Commit 1177dcc9 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'modules-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux

Pull module fix from Luis Chamberlain:
 "Only one fix has trickled through. Harshit Mogalapalli found a
  use-after-free bug through static analysis with smatch"

* tag 'modules-6.4-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux:
  module: Fix use-after-free bug in read_file_mod_stats()
parents 421ca22e d36f6efb
...@@ -276,6 +276,7 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf, ...@@ -276,6 +276,7 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf,
struct mod_fail_load *mod_fail; struct mod_fail_load *mod_fail;
unsigned int len, size, count_failed = 0; unsigned int len, size, count_failed = 0;
char *buf; char *buf;
int ret;
u32 live_mod_count, fkreads, fdecompress, fbecoming, floads; u32 live_mod_count, fkreads, fdecompress, fbecoming, floads;
unsigned long total_size, text_size, ikread_bytes, ibecoming_bytes, unsigned long total_size, text_size, ikread_bytes, ibecoming_bytes,
idecompress_bytes, imod_bytes, total_virtual_lost; idecompress_bytes, imod_bytes, total_virtual_lost;
...@@ -390,8 +391,9 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf, ...@@ -390,8 +391,9 @@ static ssize_t read_file_mod_stats(struct file *file, char __user *user_buf,
out_unlock: out_unlock:
mutex_unlock(&module_mutex); mutex_unlock(&module_mutex);
out: out:
ret = simple_read_from_buffer(user_buf, count, ppos, buf, len);
kfree(buf); kfree(buf);
return simple_read_from_buffer(user_buf, count, ppos, buf, len); return ret;
} }
#undef MAX_PREAMBLE #undef MAX_PREAMBLE
#undef MAX_FAILED_MOD_PRINT #undef MAX_FAILED_MOD_PRINT
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment