From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754921AbbDGNFj (ORCPT ); Tue, 7 Apr 2015 09:05:39 -0400 Received: from ip4-83-240-67-251.cust.nbox.cz ([83.240.67.251]:54549 "EHLO ip4-83-240-18-248.cust.nbox.cz" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754143AbbDGMwI (ORCPT ); Tue, 7 Apr 2015 08:52:08 -0400 From: Jiri Slaby To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Andy Lutomirski , Rusty Russell , Jiri Slaby Subject: [PATCH 3.12 114/155] module: Clean up ro/nx after early module load failures Date: Tue, 7 Apr 2015 14:51:23 +0200 Message-Id: <7f64521b89f47c3d00de6d89dcee4e71812d643c.1428411004.git.jslaby@suse.cz> X-Mailer: git-send-email 2.3.4 In-Reply-To: <9a548862b8a26cbccc14f2c6c9c3688813d8d14b.1428411003.git.jslaby@suse.cz> References: <9a548862b8a26cbccc14f2c6c9c3688813d8d14b.1428411003.git.jslaby@suse.cz> In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Andy Lutomirski 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit ff7e0055bb5ddbbb320cdd8dfd3e18672bddd2ad upstream. The commit 4982223e51e8 module: set nx before marking module MODULE_STATE_COMING. introduced a regression: if a module fails to parse its arguments or if mod_sysfs_setup fails, then the module's memory will be freed while still read-only. Anything that reuses that memory will crash as soon as it tries to write to it. Cc: stable@vger.kernel.org # v3.16 Cc: Rusty Russell Signed-off-by: Andy Lutomirski Signed-off-by: Rusty Russell Signed-off-by: Jiri Slaby --- kernel/module.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/module.c b/kernel/module.c index 3edb91fabc7a..a97785308f25 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -3332,6 +3332,11 @@ static int load_module(struct load_info *info, const char __user *uargs, mutex_lock(&module_mutex); module_bug_cleanup(mod); mutex_unlock(&module_mutex); + + /* we can't deallocate the module until we clear memory protection */ + unset_module_init_ro_nx(mod); + unset_module_core_ro_nx(mod); + ddebug_cleanup: dynamic_debug_remove(info->debug); synchronize_sched(); -- 2.3.4