Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752568AbeAQLEZ (ORCPT + 1 other); Wed, 17 Jan 2018 06:04:25 -0500 Received: from terminus.zytor.com ([65.50.211.136]:60833 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750830AbeAQLEX (ORCPT ); Wed, 17 Jan 2018 06:04:23 -0500 Date: Wed, 17 Jan 2018 03:00:53 -0800 From: tip-bot for Thomas Gleixner Message-ID: Cc: joseph.salisbury@canonical.com, rod.smith@canonical.com, mingo@kernel.org, eranian@google.com, peterz@infradead.org, hpa@zytor.com, ak@linux.intel.com, tony.luck@intel.com, vikas.shivappa@linux.intel.com, ravi.v.shankar@intel.com, tglx@linutronix.de, linux-kernel@vger.kernel.org, fenghua.yu@intel.com Reply-To: vikas.shivappa@linux.intel.com, tglx@linutronix.de, ravi.v.shankar@intel.com, fenghua.yu@intel.com, linux-kernel@vger.kernel.org, hpa@zytor.com, ak@linux.intel.com, tony.luck@intel.com, rod.smith@canonical.com, mingo@kernel.org, peterz@infradead.org, eranian@google.com, joseph.salisbury@canonical.com In-Reply-To: References: To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/urgent] x86/intel_rdt/cqm: Prevent use after free Git-Commit-ID: d47924417319e3b6a728c0b690f183e75bc2a702 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: Commit-ID: d47924417319e3b6a728c0b690f183e75bc2a702 Gitweb: https://git.kernel.org/tip/d47924417319e3b6a728c0b690f183e75bc2a702 Author: Thomas Gleixner AuthorDate: Tue, 16 Jan 2018 19:59:59 +0100 Committer: Thomas Gleixner CommitDate: Wed, 17 Jan 2018 11:56:47 +0100 x86/intel_rdt/cqm: Prevent use after free intel_rdt_iffline_cpu() -> domain_remove_cpu() frees memory first and then proceeds accessing it. BUG: KASAN: use-after-free in find_first_bit+0x1f/0x80 Read of size 8 at addr ffff883ff7c1e780 by task cpuhp/31/195 find_first_bit+0x1f/0x80 has_busy_rmid+0x47/0x70 intel_rdt_offline_cpu+0x4b4/0x510 Freed by task 195: kfree+0x94/0x1a0 intel_rdt_offline_cpu+0x17d/0x510 Do the teardown first and then free memory. Fixes: 24247aeeabe9 ("x86/intel_rdt/cqm: Improve limbo list processing") Reported-by: Joseph Salisbury Signed-off-by: Thomas Gleixner Cc: Ravi Shankar Cc: Peter Zilstra Cc: Stephane Eranian Cc: Vikas Shivappa Cc: Andi Kleen Cc: "Roderick W. Smith" Cc: 1733662@bugs.launchpad.net Cc: Fenghua Yu Cc: Tony Luck Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1801161957510.2366@nanos --- arch/x86/kernel/cpu/intel_rdt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c index 88dcf84..9944237 100644 --- a/arch/x86/kernel/cpu/intel_rdt.c +++ b/arch/x86/kernel/cpu/intel_rdt.c @@ -525,10 +525,6 @@ static void domain_remove_cpu(int cpu, struct rdt_resource *r) */ if (static_branch_unlikely(&rdt_mon_enable_key)) rmdir_mondata_subdir_allrdtgrp(r, d->id); - kfree(d->ctrl_val); - kfree(d->rmid_busy_llc); - kfree(d->mbm_total); - kfree(d->mbm_local); list_del(&d->list); if (is_mbm_enabled()) cancel_delayed_work(&d->mbm_over); @@ -545,6 +541,10 @@ static void domain_remove_cpu(int cpu, struct rdt_resource *r) cancel_delayed_work(&d->cqm_limbo); } + kfree(d->ctrl_val); + kfree(d->rmid_busy_llc); + kfree(d->mbm_total); + kfree(d->mbm_local); kfree(d); return; }