The klp-build generated livepatch module allocates the patch structure,
the array of objects, and the per-object arrays of functions with
kzalloc() in livepatch_mod_init().
The result of klp_enable_patch() is returned directly. It bypasses
the err_free_objs cleanup path when the call fails. As a result, all the
allocated structures leak.
Save the return value and go into the error path on failure.
The per-object arrays of functions must be freed in the shared
err_free_objs path as well. The cleanup loop in the funcs allocation
failure path is removed instead. Otherwise, it would cause a double
free when the new error path jumps into the shared cleanup.
Fixes: 59adee07b568 ("livepatch/klp-build: Add stub init code for livepatch
modules")
Reported-by: sashiko-bot <[email protected]>
Closes: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Yafang Shao <[email protected]>
---
scripts/livepatch/init.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
---
It is based on tip's objtool/urgent branch.
diff --git a/scripts/livepatch/init.c b/scripts/livepatch/init.c
index 16aff8f..a1f6993 100644
--- a/scripts/livepatch/init.c
+++ b/scripts/livepatch/init.c
@@ -50,8 +50,6 @@ static int __init livepatch_mod_init(void)
funcs = kzalloc(sizeof(struct klp_func) * (nr_funcs + 1),
GFP_KERNEL);
if (!funcs) {
ret = -ENOMEM;
- for (int j = 0; j < i; j++)
- kfree(objs[j].funcs);
goto err_free_objs;
}
@@ -78,9 +76,14 @@ static int __init livepatch_mod_init(void)
patch->replace = true;
#endif
- return klp_enable_patch(patch);
+ ret = klp_enable_patch(patch);
+ if (ret)
+ goto err_free_objs;
+ return 0;
err_free_objs:
+ for (int i = 0; i < nr_objs; i++)
+ kfree(objs[i].funcs);
kfree(objs);
err_free_patch:
kfree(patch);
--
1.8.3.1
