• Rusty Russell's avatar
    [PATCH] Fix module load failure case · 2c435ad4
    Rusty Russell authored
    Milton Miller noticed a free-after-use problem in the cleanup path of a
    failed module load.
    
    The problem is that mod is moved to point from the sucked-in file
    (always freed last) to the module core, after which time the
    "free(mod->core), reference mod->percpu" sequence is bogus, eg.  when
    the module_init function fails.
    
    This is fixed by keeping the pointer in a local variable, which solves
    the problem. We no longer need to reference the free'd data structure.
    2c435ad4
module.c 47.7 KB