[PATCH stable] EDAC/mc: Really fix error path ordering in edac_mc_alloc()

[PATCH stable] EDAC/mc: Really fix error path ordering in edac_mc_alloc()

[Jean Delvare]

The backport of 51520e03e70d ("EDAC/mc: Fix error path ordering in
edac_mc_alloc()") to stable kernel branches is incomplete due to a
different memory allocation scheme. In v6.19 and earlier, the device
initialization must be moved further up so that all jumps to the
error label are covered.

Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: stable@kernel.org # v6.19-
---
I believe that CVE-2026-31689 is not properly fixed in kernels v6.19 and
older as of today, and the patch below shall address that. Affected
branches still under maintenance would be v6.18, v6.12, v6.6 and v6.1.
v6.19 is equally affected but no longer maintained.

I wrote to Borislav earlier about this but I'm unsure if my message
reached him as I did not hear back. So I'm sending it to the stable
kernel list this time.

 drivers/edac/edac_mc.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- linux-6.18.orig/drivers/edac/edac_mc.c
+++ linux-6.18/drivers/edac/edac_mc.c
@@ -366,13 +366,13 @@ struct mem_ctl_info *edac_mc_alloc(unsig
 	if (!mci)
 		return NULL;
 
+	mci->dev.release = mci_release;
+	device_initialize(&mci->dev);
+
 	mci->layers = kcalloc(n_layers, sizeof(struct edac_mc_layer), GFP_KERNEL);
 	if (!mci->layers)
 		goto error;
 
-	mci->dev.release = mci_release;
-	device_initialize(&mci->dev);
-
 	mci->pvt_info = kzalloc(sz_pvt, GFP_KERNEL);
 	if (!mci->pvt_info)
 		goto error;


-- 
Jean Delvare
SUSE L3 Support

Re: [PATCH stable] EDAC/mc: Really fix error path ordering in edac_mc_alloc()

[Borislav Petkov]

On Tue, Nov 03, 2026 at 05:04:39PM +0100, Jean Delvare wrote:
> The backport of 51520e03e70d ("EDAC/mc: Fix error path ordering in
> edac_mc_alloc()") to stable kernel branches is incomplete due to a
> different memory allocation scheme. In v6.19 and earlier, the device
> initialization must be moved further up so that all jumps to the
> error label are covered.
> 
> Signed-off-by: Jean Delvare <jdelvare@suse.de>
> Cc: stable@kernel.org # v6.19-

looks about right:

Acked-by: Borislav Petkov (AMD) <bp@alien8.de>

> I believe that CVE-2026-31689 is not properly fixed in kernels v6.19 and
> older as of today, and the patch below shall address that. Affected
> branches still under maintenance would be v6.18, v6.12, v6.6 and v6.1.
> v6.19 is equally affected but no longer maintained.

Have you audited all those other trees, whether backporting it there is
correct?

> I wrote to Borislav earlier about this but I'm unsure if my message
> reached him as I did not hear back.

Borislav is regularly overloaded with shit. :-\

Sorry that I couldn't get back to you.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: [PATCH stable] EDAC/mc: Really fix error path ordering in edac_mc_alloc()

[Jean Delvare]

On Tue, 3 Nov 2026 13:09:51 -0800, Borislav Petkov wrote:
> On Tue, Nov 03, 2026 at 05:04:39PM +0100, Jean Delvare wrote:
> > The backport of 51520e03e70d ("EDAC/mc: Fix error path ordering in
> > edac_mc_alloc()") to stable kernel branches is incomplete due to a
> > different memory allocation scheme. In v6.19 and earlier, the device
> > initialization must be moved further up so that all jumps to the
> > error label are covered.
> > 
> > Signed-off-by: Jean Delvare <jdelvare@suse.de>
> > Cc: stable@kernel.org # v6.19-  
> 
> looks about right:
> 
> Acked-by: Borislav Petkov (AMD) <bp@alien8.de>

Thanks for the review.

> > I believe that CVE-2026-31689 is not properly fixed in kernels v6.19 and
> > older as of today, and the patch below shall address that. Affected
> > branches still under maintenance would be v6.18, v6.12, v6.6 and v6.1.
> > v6.19 is equally affected but no longer maintained.  
> 
> Have you audited all those other trees, whether backporting it there is
> correct?

Yes I did.
-- 
Jean Delvare
SUSE L3 Support

Re: [PATCH stable] EDAC/mc: Really fix error path ordering in edac_mc_alloc()

[Sasha Levin]

On 2026-11-03, Jean Delvare <jdelvare@suse.de> wrote:
> Affected
> branches still under maintenance would be v6.18, v6.12, v6.6 and v6.1.

Queued for 6.18, 6.12, 6.6 and 6.1, thanks.

-- 
Thanks,
Sasha