B Horn 500e5fdd82 kern/dl: Fix for an integer overflow in grub_dl_ref()
It was possible to overflow the value of mod->ref_count, a signed
integer, by repeatedly invoking insmod on an already loaded module.
This led to a use-after-free. As once ref_count was overflowed it became
possible to unload the module while there was still references to it.

This resolves the issue by using grub_add() to check if the ref_count
will overflow and then stops further increments. Further changes were
also made to grub_dl_unref() to check for the underflow condition and
the reference count was changed to an unsigned 64-bit integer.

Reported-by: B Horn <b@horn.uk>
Signed-off-by: B Horn <b@horn.uk>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
2025-02-13 15:45:55 +01:00
..
2013-12-21 03:03:31 +01:00
2022-03-14 15:44:26 +01:00
2022-03-14 15:44:26 +01:00
2021-03-02 15:54:15 +01:00
2015-01-24 20:52:02 +01:00
2022-03-14 15:44:26 +01:00
2022-03-14 15:44:26 +01:00
2022-03-14 15:44:26 +01:00
2015-12-15 10:25:34 +03:00
2022-03-14 15:44:26 +01:00
2022-03-14 15:44:26 +01:00
2023-07-03 14:10:01 +02:00
2012-02-12 15:25:25 +01:00