| Message ID | 20230428055933.2699308-1-harshit.m.mogalapalli@oracle.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | module: Fix use-after-free bug in read_file_mod_stats() | expand |
Hi, On 28/04/23 11:29 am, Harshit Mogalapalli wrote: > Smatch warns: > kernel/module/stats.c:394 read_file_mod_stats() > warn: passing freed memory 'buf' > > We are passing 'buf' to simple_read_from_buffer() after freeing it. > > Fix this by changing the order of 'simple_read_from_buffer' and 'kfree'. > Friendly reminder to review this patch. Thanks, Harshit > Fixes: df3e764d8e5c ("module: add debug stats to help identify memory pressure") > Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> > --- > Found with statis analysis, only compile tested. > --- > kernel/module/stats.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/kernel/module/stats.c b/kernel/module/stats.c > index ad7b6ada29f2..6ab2c94d6bc3 100644 > --- a/kernel/module/stats.c > +++ b/kernel/module/stats.c > @@ -276,6 +276,7 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf, > struct mod_fail_load *mod_fail; > unsigned int len, size, count_failed = 0; > char *buf; > + int ret; > u32 live_mod_count, fkreads, fdecompress, fbecoming, floads; > unsigned long total_size, text_size, ikread_bytes, ibecoming_bytes, > idecompress_bytes, imod_bytes, total_virtual_lost; > @@ -390,8 +391,9 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf, > out_unlock: > mutex_unlock(&module_mutex); > out: > + ret = simple_read_from_buffer(user_buf, count, ppos, buf, len); > kfree(buf); > - return simple_read_from_buffer(user_buf, count, ppos, buf, len); > + return ret; > } > #undef MAX_PREAMBLE > #undef MAX_FAILED_MOD_PRINT
On Thu, Apr 27, 2023 at 10:59:33PM -0700, Harshit Mogalapalli wrote: > Smatch warns: > kernel/module/stats.c:394 read_file_mod_stats() > warn: passing freed memory 'buf' > > We are passing 'buf' to simple_read_from_buffer() after freeing it. > > Fix this by changing the order of 'simple_read_from_buffer' and 'kfree'. > > Fixes: df3e764d8e5c ("module: add debug stats to help identify memory pressure") > Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> > --- Queued up, thanks! Luis
diff --git a/kernel/module/stats.c b/kernel/module/stats.c index ad7b6ada29f2..6ab2c94d6bc3 100644 --- a/kernel/module/stats.c +++ b/kernel/module/stats.c @@ -276,6 +276,7 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf, struct mod_fail_load *mod_fail; unsigned int len, size, count_failed = 0; char *buf; + int ret; u32 live_mod_count, fkreads, fdecompress, fbecoming, floads; unsigned long total_size, text_size, ikread_bytes, ibecoming_bytes, idecompress_bytes, imod_bytes, total_virtual_lost; @@ -390,8 +391,9 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf, out_unlock: mutex_unlock(&module_mutex); out: + ret = simple_read_from_buffer(user_buf, count, ppos, buf, len); kfree(buf); - return simple_read_from_buffer(user_buf, count, ppos, buf, len); + return ret; } #undef MAX_PREAMBLE #undef MAX_FAILED_MOD_PRINT
Smatch warns: kernel/module/stats.c:394 read_file_mod_stats() warn: passing freed memory 'buf' We are passing 'buf' to simple_read_from_buffer() after freeing it. Fix this by changing the order of 'simple_read_from_buffer' and 'kfree'. Fixes: df3e764d8e5c ("module: add debug stats to help identify memory pressure") Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> --- Found with statis analysis, only compile tested. --- kernel/module/stats.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)