Messages in this thread | | | Date | Sat, 30 Dec 2017 22:33:37 +0100 | From | Ingo Molnar <> | Subject | Re: [patch 1/3] x86/ldt: Free the right LDT memory in write_ldt() error path |
| |
* Thomas Gleixner <tglx@linutronix.de> wrote:
> The error path in write_ldt() frees the already installed LDT memory > instead of the newly allocated which cannot be installed.
s/newly allocated /newly allocated one
> > Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on") > Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> > Signed-off-by: Thomas Gleixner <tglx@linutronix.de> > --- > arch/x86/kernel/ldt.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > --- a/arch/x86/kernel/ldt.c > +++ b/arch/x86/kernel/ldt.c > @@ -421,7 +421,7 @@ static int write_ldt(void __user *ptr, u > */ > error = map_ldt_struct(mm, new_ldt, old_ldt ? !old_ldt->slot : 0); > if (error) { > - free_ldt_struct(old_ldt); > + free_ldt_struct(new_ldt); > goto out_unlock; > } >
This bug kind of scares me ...
Reviewed-by: Ingo Molnar <mingo@kernel.org>
Thanks,
Ingo
| |