lkml.org 
[lkml]   [2011]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[34-longterm 180/260] x86, irq: Plug memory leak in sparse irq
    Date
    From: Thomas Gleixner <tglx@linutronix.de>

    commit 1cf180c94e9166cda083ff65333883ab3648e852 upstream.

    free_irq_cfg() is not freeing the cpumask_vars in irq_cfg. Fixing this
    triggers a use after free caused by the fact that copying struct
    irq_cfg is done with memcpy, which copies the pointer not the cpumask.

    Fix both places.

    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Yinghai Lu <yhlu.kernel@gmail.com>
    LKML-Reference: <alpine.LFD.2.00.1009282052570.2416@localhost6.localdomain6>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    ---
    arch/x86/kernel/apic/io_apic.c | 11 ++++++++---
    1 files changed, 8 insertions(+), 3 deletions(-)

    diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
    index abb136a..469d45a 100644
    --- a/arch/x86/kernel/apic/io_apic.c
    +++ b/arch/x86/kernel/apic/io_apic.c
    @@ -303,14 +303,19 @@ void arch_init_copy_chip_data(struct irq_desc *old_desc,

    old_cfg = old_desc->chip_data;

    - memcpy(cfg, old_cfg, sizeof(struct irq_cfg));
    + cfg->vector = old_cfg->vector;
    + cfg->move_in_progress = old_cfg->move_in_progress;
    + cpumask_copy(cfg->domain, old_cfg->domain);
    + cpumask_copy(cfg->old_domain, old_cfg->old_domain);

    init_copy_irq_2_pin(old_cfg, cfg, node);
    }

    -static void free_irq_cfg(struct irq_cfg *old_cfg)
    +static void free_irq_cfg(struct irq_cfg *cfg)
    {
    - kfree(old_cfg);
    + free_cpumask_var(cfg->domain);
    + free_cpumask_var(cfg->old_domain);
    + kfree(cfg);
    }

    void arch_free_chip_data(struct irq_desc *old_desc, struct irq_desc *desc)
    --
    1.7.3.3


    \
     
     \ /
      Last update: 2011-01-02 08:31    [W:2.458 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site