lkml.org 
[lkml]   [2018]   [Jan]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 143/146] x86/ldt: Plug memory leak in error path
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Thomas Gleixner <tglx@linutronix.de>

    commit a62d69857aab4caa43049e72fe0ed5c4a60518dd upstream.

    The error path in write_ldt() tries to free 'old_ldt' instead of the newly
    allocated 'new_ldt', resulting in a memory leak. It also misses to clean up a
    half populated LDT pagetable, which is not a leak as it gets cleaned up
    when the process exits.

    Free both the potentially half populated LDT pagetable and the newly
    allocated LDT struct. This can be done unconditionally because once an LDT
    is mapped subsequent maps will succeed, because the PTE page is already
    populated and the two LDTs fit into that single page.

    Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Dominik Brodowski <linux@dominikbrodowski.net>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Linus Torvalds <torvalds@linuxfoundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on")
    Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1712311121340.1899@nanos
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/x86/kernel/ldt.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    --- a/arch/x86/kernel/ldt.c
    +++ b/arch/x86/kernel/ldt.c
    @@ -421,7 +421,13 @@ static int write_ldt(void __user *ptr, u
    */
    error = map_ldt_struct(mm, new_ldt, old_ldt ? !old_ldt->slot : 0);
    if (error) {
    - free_ldt_struct(old_ldt);
    + /*
    + * This only can fail for the first LDT setup. If an LDT is
    + * already installed then the PTE page is already
    + * populated. Mop up a half populated page table.
    + */
    + free_ldt_pgtables(mm);
    + free_ldt_struct(new_ldt);
    goto out_unlock;
    }


    \
     
     \ /
      Last update: 2018-01-01 15:50    [W:4.073 / U:0.608 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site