module: fix reference to mod->percpu after freeing module. (293a7cfe) · Commits · 戴 / test

Rafael sees a sometimes crash at precpu_modfree from kernel/module.c; it only occurred with another (since-reverted) patch, but that patch simply changed timing to uncover this bug, it was otherwise unrelated. The comment about the mod being freed is self-explanatory, but neither Tejun nor I read it. This bug was introduced in , after it had previously been fixed in . How embarrassing. Reported-by:

"Rafael J. Wysocki" <rjw@sisk.pl> Signed-off-by:

Rusty Russell <rusty@rustcorp.com.au> Embarrassingly-Acked-by:

Tejun Heo <tj@kernel.org> Cc: Masami Hiramatsu <mhiramat@redhat.com> Tested-by:

"Rafael J. Wysocki" <rjw@sisk.pl> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

kernel/module.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -2014,6 +2014,7 @@ static noinline struct module load_module(void __user umod,
		long err = 0;
		void ptr = NULL; / Stops spurious gcc warning */
		unsigned long symoffs, stroffs, *strmap;
		void __percpu *percpu;

		mm_segment_t old_fs;

		@@ -2158,6 +2159,8 @@ static noinline struct module load_module(void __user umod,
		goto free_mod;
		sechdrs[pcpuindex].sh_flags &= ~(unsigned long)SHF_ALLOC;
		}
		/* Keep this around for failure path. */
		percpu = mod_percpu(mod);

		/* Determine total sizes, and put offsets in sh_entsize. For now
		this is done generically; there doesn't appear to be any
		@@ -2463,7 +2466,7 @@ static noinline struct module load_module(void __user umod,
		module_free(mod, mod->module_core);
		/* mod will be freed with core. Don't access it beyond this line! */
		free_percpu:
		percpu_modfree(mod);
		free_percpu(percpu);
		free_mod:
		kfree(args);
		kfree(strmap);

Admin message