x19/0x70 [ 18.113393] [] ? kimage_file_post_load_cleanup+0x47/0xb0 [ 18.113394] [] __vunmap+0xc1/0xd0 [ 18.113396] [] vfree+0x2e/0x70 [ 18.113397] [] kimage_file_post_load_cleanup+0x5e/0xb0 [ 18.113398] [] SyS_kexec_file_load+0x448/0x680 [ 18.113401] [] ? putname+0x54/0x60 [ 18.113403] [] ? do_sys_open+0x190/0x1f0 [ 18.113407] [] entry_SYSCALL_64_fastpath+0x13/0x8f [ 18.113408] ---[ end trace 158bb74f5950ca2b ]--- Fix by setting pi->sechdrs an pi->purgatory_buf to NULL, since vfree won't try to free a NULL pointer. Signed-off-by: Thiago Jung Bauermann --- kernel/kexec_file.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 503bc2d348e5..037c321c5618 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -887,7 +887,10 @@ int kexec_load_purgatory(struct kimage *image, unsigned long min, return 0; out: vfree(pi->sechdrs); + pi->sechdrs = NULL; + vfree(pi->purgatory_buf); + pi->purgatory_buf = NULL; return ret; } -- 1.9.1