On 7/4/23 15:37, Linus Torvalds wrote:
On Tue, 4 Jul 2023 at 03:09, Vegard Nossum <vegard.nossum@xxxxxxxxxx> wrote:
Commit 9b9879fc0327 added a hashtable storing lists of concurrent module
loads. However, it didn't fix up all the error paths in
init_module_from_file(); this would lead to leaving the function while an
on-stack 'struct idempotent' element is still in the hash table, which
leads to all sorts of badness as spotted by syzkaller:
You are of course 100% right.
However, I'd rather just use a wrapper function and make this thing
much clearer. Like I should have done originally.
So I'd be inclined towards a patch like the attached instead. Works for you?
Harshit tells me there's still a crash... and indeed, with your wrapped
version we call file_inode() on a NULL pointer before checking the
fdget() return value.
It's likely you already changed this with the f_mode changes I commented
on, so maybe it's no longer a problem, though.
Vegard
