diff options
| author | Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> | 2023-04-28 07:59:33 +0200 |
|---|---|---|
| committer | Luis Chamberlain <mcgrof@kernel.org> | 2023-05-22 23:13:13 +0200 |
| commit | d36f6efbe0cb422fe1e4475717d75f3737088832 (patch) | |
| tree | 1ab07fc5ff08142fb69becd47de6d6006548c712 /kernel | |
| parent | Linux 6.4-rc3 (diff) | |
| download | linux-d36f6efbe0cb422fe1e4475717d75f3737088832.tar.xz linux-d36f6efbe0cb422fe1e4475717d75f3737088832.zip | |
module: Fix use-after-free bug in read_file_mod_stats()
Smatch warns:
kernel/module/stats.c:394 read_file_mod_stats()
warn: passing freed memory 'buf'
We are passing 'buf' to simple_read_from_buffer() after freeing it.
Fix this by changing the order of 'simple_read_from_buffer' and 'kfree'.
Fixes: df3e764d8e5c ("module: add debug stats to help identify memory pressure")
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/module/stats.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/kernel/module/stats.c b/kernel/module/stats.c index ad7b6ada29f2..6ab2c94d6bc3 100644 --- a/kernel/module/stats.c +++ b/kernel/module/stats.c @@ -276,6 +276,7 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf, struct mod_fail_load *mod_fail; unsigned int len, size, count_failed = 0; char *buf; + int ret; u32 live_mod_count, fkreads, fdecompress, fbecoming, floads; unsigned long total_size, text_size, ikread_bytes, ibecoming_bytes, idecompress_bytes, imod_bytes, total_virtual_lost; @@ -390,8 +391,9 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf, out_unlock: mutex_unlock(&module_mutex); out: + ret = simple_read_from_buffer(user_buf, count, ppos, buf, len); kfree(buf); - return simple_read_from_buffer(user_buf, count, ppos, buf, len); + return ret; } #undef MAX_PREAMBLE #undef MAX_FAILED_MOD_PRINT |