B Horn 500e5fdd82 kern/dl: Fix for an integer overflow in grub_dl_ref()
It was possible to overflow the value of mod->ref_count, a signed
integer, by repeatedly invoking insmod on an already loaded module.
This led to a use-after-free. As once ref_count was overflowed it became
possible to unload the module while there was still references to it.

This resolves the issue by using grub_add() to check if the ref_count
will overflow and then stops further increments. Further changes were
also made to grub_dl_unref() to check for the underflow condition and
the reference count was changed to an unsigned 64-bit integer.

Reported-by: B Horn <b@horn.uk>
Signed-off-by: B Horn <b@horn.uk>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
2025-02-13 15:45:55 +01:00
..
2022-03-14 16:01:26 +01:00
2022-03-14 16:01:26 +01:00
2022-03-14 16:01:26 +01:00
2016-10-27 16:22:06 +02:00
2018-03-05 13:44:55 +01:00
2017-08-07 18:33:29 +02:00
2012-02-26 19:10:52 +01:00
2019-06-07 15:37:55 +02:00
2022-03-14 16:01:26 +01:00
2021-03-02 15:54:15 +01:00
2019-09-23 13:17:15 +02:00
2020-12-18 23:04:36 +01:00
2022-03-14 16:01:26 +01:00
2011-10-01 22:51:12 +02:00
2013-12-17 14:45:46 +01:00
2017-05-08 22:06:04 +02:00
2025-01-23 16:22:47 +01:00
2021-03-02 15:54:15 +01:00
2022-11-14 20:24:39 +01:00
2010-08-17 19:03:22 +05:30
2022-03-14 16:01:26 +01:00
2021-03-02 15:54:15 +01:00
2015-12-15 10:25:34 +03:00
2012-03-04 14:55:13 +01:00
2024-10-11 14:35:54 +02:00
2023-01-19 17:39:04 +01:00
2023-05-25 16:47:59 +02:00
2010-08-17 19:03:22 +05:30
2016-02-12 12:39:38 +01:00
2010-09-24 14:05:47 +02:00
2023-06-23 00:50:38 +02:00
2010-08-17 19:03:22 +05:30
2013-12-18 05:28:05 +01:00
2022-03-14 16:01:26 +01:00
2011-11-30 16:20:13 +01:00
2022-03-14 16:01:26 +01:00
2022-03-14 16:01:26 +01:00
2022-03-14 16:01:26 +01:00