From: John Garry <john.garry@huawei.com>
To: Robert Richter <rrichter@marvell.com>
Cc: Borislav Petkov <bp@alien8.de>,
Mauro Carvalho Chehab <mchehab@kernel.org>,
James Morse <james.morse@arm.com>,
"tony.luck@intel.com" <tony.luck@intel.com>,
"linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
wanghuiqiang <wanghuiqiang@huawei.com>,
Xiaofei Tan <tanxiaofei@huawei.com>,
Linuxarm <linuxarm@huawei.com>,
"Huangming (Mark)" <huangming23@huawei.com>
Subject: Re: linuxnext-2019127 edac warns (was Re: edac KASAN warning in experimental arm64 allmodconfig boot)
Date: Mon, 2 Dec 2019 10:23:29 +0000 [thread overview]
Message-ID: <49bb86d8-a7ad-e66d-9796-799ee0bdd605@huawei.com> (raw)
In-Reply-To: <20191128211240.yuuhf4xkzhl2jvfw@rric.localdomain>
On 28/11/2019 21:12, Robert Richter wrote:
> On 27.11.19 17:07:33, John Garry wrote:
>> [ 22.104498] BUG: KASAN: use-after-free in
>> edac_remove_sysfs_mci_device+0x148/0x180
>
> It is triggered in edac_remove_sysfs_mci_device().
>
> device_unregister(&dimm->dev) not only removes the sysfs entry, it
> also frees the dimm struct in dimm_attr_release(). When incrementing
> the loop in mci_for_each_dimm(), the dimm struct is accessed again
> which causes the use-after-free. But, the dimm struct shouln'd be
> released here already.
>
> edac_remove_sysfs_mci_device() should not release the devices at this
> point. We need clean release functions for mci and dimm_info and
> refcounts to protect pdev/dev mappings. And mci_for_each_dimm() must
> be checked how it handles device removals and if it is safe.
>
> Let's see how this can be fixed.
>
> Thanks for reporting the issue.
Fine, and would any fix also deal with the v5.4 mem leak which I
mentioned also?
Cheers,
John
next prev parent reply other threads:[~2019-12-02 10:23 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-14 15:18 edac KASAN warning in experimental arm64 allmodconfig boot John Garry
2019-10-14 16:09 ` Borislav Petkov
2019-10-14 16:44 ` John Garry
2019-10-14 16:15 ` James Morse
2019-10-14 16:56 ` John Garry
2019-10-14 16:57 ` Borislav Petkov
2019-11-21 12:34 ` linuxnext-2019119 edac warns (was Re: edac KASAN warning in experimental arm64 allmodconfig boot) John Garry
2019-11-21 14:23 ` Robert Richter
2019-11-21 15:23 ` John Garry
2019-11-21 21:36 ` [PATCH] EDAC/ghes: Do not warn when incrementing refcount on 0 Robert Richter
2019-11-22 9:01 ` Borislav Petkov
2019-11-26 9:57 ` John Garry
2019-11-22 11:28 ` linuxnext-2019119 edac warns (was Re: edac KASAN warning in experimental arm64 allmodconfig boot) Robert Richter
2019-11-26 9:59 ` John Garry
2019-11-27 17:07 ` linuxnext-2019127 " John Garry
2019-11-27 20:54 ` Robert Richter
2019-11-28 11:02 ` linuxnext-20191127 " John Garry
2019-11-28 16:44 ` Borislav Petkov
2019-11-28 21:12 ` linuxnext-2019127 " Robert Richter
2019-12-02 10:23 ` John Garry [this message]
2019-12-02 11:46 ` Robert Richter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=49bb86d8-a7ad-e66d-9796-799ee0bdd605@huawei.com \
--to=john.garry@huawei.com \
--cc=bp@alien8.de \
--cc=huangming23@huawei.com \
--cc=james.morse@arm.com \
--cc=linux-edac@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxarm@huawei.com \
--cc=mchehab@kernel.org \
--cc=rrichter@marvell.com \
--cc=tanxiaofei@huawei.com \
--cc=tony.luck@intel.com \
--cc=wanghuiqiang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.