From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-by2nam03on0135.outbound.protection.outlook.com ([104.47.42.135]:16544 "EHLO NAM03-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1756196AbeDIAbN (ORCPT ); Sun, 8 Apr 2018 20:31:13 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Paul Burton , "linux-mips@linux-mips.org" , Ralf Baechle , Sasha Levin Subject: [PATCH AUTOSEL for 4.9 159/293] MIPS: module: Ensure we always clean up r_mips_hi16_list Date: Mon, 9 Apr 2018 00:24:57 +0000 Message-ID: <20180409002239.163177-159-alexander.levin@microsoft.com> References: <20180409002239.163177-1-alexander.levin@microsoft.com> In-Reply-To: <20180409002239.163177-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Paul Burton [ Upstream commit 351b0940d473146923711bc943fc881354a4c1f3 ] If we hit an error whilst processing a reloc then we would return early from apply_relocate & potentially not free entries in r_mips_hi16_list, thereby leaking memory. Fix this by ensuring that we always run the code to free r_mipps_hi16_list when errors occur. Signed-off-by: Paul Burton Fixes: 861667dc82f5 ("MIPS: Fix race condition in module relocation code.") Fixes: 04211a574641 ("MIPS: Bail on unsupported module relocs") Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/15831/ Signed-off-by: Ralf Baechle Signed-off-by: Sasha Levin --- arch/mips/kernel/module.c | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/arch/mips/kernel/module.c b/arch/mips/kernel/module.c index 94627a3a6a0d..ddcfb59593b6 100644 --- a/arch/mips/kernel/module.c +++ b/arch/mips/kernel/module.c @@ -251,7 +251,7 @@ int apply_relocate(Elf_Shdr *sechdrs, const char *strta= b, u32 *location; unsigned int i, type; Elf_Addr v; - int res; + int err =3D 0; =20 pr_debug("Applying relocate section %u to %u\n", relsec, sechdrs[relsec].sh_info); @@ -270,7 +270,8 @@ int apply_relocate(Elf_Shdr *sechdrs, const char *strta= b, continue; pr_warn("%s: Unknown symbol %s\n", me->name, strtab + sym->st_name); - return -ENOENT; + err =3D -ENOENT; + goto out; } =20 type =3D ELF_MIPS_R_TYPE(rel[i]); @@ -283,29 +284,32 @@ int apply_relocate(Elf_Shdr *sechdrs, const char *str= tab, if (!handler) { pr_err("%s: Unknown relocation type %u\n", me->name, type); - return -EINVAL; + err =3D -EINVAL; + goto out; } =20 v =3D sym->st_value; - res =3D handler(me, location, v); - if (res) - return res; + err =3D handler(me, location, v); + if (err) + goto out; } =20 +out: /* - * Normally the hi16 list should be deallocated at this point. A + * Normally the hi16 list should be deallocated at this point. A * malformed binary however could contain a series of R_MIPS_HI16 - * relocations not followed by a R_MIPS_LO16 relocation. In that - * case, free up the list and return an error. + * relocations not followed by a R_MIPS_LO16 relocation, or if we hit + * an error processing a reloc we might have gotten here before + * reaching the R_MIPS_LO16. In either case, free up the list and + * return an error. */ if (me->arch.r_mips_hi16_list) { free_relocation_chain(me->arch.r_mips_hi16_list); me->arch.r_mips_hi16_list =3D NULL; - - return -ENOEXEC; + err =3D err ?: -ENOEXEC; } =20 - return 0; + return err; } =20 /* Given an address, look for it in the module exception tables. */ --=20 2.15.1