On Sun, Jun 08, 2025 at 09:25:34AM +0200, Petr Pavlu wrote:
> On 6/7/25 6:16 PM, Petr Pavlu wrote:
> > The function move_module() uses the variable t to track how many memory
> > types it has allocated and consequently how many should be freed if an
> > error occurs.
> >
> > The variable is initially set to 0 and is updated when a call to
> > module_memory_alloc() fails. However, move_module() can fail for other
> > reasons as well, in which case t remains set to 0 and no memory is freed.
> >
> > Fix the problem by setting t to MOD_MEM_NUM_TYPES after all memory types
> > have been allocated. Additionally, make the deallocation loop more robust
> > by not relying on the mod_mem_type_t enum having a signed integer as its
> > underlying type.
> >
> > Fixes: c7ee8aebf6c0 ("module: add stop-grap sanity check on module
> > memcpy()")
> > Signed-off-by: Petr Pavlu <petr.pa...@suse.com>
> > ---
> > kernel/module/main.c | 7 ++++---
> > 1 file changed, 4 insertions(+), 3 deletions(-)
> >
> > diff --git a/kernel/module/main.c b/kernel/module/main.c
> > index 08b59c37735e..322b38c0a782 100644
> > --- a/kernel/module/main.c
> > +++ b/kernel/module/main.c
> > [...]
> > pr_debug("Final section addresses for %s:\n", mod->name);
> > @@ -2693,8 +2694,8 @@ static int move_module(struct module *mod, struct
> > load_info *info)
> > return 0;
> > out_err:
> > module_memory_restore_rox(mod);
> > - for (t--; t >= 0; t--)
> > - module_memory_free(mod, t);
> > + for (; t > 0; t--)
> > + module_memory_free(mod, t - 1);
> > if (codetag_section_found)
> > codetag_free_module_sections(mod);
> >
>
> This can actually be simply:
>
> while (t--)
> module_memory_free(mod, t);
Looks correct to me either way.
Reviewed-by: Sami Tolvanen <samitolva...@google.com>
Sami
