lkml.org 
[lkml]   [2018]   [Jan]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 37/89] x86/intel_rdt/cqm: Prevent use after free
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Thomas Gleixner <tglx@linutronix.de>

    commit d47924417319e3b6a728c0b690f183e75bc2a702 upstream.

    intel_rdt_iffline_cpu() -> domain_remove_cpu() frees memory first and then
    proceeds accessing it.

    BUG: KASAN: use-after-free in find_first_bit+0x1f/0x80
    Read of size 8 at addr ffff883ff7c1e780 by task cpuhp/31/195
    find_first_bit+0x1f/0x80
    has_busy_rmid+0x47/0x70
    intel_rdt_offline_cpu+0x4b4/0x510

    Freed by task 195:
    kfree+0x94/0x1a0
    intel_rdt_offline_cpu+0x17d/0x510

    Do the teardown first and then free memory.

    Fixes: 24247aeeabe9 ("x86/intel_rdt/cqm: Improve limbo list processing")
    Reported-by: Joseph Salisbury <joseph.salisbury@canonical.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ravi Shankar <ravi.v.shankar@intel.com>
    Cc: Peter Zilstra <peterz@infradead.org>
    Cc: Stephane Eranian <eranian@google.com>
    Cc: Vikas Shivappa <vikas.shivappa@linux.intel.com>
    Cc: Andi Kleen <ak@linux.intel.com>
    Cc: "Roderick W. Smith" <rod.smith@canonical.com>
    Cc: 1733662@bugs.launchpad.net
    Cc: Fenghua Yu <fenghua.yu@intel.com>
    Cc: Tony Luck <tony.luck@intel.com>
    Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1801161957510.2366@nanos
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/x86/kernel/cpu/intel_rdt.c | 8 ++++----
    1 file changed, 4 insertions(+), 4 deletions(-)

    --- a/arch/x86/kernel/cpu/intel_rdt.c
    +++ b/arch/x86/kernel/cpu/intel_rdt.c
    @@ -525,10 +525,6 @@ static void domain_remove_cpu(int cpu, s
    */
    if (static_branch_unlikely(&rdt_mon_enable_key))
    rmdir_mondata_subdir_allrdtgrp(r, d->id);
    - kfree(d->ctrl_val);
    - kfree(d->rmid_busy_llc);
    - kfree(d->mbm_total);
    - kfree(d->mbm_local);
    list_del(&d->list);
    if (is_mbm_enabled())
    cancel_delayed_work(&d->mbm_over);
    @@ -545,6 +541,10 @@ static void domain_remove_cpu(int cpu, s
    cancel_delayed_work(&d->cqm_limbo);
    }

    + kfree(d->ctrl_val);
    + kfree(d->rmid_busy_llc);
    + kfree(d->mbm_total);
    + kfree(d->mbm_local);
    kfree(d);
    return;
    }

    \
     
     \ /
      Last update: 2018-01-22 10:12    [W:4.036 / U:0.660 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site