iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix ghes_edac UAF case triggered by KASAN and DEBUG_TEST_DRIVER_REMOVE.

Browse Source 
Future pending rework of the ghes_edac instances registration will do
 away with the single memory controller per system model and that ugly
 hackery there.
 
 This is a minimal fix for stable@, courtesy of James Morse.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAl2v/h4ACgkQEsHwGGHe
 VUrBTw//UqWfFXV+82L6u98j4wAduGxJLGHu9q+bFS8G/sqw32/WGIzzsoImD4Ta
 Xn3gRlQLc5zQTNNOaWh9jR3VtZsVvykLtTkIPzY/cGb78/kQbfycmIACUVKaBTdw
 PUZ9dTev/PAnctotePfcUan78pDmo3LBhI5Y9ZvWdE4CelOP/+QaH8dFa/LNSe7t
 jZMuJ1H6fA8wgD/i/eO4dDnvzhykf58oFyZMrdlO6GCwPCYu9CbLHgqWCqfG73IF
 R6xIf7aoebnQOGqcwsJuY5n33wgmNyBQcOWVbBKAuv5ffVMobvxZ0dth2pS1Kulx
 gQSI7Mt+FqL9xO9mY3GkkhcAZvANFPjgNRARUDwYFpy+Iihg2z24DdTDXTG+51Ps
 JyeEZx1HgA7oCkBftphuVd7l/mmocI789j/k4rn1AHyPi8/GyYPV3KatikTCbRKc
 BL7dvzYSLg1nESiiwXHuZssWT75IoIgNFvEpwJcao074YNFfaCg03Dev5v440c2Q
 CdqHIZbcl7sDlmRAdbcd7gu2HSnr2wqbmDKfSpNY3ks9e3PjzQOfjDZ/vxSbPz5G
 1Dqv2vsPGCfeBGxbzTRBTK7+PPowoWkqhPp2OvDi0WUkMWrlO/+ZeNw9JU4ri4S7
 4eUXfLlBhD6COJDCT+4edxLcjtG2zvDCZIutNvWvs5IZAXtZpMQ=
 =6R9z
 -----END PGP SIGNATURE-----

Merge tag 'edac_urgent_for_5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras

Pull EDAC fix from Borislav Petkov:
 "Fix ghes_edac UAF case triggered by KASAN and DEBUG_TEST_DRIVER_REMOVE.

  Future pending rework of the ghes_edac instances registration will do
  away with the single memory controller per system model and that ugly
  hackery there.

  This is a minimal fix for stable@, courtesy of James Morse"

* tag 'edac_urgent_for_5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
  EDAC/ghes: Fix Use after free in ghes_edac remove path
This commit is contained in:
Linus Torvalds 2019-10-23 06:19:07 -04:00
commit e969c860d5
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/edac/ghes_edac.c
View File

@ -553,7 +553,11 @@ void ghes_edac_unregister(struct ghes *ghes)
if (!ghes_pvt)
return;
if (atomic_dec_return(&ghes_init))
return;
mci = ghes_pvt->mci;
ghes_pvt = NULL;
edac_mc_del_mc(mci->pdev);
edac_mc_free(mci);
}