Andrii KuchmenkoandGreg Kroah-Hartman e7f174715f module: decompress: check return value of module_extend_max_pages() ...

commit 786d2d8441 upstream.

module_extend_max_pages() calls kvrealloc() internally and returns
-ENOMEM on allocation failure. The return value is never checked.

If the initial allocation fails, info->pages remains NULL and
info->max_pages remains 0. Subsequent calls to module_get_next_page()
will attempt to dynamically grow the array by calling
module_extend_max_pages(info, 0) since info->used_pages is 0. This
results in kvrealloc(NULL, 0) returning ZERO_SIZE_PTR, which is treated
as a success, leading to a dereference of ZERO_SIZE_PTR and a kernel
oops.

Fix: add the missing error check after module_extend_max_pages() and
return immediately on failure. This matches the pattern used by every
other kvrealloc() caller in the module loading path.

Fixes: b1ae6dc41e ("module: add in-kernel support for decompressing")
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Andrii Kuchmenko <capyenglishlite@gmail.com>
Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
[Sami: Corrected the analysis in the commit message.]
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-07-24 15:54:29 +02:00

..

debug_kmemleak.c

…

decompress.c

module: decompress: check return value of module_extend_max_pages()

2026-07-24 15:54:29 +02:00

internal.h

…

kallsyms.c

module: add helper function for reading module_buildid()

2026-03-04 07:19:40 -05:00

Kconfig

module: sign with sha512 instead of sha1 by default

2025-05-02 07:46:49 +02:00

kdb.c

…

livepatch.c

…

main.c

module: Fix freeing of charp module parameters when CONFIG_SYSFS=n

2026-06-01 17:39:06 +02:00

Makefile

…

procfs.c

…

signing.c

…

strict_rwx.c

…

sysfs.c

…

tracking.c

…

tree_lookup.c

…

version.c

…