diff options
| author | Rusty Russell <rusty@rustcorp.com.au> | 2010-08-05 12:59:08 -0600 |
|---|---|---|
| committer | Rusty Russell <rusty@rustcorp.com.au> | 2010-08-05 12:59:08 +0930 |
| commit | 511ca6ae43fbe0a7c9e0b50ad275f7ef24ef3b58 (patch) | |
| tree | 596d11de1a99dfce758465de009a97ccdb7da011 /kernel/module.c | |
| parent | eded41c1c6466081e0eb00d38719c6e6ee81a5d4 (diff) | |
| download | linux-511ca6ae43fbe0a7c9e0b50ad275f7ef24ef3b58.tar.gz linux-511ca6ae43fbe0a7c9e0b50ad275f7ef24ef3b58.tar.bz2 linux-511ca6ae43fbe0a7c9e0b50ad275f7ef24ef3b58.zip | |
module: fix crash in get_ksymbol() when oopsing in module init
Andrew had the sole pleasure of tickling this bug in linux-next; when we set
up "info->strtab" it's pointing into the temporary copy of the module. For
most uses that is fine, but kallsyms keeps a pointer around during module
load (inside mod->strtab).
If we oops for some reason inside a module's init function, kallsyms will use
the mod->strtab pointer into the now-freed temporary module copy.
(Later oopses work fine: after init we overwrite mod->strtab to point to a
compacted core-only strtab).
Reported-by: Andrew "Grumpy" Morton <akpm@linux-foundation.org>
Signed-off-by: Rusty "Buggy" Russell <rusty@rustcorp.com.au>
Tested-by: Andrew "Happy" Morton <akpm@linux-foundation.org>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Diffstat (limited to 'kernel/module.c')
| -rw-r--r-- | kernel/module.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/module.c b/kernel/module.c index 79c4d6f69dd7..60cdd0459eac 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2045,7 +2045,8 @@ static void add_kallsyms(struct module *mod, struct load_info *info, mod->symtab = (void *)symsec->sh_addr; mod->num_symtab = symsec->sh_size / sizeof(Elf_Sym); - mod->strtab = info->strtab; + /* Make sure we get permanent strtab: don't use info->strtab. */ + mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr; /* Set types up while we still have access to sections. */ for (i = 0; i < mod->num_symtab; i++) |