Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751014AbdL3VWM (ORCPT ); Sat, 30 Dec 2017 16:22:12 -0500 Received: from Galois.linutronix.de ([146.0.238.70]:35222 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750895AbdL3VWK (ORCPT ); Sat, 30 Dec 2017 16:22:10 -0500 Message-Id: <20171230211829.508293470@linutronix.de> User-Agent: quilt/0.63-1 Date: Sat, 30 Dec 2017 22:13:52 +0100 From: Thomas Gleixner To: LKML Cc: Linus Torvalds , x86@kernel.org, Andy Lutomirski , Dave Hansen , Peter Zijlstra , Borislav Petkov , Dominik Brodowski , Mathieu Desnoyers Subject: [patch 1/3] x86/ldt: Free the right LDT memory in write_ldt() error path References: <20171230211351.980176980@linutronix.de> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Disposition: inline; filename=x86-ldt--Free-the-right-thing-in-error-path.patch Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 694 Lines: 22 The error path in write_ldt() frees the already installed LDT memory instead of the newly allocated which cannot be installed. Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on") Reported-by: Mathieu Desnoyers Signed-off-by: Thomas Gleixner --- arch/x86/kernel/ldt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/kernel/ldt.c +++ b/arch/x86/kernel/ldt.c @@ -421,7 +421,7 @@ static int write_ldt(void __user *ptr, u */ error = map_ldt_struct(mm, new_ldt, old_ldt ? !old_ldt->slot : 0); if (error) { - free_ldt_struct(old_ldt); + free_ldt_struct(new_ldt); goto out_unlock; }