module: Fix memory deallocation on error path in move_module()

BugLink: https://bugs.launchpad.net/bugs/2123745

[ Upstream commit ca3881f6fd8e9b6eb2d51e8718d07d3b8029d886 ]

The function move_module() uses the variable t to track how many memory
types it has allocated and consequently how many should be freed if an
error occurs.

The variable is initially set to 0 and is updated when a call to
module_memory_alloc() fails. However, move_module() can fail for other
reasons as well, in which case t remains set to 0 and no memory is freed.

Fix the problem by initializing t to MOD_MEM_NUM_TYPES. Additionally, make
the deallocation loop more robust by not relying on the mod_mem_type_t enum
having a signed integer as its underlying type.

Fixes: c7ee8ae ("module: add stop-grap sanity check on module memcpy()")
Signed-off-by: Petr Pavlu <[email protected]>
Reviewed-by: Sami Tolvanen <[email protected]>
Reviewed-by: Daniel Gomez <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Daniel Gomez <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
[nwager: Context change due to missing commit:
c287c0723329 ("module: switch to execmem API for remapping as RW and restoring ROX")]
Signed-off-by: Noah Wager <[email protected]>
Signed-off-by: Edoardo Canepa <[email protected]>

Author: petrpavlu

kernel/module/main.c

@@ -2635,7 +2635,7 @@ static int find_module_sections(struct module *mod, struct load_info *info)
 static int move_module(struct module *mod, struct load_info *info)
 {
 	int i;
-	enum mod_mem_type t = 0;
+	enum mod_mem_type t = MOD_MEM_NUM_TYPES;
 	int ret = -ENOMEM;
 	bool codetag_section_found = false;
 
@@ -2717,7 +2717,7 @@ static int move_module(struct module *mod, struct load_info *info)
 
 	return 0;
 out_err:
-	for (t--; t >= 0; t--)
+	while (t--)
 		module_memory_free(mod, t);
 	if (codetag_section_found)
 		codetag_free_module_sections(mod);