[PATCH] kexec: fix allocation problems in function kimage_normal_alloc

[Zhang Yanfei]

The function kimage_normal_alloc() has 2 allocation problems that may cause
failures:

  1. If kimage_normal_alloc() fails to initialize an allocated kimage, it will
     free the image but would still set 'rimage', as a result kexec_load will
     try to free it again.

     This would explode as part of the freeing process is accessing internal
     members which point to uninitialized memory.

  2. If kimage_normal_alloc() fails to alloc pages for image->swap_page, it
     should call kimage_free_page_list() to free allocated pages in
     image->control_pages list before it frees image.

Signed-off-by: Sasha Levin <sasha.levin@xxxxxxxxxx>
Signed-off-by: Zhang Yanfei <zhangyanfei@xxxxxxxxxxxxxx>
---
 kernel/kexec.c |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/kernel/kexec.c b/kernel/kexec.c
index 5e4bd78..f219357 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -223,6 +223,8 @@ out:
 
 }
 
+static void kimage_free_page_list(struct list_head *list);
+
 static int kimage_normal_alloc(struct kimage **rimage, unsigned long entry,
 				unsigned long nr_segments,
 				struct kexec_segment __user *segments)
@@ -236,8 +238,6 @@ static int kimage_normal_alloc(struct kimage **rimage, unsigned long entry,
 	if (result)
 		goto out;
 
-	*rimage = image;
-
 	/*
 	 * Find a location for the control code buffer, and add it
 	 * the vector of segments so that it's pages will also be
@@ -259,10 +259,12 @@ static int kimage_normal_alloc(struct kimage **rimage, unsigned long entry,
 
 	result = 0;
  out:
-	if (result == 0)
+	if (result == 0) {
 		*rimage = image;
-	else
+	} else {
+		kimage_free_page_list(&image->control_pages);
 		kfree(image);
+	}
 
 	return result;
 }
-- 
1.7.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/