diff options
author | Borislav Petkov <bp@suse.de> | 2020-02-04 13:28:41 +0100 |
---|---|---|
committer | Borislav Petkov <bp@suse.de> | 2020-02-13 18:58:39 +0100 |
commit | 6e5cf31fbe651bed7ba1df768f2e123531132417 (patch) | |
tree | 71adfc2e4f338edc3cfbf90a0b724a387d72d8fa /drivers/usb/cdns3/debug.h | |
parent | bb6d3fb354c5ee8d6bde2d576eb7220ea09862b9 (diff) |
x86/mce/amd: Publish the bank pointer only after setup has succeeded
threshold_create_bank() creates a bank descriptor per MCA error
thresholding counter which can be controlled over sysfs. It publishes
the pointer to that bank in a per-CPU variable and then goes on to
create additional thresholding blocks if the bank has such.
However, that creation of additional blocks in
allocate_threshold_blocks() can fail, leading to a use-after-free
through the per-CPU pointer.
Therefore, publish that pointer only after all blocks have been setup
successfully.
Fixes: 019f34fccfd5 ("x86, MCE, AMD: Move shared bank to node descriptor")
Reported-by: Saar Amar <Saar.Amar@microsoft.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200128140846.phctkvx5btiexvbx@kili.mountain
Diffstat (limited to 'drivers/usb/cdns3/debug.h')
0 files changed, 0 insertions, 0 deletions