summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPetr Pavlu <petr.pavlu@suse.com>2025-06-18 14:26:26 +0200
committerDaniel Gomez <da.gomez@samsung.com>2025-07-08 20:52:29 +0200
commitca3881f6fd8e9b6eb2d51e8718d07d3b8029d886 (patch)
treea65408f73d82a8ecac4d7fe09c67f72fe57176e0
parentd7b8f8e20813f0179d8ef519541a3527e7661d3a (diff)
module: Fix memory deallocation on error path in move_module()
The function move_module() uses the variable t to track how many memory types it has allocated and consequently how many should be freed if an error occurs. The variable is initially set to 0 and is updated when a call to module_memory_alloc() fails. However, move_module() can fail for other reasons as well, in which case t remains set to 0 and no memory is freed. Fix the problem by initializing t to MOD_MEM_NUM_TYPES. Additionally, make the deallocation loop more robust by not relying on the mod_mem_type_t enum having a signed integer as its underlying type. Fixes: c7ee8aebf6c0 ("module: add stop-grap sanity check on module memcpy()") Signed-off-by: Petr Pavlu <petr.pavlu@suse.com> Reviewed-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Daniel Gomez <da.gomez@samsung.com> Link: https://lore.kernel.org/r/20250618122730.51324-2-petr.pavlu@suse.com Signed-off-by: Daniel Gomez <da.gomez@samsung.com> Message-ID: <20250618122730.51324-2-petr.pavlu@suse.com>
-rw-r--r--kernel/module/main.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/kernel/module/main.c b/kernel/module/main.c
index 413ac6ea3702..9ac994b2f354 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -2697,7 +2697,7 @@ static int find_module_sections(struct module *mod, struct load_info *info)
static int move_module(struct module *mod, struct load_info *info)
{
int i;
- enum mod_mem_type t = 0;
+ enum mod_mem_type t = MOD_MEM_NUM_TYPES;
int ret = -ENOMEM;
bool codetag_section_found = false;
@@ -2776,7 +2776,7 @@ static int move_module(struct module *mod, struct load_info *info)
return 0;
out_err:
module_memory_restore_rox(mod);
- for (t--; t >= 0; t--)
+ while (t--)
module_memory_free(mod, t);
if (codetag_section_found)
codetag_free_module_sections(mod);