Messages in this thread | | | Date | Wed, 23 Mar 2016 18:33:56 +0100 | From | Borislav Petkov <> | Subject | Re: [PATCH] x86/mce: Avoid using object after free in genpool. |
| |
On Wed, Mar 23, 2016 at 09:14:40AM -0700, Tony Luck wrote: > When we loop over all queued machine check error records to pass > them to the registered notifiers we use llist_for_each_entry(). > But the loop calls gen_pool_free() for the entry in the body of > the loop - and then the iterator looks at node->next after the > free. > > Use llist_for_each_entry_safe() instead. > > Cc: stable@vger.kernel.org > Signed-off-by: Tony Luck <tony.luck@intel.com> > --- > arch/x86/kernel/cpu/mcheck/mce-genpool.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kernel/cpu/mcheck/mce-genpool.c b/arch/x86/kernel/cpu/mcheck/mce-genpool.c > index 0a850100c594..2658e2af74ec 100644 > --- a/arch/x86/kernel/cpu/mcheck/mce-genpool.c > +++ b/arch/x86/kernel/cpu/mcheck/mce-genpool.c > @@ -29,7 +29,7 @@ static char gen_pool_buf[MCE_POOLSZ]; > void mce_gen_pool_process(void) > { > struct llist_node *head; > - struct mce_evt_llist *node; > + struct mce_evt_llist *node, *tmp; > struct mce *mce; > > head = llist_del_all(&mce_event_llist); > @@ -37,7 +37,7 @@ void mce_gen_pool_process(void) > return; > > head = llist_reverse_order(head); > - llist_for_each_entry(node, head, llnode) { > + llist_for_each_entry_safe(node, tmp, head, llnode) { > mce = &node->mce; > atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, mce); > gen_pool_free(mce_evt_pool, (unsigned long)node, sizeof(*node)); > --
Acked-by: Borislav Petkov <bp@suse.de>
I have a couple more RAS patches for tip, want me to pick that one up too? I'm going to send my pile to tip guys after -rc1 is out.
-- Regards/Gruss, Boris.
ECO tip #101: Trim your mails when you reply.
| |