6.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Pavlu petr.pavlu@suse.com
[ Upstream commit ca3881f6fd8e9b6eb2d51e8718d07d3b8029d886 ]
The function move_module() uses the variable t to track how many memory types it has allocated and consequently how many should be freed if an error occurs.
The variable is initially set to 0 and is updated when a call to module_memory_alloc() fails. However, move_module() can fail for other reasons as well, in which case t remains set to 0 and no memory is freed.
Fix the problem by initializing t to MOD_MEM_NUM_TYPES. Additionally, make the deallocation loop more robust by not relying on the mod_mem_type_t enum having a signed integer as its underlying type.
Fixes: c7ee8aebf6c0 ("module: add stop-grap sanity check on module memcpy()") Signed-off-by: Petr Pavlu petr.pavlu@suse.com Reviewed-by: Sami Tolvanen samitolvanen@google.com Reviewed-by: Daniel Gomez da.gomez@samsung.com Link: https://lore.kernel.org/r/20250618122730.51324-2-petr.pavlu@suse.com Signed-off-by: Daniel Gomez da.gomez@samsung.com Message-ID: 20250618122730.51324-2-petr.pavlu@suse.com Signed-off-by: Sasha Levin sashal@kernel.org --- kernel/module/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/module/main.c b/kernel/module/main.c index 9861c2ac5fd50..9d8a845d94665 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -2615,7 +2615,7 @@ static int find_module_sections(struct module *mod, struct load_info *info) static int move_module(struct module *mod, struct load_info *info) { int i; - enum mod_mem_type t = 0; + enum mod_mem_type t = MOD_MEM_NUM_TYPES; int ret = -ENOMEM; bool codetag_section_found = false;
@@ -2694,7 +2694,7 @@ static int move_module(struct module *mod, struct load_info *info) return 0; out_err: module_memory_restore_rox(mod); - for (t--; t >= 0; t--) + while (t--) module_memory_free(mod, t); if (codetag_section_found) codetag_free_module_sections(mod);