* [PATCH v3 1/3] riscv: Fix module loading free order
2024-01-04 19:42 [PATCH v3 0/3] riscv: modules: Fix module loading error handling Charlie Jenkins
@ 2024-01-04 19:42 ` Charlie Jenkins
2024-01-04 19:42 ` [PATCH v3 2/3] riscv: Correctly free relocation hashtable on error Charlie Jenkins
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Charlie Jenkins @ 2024-01-04 19:42 UTC (permalink / raw)
To: Paul Walmsley, Palmer Dabbelt, Albert Ou
Cc: Palmer Dabbelt, linux-riscv, linux-kernel, Charlie Jenkins,
kernel test robot, Dan Carpenter, Julia Lawall
Reverse order of kfree calls to resolve use-after-free error.
Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
Fixes: d8792a5734b0 ("riscv: Safely remove entries from relocation list")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202312132019.iYGTwW0L-lkp@intel.com/
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@inria.fr>
Closes: https://lore.kernel.org/r/202312120044.wTI1Uyaa-lkp@intel.com/
---
arch/riscv/kernel/module.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
index aac019ed63b1..21c7a773a8ef 100644
--- a/arch/riscv/kernel/module.c
+++ b/arch/riscv/kernel/module.c
@@ -723,8 +723,8 @@ static int add_relocation_to_accumulate(struct module *me, int type,
if (!bucket) {
kfree(entry);
- kfree(rel_head);
kfree(rel_head->rel_entry);
+ kfree(rel_head);
return -ENOMEM;
}
--
2.43.0
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v3 2/3] riscv: Correctly free relocation hashtable on error
2024-01-04 19:42 [PATCH v3 0/3] riscv: modules: Fix module loading error handling Charlie Jenkins
2024-01-04 19:42 ` [PATCH v3 1/3] riscv: Fix module loading free order Charlie Jenkins
@ 2024-01-04 19:42 ` Charlie Jenkins
2024-01-04 19:42 ` [PATCH v3 3/3] riscv: Fix relocation_hashtable size Charlie Jenkins
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Charlie Jenkins @ 2024-01-04 19:42 UTC (permalink / raw)
To: Paul Walmsley, Palmer Dabbelt, Albert Ou
Cc: Palmer Dabbelt, linux-riscv, linux-kernel, Charlie Jenkins,
kernel test robot, Dan Carpenter, Julia Lawall
When there is not enough allocatable memory for the relocation
hashtable, module loading should exit gracefully. Previously, this was
attempted to be accomplished by checking if an unsigned number is less
than zero which does not work. Instead have the caller check if the
hashtable was correctly allocated and add a comment explaining that
hashtable_bits that is 0 is valid.
Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
Fixes: d8792a5734b0 ("riscv: Safely remove entries from relocation list")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202312132019.iYGTwW0L-lkp@intel.com/
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@inria.fr>
Closes: https://lore.kernel.org/r/202312120044.wTI1Uyaa-lkp@intel.com/
---
arch/riscv/kernel/module.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
index 21c7a773a8ef..32743180e8ef 100644
--- a/arch/riscv/kernel/module.c
+++ b/arch/riscv/kernel/module.c
@@ -747,6 +747,10 @@ initialize_relocation_hashtable(unsigned int num_relocations,
{
/* Can safely assume that bits is not greater than sizeof(long) */
unsigned long hashtable_size = roundup_pow_of_two(num_relocations);
+ /*
+ * When hashtable_size == 1, hashtable_bits == 0.
+ * This is valid because the hashing algorithm returns 0 in this case.
+ */
unsigned int hashtable_bits = ilog2(hashtable_size);
/*
@@ -763,7 +767,7 @@ initialize_relocation_hashtable(unsigned int num_relocations,
sizeof(*relocation_hashtable),
GFP_KERNEL);
if (!*relocation_hashtable)
- return -ENOMEM;
+ return 0;
__hash_init(*relocation_hashtable, hashtable_size);
@@ -789,8 +793,8 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
hashtable_bits = initialize_relocation_hashtable(num_relocations,
&relocation_hashtable);
- if (hashtable_bits < 0)
- return hashtable_bits;
+ if (!relocation_hashtable)
+ return -ENOMEM;
INIT_LIST_HEAD(&used_buckets_list);
--
2.43.0
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH v3 3/3] riscv: Fix relocation_hashtable size
2024-01-04 19:42 [PATCH v3 0/3] riscv: modules: Fix module loading error handling Charlie Jenkins
2024-01-04 19:42 ` [PATCH v3 1/3] riscv: Fix module loading free order Charlie Jenkins
2024-01-04 19:42 ` [PATCH v3 2/3] riscv: Correctly free relocation hashtable on error Charlie Jenkins
@ 2024-01-04 19:42 ` Charlie Jenkins
2024-01-05 7:38 ` [PATCH v3 0/3] riscv: modules: Fix module loading error handling Dan Carpenter
2024-01-11 14:50 ` patchwork-bot+linux-riscv
4 siblings, 0 replies; 6+ messages in thread
From: Charlie Jenkins @ 2024-01-04 19:42 UTC (permalink / raw)
To: Paul Walmsley, Palmer Dabbelt, Albert Ou
Cc: Palmer Dabbelt, linux-riscv, linux-kernel, Charlie Jenkins,
kernel test robot, Julia Lawall
A second dereference is needed to get the accurate size of the
relocation_hashtable.
Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
Fixes: d8792a5734b0 ("riscv: Safely remove entries from relocation list")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@inria.fr>
Closes: https://lore.kernel.org/r/202312120044.wTI1Uyaa-lkp@intel.com/
---
arch/riscv/kernel/module.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
index 32743180e8ef..ceb0adb38715 100644
--- a/arch/riscv/kernel/module.c
+++ b/arch/riscv/kernel/module.c
@@ -764,7 +764,7 @@ initialize_relocation_hashtable(unsigned int num_relocations,
hashtable_size <<= should_double_size;
*relocation_hashtable = kmalloc_array(hashtable_size,
- sizeof(*relocation_hashtable),
+ sizeof(**relocation_hashtable),
GFP_KERNEL);
if (!*relocation_hashtable)
return 0;
--
2.43.0
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v3 0/3] riscv: modules: Fix module loading error handling
2024-01-04 19:42 [PATCH v3 0/3] riscv: modules: Fix module loading error handling Charlie Jenkins
` (2 preceding siblings ...)
2024-01-04 19:42 ` [PATCH v3 3/3] riscv: Fix relocation_hashtable size Charlie Jenkins
@ 2024-01-05 7:38 ` Dan Carpenter
2024-01-11 14:50 ` patchwork-bot+linux-riscv
4 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2024-01-05 7:38 UTC (permalink / raw)
To: Charlie Jenkins
Cc: Paul Walmsley, Palmer Dabbelt, Albert Ou, Palmer Dabbelt,
linux-riscv, linux-kernel, kernel test robot, Dan Carpenter,
Julia Lawall
On Thu, Jan 04, 2024 at 11:42:46AM -0800, Charlie Jenkins wrote:
> When modules are loaded while there is not ample allocatable memory,
> there was previously not proper error handling. This series fixes a
> use-after-free error and a different issue that caused a non graceful
> exit after memory was not properly allocated.
>
> Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
Thanks!
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
regards,
dan carpenter
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v3 0/3] riscv: modules: Fix module loading error handling
2024-01-04 19:42 [PATCH v3 0/3] riscv: modules: Fix module loading error handling Charlie Jenkins
` (3 preceding siblings ...)
2024-01-05 7:38 ` [PATCH v3 0/3] riscv: modules: Fix module loading error handling Dan Carpenter
@ 2024-01-11 14:50 ` patchwork-bot+linux-riscv
4 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+linux-riscv @ 2024-01-11 14:50 UTC (permalink / raw)
To: Charlie Jenkins
Cc: linux-riscv, paul.walmsley, palmer, aou, palmer, linux-kernel,
lkp, error27, julia.lawall, dan.carpenter
Hello:
This series was applied to riscv/linux.git (for-next)
by Palmer Dabbelt <palmer@rivosinc.com>:
On Thu, 04 Jan 2024 11:42:46 -0800 you wrote:
> When modules are loaded while there is not ample allocatable memory,
> there was previously not proper error handling. This series fixes a
> use-after-free error and a different issue that caused a non graceful
> exit after memory was not properly allocated.
>
> Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
>
> [...]
Here is the summary with links:
- [v3,1/3] riscv: Fix module loading free order
https://git.kernel.org/riscv/c/78996eee79eb
- [v3,2/3] riscv: Correctly free relocation hashtable on error
https://git.kernel.org/riscv/c/4b38b36bfbd8
- [v3,3/3] riscv: Fix relocation_hashtable size
https://git.kernel.org/riscv/c/a35551c7244d
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
^ permalink raw reply [flat|nested] 6+ messages in thread