Messages in this thread Patch in this message | | | Date | Sat, 30 Dec 2017 22:13:52 +0100 | From | Thomas Gleixner <> | Subject | [patch 1/3] x86/ldt: Free the right LDT memory in write_ldt() error path |
| |
The error path in write_ldt() frees the already installed LDT memory instead of the newly allocated which cannot be installed.
Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on") Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> --- arch/x86/kernel/ldt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/ldt.c +++ b/arch/x86/kernel/ldt.c @@ -421,7 +421,7 @@ static int write_ldt(void __user *ptr, u */ error = map_ldt_struct(mm, new_ldt, old_ldt ? !old_ldt->slot : 0); if (error) { - free_ldt_struct(old_ldt); + free_ldt_struct(new_ldt); goto out_unlock; }
| |