diff options
| author | Thomas Gleixner <[email protected]> | 2018-01-16 19:59:59 +0100 |
|---|---|---|
| committer | Thomas Gleixner <[email protected]> | 2018-01-17 11:56:47 +0100 |
| commit | d47924417319e3b6a728c0b690f183e75bc2a702 (patch) | |
| tree | 89ee808f14ffb67f1adb34ee65b1478c343757c7 | |
| parent | 107cd2532181b96c549e8f224cdcca8631c3076b (diff) | |
x86/intel_rdt/cqm: Prevent use after free
intel_rdt_iffline_cpu() -> domain_remove_cpu() frees memory first and then
proceeds accessing it.
BUG: KASAN: use-after-free in find_first_bit+0x1f/0x80
Read of size 8 at addr ffff883ff7c1e780 by task cpuhp/31/195
find_first_bit+0x1f/0x80
has_busy_rmid+0x47/0x70
intel_rdt_offline_cpu+0x4b4/0x510
Freed by task 195:
kfree+0x94/0x1a0
intel_rdt_offline_cpu+0x17d/0x510
Do the teardown first and then free memory.
Fixes: 24247aeeabe9 ("x86/intel_rdt/cqm: Improve limbo list processing")
Reported-by: Joseph Salisbury <[email protected]>
Signed-off-by: Thomas Gleixner <[email protected]>
Cc: Ravi Shankar <[email protected]>
Cc: Peter Zilstra <[email protected]>
Cc: Stephane Eranian <[email protected]>
Cc: Vikas Shivappa <[email protected]>
Cc: Andi Kleen <[email protected]>
Cc: "Roderick W. Smith" <[email protected]>
Cc: [email protected]
Cc: Fenghua Yu <[email protected]>
Cc: Tony Luck <[email protected]>
Cc: [email protected]
Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1801161957510.2366@nanos
| -rw-r--r-- | arch/x86/kernel/cpu/intel_rdt.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c index 88dcf8479013..99442370de40 100644 --- a/arch/x86/kernel/cpu/intel_rdt.c +++ b/arch/x86/kernel/cpu/intel_rdt.c @@ -525,10 +525,6 @@ static void domain_remove_cpu(int cpu, struct rdt_resource *r) */ if (static_branch_unlikely(&rdt_mon_enable_key)) rmdir_mondata_subdir_allrdtgrp(r, d->id); - kfree(d->ctrl_val); - kfree(d->rmid_busy_llc); - kfree(d->mbm_total); - kfree(d->mbm_local); list_del(&d->list); if (is_mbm_enabled()) cancel_delayed_work(&d->mbm_over); @@ -545,6 +541,10 @@ static void domain_remove_cpu(int cpu, struct rdt_resource *r) cancel_delayed_work(&d->cqm_limbo); } + kfree(d->ctrl_val); + kfree(d->rmid_busy_llc); + kfree(d->mbm_total); + kfree(d->mbm_local); kfree(d); return; } |