diff options
author | Jason Baron <jbaron@redhat.com> | 2010-10-01 23:23:41 +0200 |
---|---|---|
committer | Steven Rostedt <rostedt@goodmis.org> | 2010-10-28 15:17:02 +0200 |
commit | b842f8faf6c7dc2005c6a70631c1a91bac02f180 (patch) | |
tree | fa4c5ed7136be2e39b728173fcae2385b119bcef /net | |
parent | Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/asy... (diff) | |
download | linux-b842f8faf6c7dc2005c6a70631c1a91bac02f180.tar.xz linux-b842f8faf6c7dc2005c6a70631c1a91bac02f180.zip |
jump label: Fix module __init section race
Jump label uses is_module_text_address() to ensure that the module
__init sections are valid before updating them. However, between the
check for a valid module __init section and the subsequent jump
label update, the module's __init section could be freed out from under
us.
We fix this potential race by adding a notifier callback to the
MODULE_STATE_LIVE state. This notifier is called *after* the __init
section has been run but before it is going to be freed. In the
callback, the jump label code zeros the key value for any __init jump
code within the module, and we add a check for a non-zero key value when
we update jump labels. In this way we require no additional data
structures.
Thanks to Mathieu Desnoyers for pointing out this race condition.
Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: Jason Baron <jbaron@redhat.com>
LKML-Reference: <c6f037b7598777668025ceedd9294212fd95fa34.1285965957.git.jbaron@redhat.com>
[ Renamed remove_module_init() to remove_jump_label_module_init()
as suggested by Masami Hiramatsu. ]
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Diffstat (limited to 'net')
0 files changed, 0 insertions, 0 deletions