1 files changed, 22 insertions, 5 deletions

diff --git a/kernel/module.c b/kernel/module.c
index d8f8ab271c2b..650b038ae520 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1865,7 +1865,7 @@ static void free_module(struct module *mod)
         kfree(mod->args);
         percpu_modfree(mod);
 
-        /* Free lock-classes: */
+        /* Free lock-classes; relies on the preceding sync_rcu(). */
         lockdep_free_key_range(mod->module_core, mod->core_size);
 
         /* Finally, free the core (containing the module structure) */
@@ -2479,6 +2479,23 @@ static int elf_header_check(struct load_info *info)
         return 0;
 }
 
+#define COPY_CHUNK_SIZE (16*PAGE_SIZE)
+
+static int copy_chunked_from_user(void *dst, const void __user *usrc, unsigned long len)
+{
+        do {
+                unsigned long n = min(len, COPY_CHUNK_SIZE);
+
+                if (copy_from_user(dst, usrc, n) != 0)
+                        return -EFAULT;
+                cond_resched();
+                dst += n;
+                usrc += n;
+                len -= n;
+        } while (len);
+        return 0;
+}
+
 /* Sets info->hdr and info->len. */
 static int copy_module_from_user(const void __user *umod, unsigned long len,
                                   struct load_info *info)
@@ -2498,7 +2515,7 @@ static int copy_module_from_user(const void __user *umod, unsigned long len,
         if (!info->hdr)
                 return -ENOMEM;
 
-        if (copy_from_user(info->hdr, umod, info->len) != 0) {
+        if (copy_chunked_from_user(info->hdr, umod, info->len) != 0) {
                 vfree(info->hdr);
                 return -EFAULT;
         }
@@ -3352,9 +3369,6 @@ static int load_module(struct load_info *info, const char __user *uargs,
         module_bug_cleanup(mod);
         mutex_unlock(&module_mutex);
 
-        /* Free lock-classes: */
-        lockdep_free_key_range(mod->module_core, mod->core_size);
-
         /* we can't deallocate the module until we clear memory protection */
         unset_module_init_ro_nx(mod);
         unset_module_core_ro_nx(mod);
@@ -3378,6 +3392,9 @@ static int load_module(struct load_info *info, const char __user *uargs,
         synchronize_rcu();
         mutex_unlock(&module_mutex);
  free_module:
+        /* Free lock-classes; relies on the preceding sync_rcu() */
+        lockdep_free_key_range(mod->module_core, mod->core_size);
+
         module_deallocate(mod, info);
  free_copy:
         free_copy(info);