1 files changed, 34 insertions, 9 deletions

diff --git a/arch/mips/kernel/module.c b/arch/mips/kernel/module.c
index a5066b1c3de3..4f8c3cba8c0c 100644
--- a/arch/mips/kernel/module.c
+++ b/arch/mips/kernel/module.c
@@ -39,8 +39,6 @@ struct mips_hi16 {
         Elf_Addr value;
 };
 
-static struct mips_hi16 *mips_hi16_list;
-
 static LIST_HEAD(dbe_list);
 static DEFINE_SPINLOCK(dbe_lock);
 
@@ -128,8 +126,8 @@ static int apply_r_mips_hi16_rel(struct module *me, u32 *location, Elf_Addr v)
 
         n->addr = (Elf_Addr *)location;
         n->value = v;
-        n->next = mips_hi16_list;
-        mips_hi16_list = n;
+        n->next = me->arch.r_mips_hi16_list;
+        me->arch.r_mips_hi16_list = n;
 
         return 0;
 }
@@ -142,18 +140,28 @@ static int apply_r_mips_hi16_rela(struct module *me, u32 *location, Elf_Addr v)
         return 0;
 }
 
+static void free_relocation_chain(struct mips_hi16 *l)
+{
+        struct mips_hi16 *next;
+
+        while (l) {
+                next = l->next;
+                kfree(l);
+                l = next;
+        }
+}
+
 static int apply_r_mips_lo16_rel(struct module *me, u32 *location, Elf_Addr v)
 {
         unsigned long insnlo = *location;
+        struct mips_hi16 *l;
         Elf_Addr val, vallo;
 
         /* Sign extend the addend we extract from the lo insn.  */
         vallo = ((insnlo & 0xffff) ^ 0x8000) - 0x8000;
 
-        if (mips_hi16_list != NULL) {
-                struct mips_hi16 *l;
-
-                l = mips_hi16_list;
+        if (me->arch.r_mips_hi16_list != NULL) {
+                l = me->arch.r_mips_hi16_list;
                 while (l != NULL) {
                         struct mips_hi16 *next;
                         unsigned long insn;
@@ -188,7 +196,7 @@ static int apply_r_mips_lo16_rel(struct module *me, u32 *location, Elf_Addr v)
                         l = next;
                 }
 
-                mips_hi16_list = NULL;
+                me->arch.r_mips_hi16_list = NULL;
         }
 
         /*
@@ -201,6 +209,9 @@ static int apply_r_mips_lo16_rel(struct module *me, u32 *location, Elf_Addr v)
         return 0;
 
 out_danger:
+        free_relocation_chain(l);
+        me->arch.r_mips_hi16_list = NULL;
+
         pr_err("module %s: dangerous R_MIPS_LO16 REL relocation\n", me->name);
 
         return -ENOEXEC;
@@ -273,6 +284,7 @@ int apply_relocate(Elf_Shdr *sechdrs, const char *strtab,
         pr_debug("Applying relocate section %u to %u\n", relsec,
                sechdrs[relsec].sh_info);
 
+        me->arch.r_mips_hi16_list = NULL;
         for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
                 /* This is where to make the change */
                 location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
@@ -296,6 +308,19 @@ int apply_relocate(Elf_Shdr *sechdrs, const char *strtab,
                         return res;
         }
 
+        /*
+         * Normally the hi16 list should be deallocated at this point.  A
+         * malformed binary however could contain a series of R_MIPS_HI16
+         * relocations not followed by a R_MIPS_LO16 relocation.  In that
+         * case, free up the list and return an error.
+         */
+        if (me->arch.r_mips_hi16_list) {
+                free_relocation_chain(me->arch.r_mips_hi16_list);
+                me->arch.r_mips_hi16_list = NULL;
+
+                return -ENOEXEC;
+        }
+
         return 0;
 }