From: Andrew Morton <akpm@linux-foundation.org>
To: akpm@linux-foundation.org, brauner@kernel.org,
ebiederm@xmission.com, keescook@chromium.org, linux-mm@kvack.org,
mcgrof@kernel.org, mm-commits@vger.kernel.org,
torvalds@linux-foundation.org, yzaikin@google.com,
ztong0001@gmail.com
Subject: [patch 2/7] binfmt_misc: fix crash when load/unload module
Date: Fri, 28 Jan 2022 18:14:17 -0800 [thread overview]
Message-ID: <20220129021417.-McVoYDIW%akpm@linux-foundation.org> (raw)
In-Reply-To: <20220128181341.2103de95948608a65958ae40@linux-foundation.org>
From: Tong Zhang <ztong0001@gmail.com>
Subject: binfmt_misc: fix crash when load/unload module
We should unregister the table upon module unload otherwise something
horrible will happen when we load binfmt_misc module again. Also note
that we should keep value returned by register_sysctl_mount_point() and
release it later, otherwise it will leak.
Also, per Christian's comment, to fully restore the old behavior that
won't break userspace the check(binfmt_misc_header) should be eliminated.
reproduce:
modprobe binfmt_misc
modprobe -r binfmt_misc
modprobe binfmt_misc
modprobe -r binfmt_misc
modprobe binfmt_misc
[ 18.032038] Call Trace:
[ 18.032108] <TASK>
[ 18.032169] dump_stack_lvl+0x34/0x44
[ 18.032273] __register_sysctl_table+0x6f4/0x720
[ 18.032397] ? preempt_count_sub+0xf/0xb0
[ 18.032508] ? 0xffffffffc0040000
[ 18.032600] init_misc_binfmt+0x2d/0x1000 [binfmt_misc]
[ 18.042520] binfmt_misc: Failed to create fs/binfmt_misc sysctl mount point
modprobe: can't load module binfmt_misc (kernel/fs/binfmt_misc.ko): Cannot allocate memory
[ 18.063549] binfmt_misc: Failed to create fs/binfmt_misc sysctl mount point
[ 18.204779] BUG: unable to handle page fault for address: fffffbfff8004802
Link: https://lkml.kernel.org/r/20220124181812.1869535-2-ztong0001@gmail.com
Fixes: 3ba442d5331f ("fs: move binfmt_misc sysctl to its own file")
Signed-off-by: Tong Zhang <ztong0001@gmail.com>
Co-developed-by: Christian Brauner<brauner@kernel.org>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Iurii Zaikin <yzaikin@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
fs/binfmt_misc.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/binfmt_misc.c~binfmt_misc-fix-crash-when-load-unload-module
+++ a/fs/binfmt_misc.c
@@ -817,20 +817,20 @@ static struct file_system_type bm_fs_typ
};
MODULE_ALIAS_FS("binfmt_misc");
+static struct ctl_table_header *binfmt_misc_header;
+
static int __init init_misc_binfmt(void)
{
int err = register_filesystem(&bm_fs_type);
if (!err)
insert_binfmt(&misc_format);
- if (!register_sysctl_mount_point("fs/binfmt_misc")) {
- pr_warn("Failed to create fs/binfmt_misc sysctl mount point");
- return -ENOMEM;
- }
+ binfmt_misc_header = register_sysctl_mount_point("fs/binfmt_misc");
return 0;
}
static void __exit exit_misc_binfmt(void)
{
+ unregister_sysctl_table(binfmt_misc_header);
unregister_binfmt(&misc_format);
unregister_filesystem(&bm_fs_type);
}
_
next prev parent reply other threads:[~2022-01-29 2:14 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-29 2:13 incoming Andrew Morton
2022-01-29 2:14 ` [patch 1/7] include/linux/sysctl.h: fix register_sysctl_mount_point() return type Andrew Morton
2022-01-29 2:14 ` Andrew Morton [this message]
2022-01-29 2:14 ` [patch 3/7] memory-failure: fetch compound_head after pgmap_pfn_valid() Andrew Morton
2022-01-29 2:14 ` [patch 4/7] tools/testing/scatterlist: add missing defines Andrew Morton
2022-01-29 2:14 ` [patch 5/7] mm, kasan: use compare-exchange operation to set KASAN page tag Andrew Morton
2022-01-29 2:14 ` [patch 6/7] psi: fix "defined but not used" warnings when CONFIG_PROC_FS=n Andrew Morton
2022-01-29 2:14 ` [patch 7/7] ocfs2: fix a deadlock when commit trans Andrew Morton
2022-01-29 4:25 ` incoming Matthew Wilcox
2022-01-29 6:23 ` incoming Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220129021417.-McVoYDIW%akpm@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=brauner@kernel.org \
--cc=ebiederm@xmission.com \
--cc=keescook@chromium.org \
--cc=linux-mm@kvack.org \
--cc=mcgrof@kernel.org \
--cc=mm-commits@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=yzaikin@google.com \
--cc=ztong0001@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.