[Devel] [PATCH rh7] kernel/kmod: fix out-of-bounds access in call_modprobe()

Andrey Ryabinin aryabinin at odin.com
Tue Aug 11 09:07:34 PDT 2015


Commit 18f83b2460e2 ("ve/kmod: Port autoloading from CT") extended
argv array for one more element, however it wasn't extended
on allocation site.

https://jira.sw.ru/browse/PSBM-38666

Fixes: 18f83b2460e2 ("ve/kmod: Port autoloading from CT")
Signed-off-by: Andrey Ryabinin <aryabinin at odin.com>
Cc: Konstantin Khorenko <khorenko at virtuozzo.com>
Cc: Kirill Tkhai <ktkhai at odin.com>
---
 kernel/kmod.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/kmod.c b/kernel/kmod.c
index e0554f8..aa5cb99 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -91,7 +91,7 @@ static int call_modprobe(char *module_name, int wait, int blacklist)
 		NULL
 	};
 
-	char **argv = kmalloc(sizeof(char *[5]), GFP_KERNEL);
+	char **argv = kmalloc(sizeof(char *[6]), GFP_KERNEL);
 	if (!argv)
 		goto out;
 
-- 
2.4.6




More information about the Devel mailing list