From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x224QnTtIfE00CStZf8spge6fNhKj2jFfyZF/eL4+1Z9++FvreG/by81/SZpnli2ux4y3Tlys ARC-Seal: i=1; a=rsa-sha256; t=1516611106; cv=none; d=google.com; s=arc-20160816; b=BQlnpGPQjEyS0N12vLSfO7ycvPyEyh0AxSb6FHCUF5X4yQvZmCW+uLSdqMxM7nQP4r mLX35k3c6HmVINkwWHtoABcnSonc0CK5eok/vCMMsHx35pr7icKBWEh2mdrHT/FKP03N if6vIY0i1I2H7OYs8cIO3/oxwgBtuO8/J03q6URO0Ax2ywOgQot9jUljYqz68Yyk4YYR kIPBMEh7l26HefD+TkJOsECC2loJxJBx6NgnqDtvhX6H7M3+x0eLHCWrE4FIVBeqwlgI jLjLcd0kDNpiVGWX60KS9ZWgmuvewIb1OfXlxOOUVHmgTiX+OjenseJy4gGT6A+nv5gX ZmQg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=K8DdDKIAYprkV4MeTOOKafU8jjuLzJ5+y4SY2B0MuJE=; b=HLJ2A/n8GvwI5Ir417n7FpeVHPkdGLyePjAevkPOnG5DmCKhUNg70z1OdakIkbCaAM V4XdWNU65Kw+FrMCzG3VtGW7uT6BnEGzxEVqQgWb60OGry7rYEfJzkg4UQWrnbyJmkor xXWvL1k82On/sscyNTKTaY14JTspCbKJvDTqPfdMQ0JZnRDRW9498OxGJe+Xk8ZyllcB cNxKH00uNbQMUHubt7vmCiuKUm72hQYouWLCa0KFHv6IYoS1qgkq6yoK47elU+jbGJOe ikAAE3+2mh4l5Voee/8WgO5pgdKIgKXSksZDk9YOXtw5wJL5ey3aDeiiwU6UH8vexx2v x7VQ== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joseph Salisbury , Thomas Gleixner , Ravi Shankar , Peter Zilstra , Stephane Eranian , Vikas Shivappa , Andi Kleen , "Roderick W. Smith" , 1733662@bugs.launchpad.net, Fenghua Yu , Tony Luck Subject: [PATCH 4.14 37/89] x86/intel_rdt/cqm: Prevent use after free Date: Mon, 22 Jan 2018 09:45:17 +0100 Message-Id: <20180122083958.365282296@linuxfoundation.org> X-Mailer: git-send-email 2.16.0 In-Reply-To: <20180122083954.683903493@linuxfoundation.org> References: <20180122083954.683903493@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590282007755937446?= X-GMAIL-MSGID: =?utf-8?q?1590282007755937446?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Thomas Gleixner commit d47924417319e3b6a728c0b690f183e75bc2a702 upstream. intel_rdt_iffline_cpu() -> domain_remove_cpu() frees memory first and then proceeds accessing it. BUG: KASAN: use-after-free in find_first_bit+0x1f/0x80 Read of size 8 at addr ffff883ff7c1e780 by task cpuhp/31/195 find_first_bit+0x1f/0x80 has_busy_rmid+0x47/0x70 intel_rdt_offline_cpu+0x4b4/0x510 Freed by task 195: kfree+0x94/0x1a0 intel_rdt_offline_cpu+0x17d/0x510 Do the teardown first and then free memory. Fixes: 24247aeeabe9 ("x86/intel_rdt/cqm: Improve limbo list processing") Reported-by: Joseph Salisbury Signed-off-by: Thomas Gleixner Cc: Ravi Shankar Cc: Peter Zilstra Cc: Stephane Eranian Cc: Vikas Shivappa Cc: Andi Kleen Cc: "Roderick W. Smith" Cc: 1733662@bugs.launchpad.net Cc: Fenghua Yu Cc: Tony Luck Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1801161957510.2366@nanos Signed-off-by: Greg Kroah-Hartman --- arch/x86/kernel/cpu/intel_rdt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/arch/x86/kernel/cpu/intel_rdt.c +++ b/arch/x86/kernel/cpu/intel_rdt.c @@ -525,10 +525,6 @@ static void domain_remove_cpu(int cpu, s */ if (static_branch_unlikely(&rdt_mon_enable_key)) rmdir_mondata_subdir_allrdtgrp(r, d->id); - kfree(d->ctrl_val); - kfree(d->rmid_busy_llc); - kfree(d->mbm_total); - kfree(d->mbm_local); list_del(&d->list); if (is_mbm_enabled()) cancel_delayed_work(&d->mbm_over); @@ -545,6 +541,10 @@ static void domain_remove_cpu(int cpu, s cancel_delayed_work(&d->cqm_limbo); } + kfree(d->ctrl_val); + kfree(d->rmid_busy_llc); + kfree(d->mbm_total); + kfree(d->mbm_local); kfree(d); return; }