mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 09:36:22 +02:00
786d2d8441
module_extend_max_pages() calls kvrealloc() internally and returns
-ENOMEM on allocation failure. The return value is never checked.
If the initial allocation fails, info->pages remains NULL and
info->max_pages remains 0. Subsequent calls to module_get_next_page()
will attempt to dynamically grow the array by calling
module_extend_max_pages(info, 0) since info->used_pages is 0. This
results in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated
as a success, leading to a dereference of ZERO_SIZE_PTR and a kernel
oops.
Fix: add the missing error check after module_extend_max_pages() and
return immediately on failure. This matches the pattern used by every
other kvrealloc() caller in the module loading path.
Fixes:
|
||
|---|---|---|
| .. | ||
| debug_kmemleak.c | ||
| decompress.c | ||
| dups.c | ||
| internal.h | ||
| kallsyms.c | ||
| Kconfig | ||
| kdb.c | ||
| kmod.c | ||
| livepatch.c | ||
| main.c | ||
| Makefile | ||
| procfs.c | ||
| signing.c | ||
| stats.c | ||
| strict_rwx.c | ||
| sysfs.c | ||
| tracking.c | ||
| tree_lookup.c | ||
| version.c | ||