• Thomas Gleixner's avatar
    x86/intel_rdt/cqm: Prevent use after free · d4792441
    Thomas Gleixner authored
    intel_rdt_iffline_cpu() -> domain_remove_cpu() frees memory first and then
    proceeds accessing it.
    
     BUG: KASAN: use-after-free in find_first_bit+0x1f/0x80
     Read of size 8 at addr ffff883ff7c1e780 by task cpuhp/31/195
     find_first_bit+0x1f/0x80
     has_busy_rmid+0x47/0x70
     intel_rdt_offline_cpu+0x4b4/0x510
    
     Freed by task 195:
     kfree+0x94/0x1a0
     intel_rdt_offline_cpu+0x17d/0x510
    
    Do the teardown first and then free memory.
    
    Fixes: 24247aee ("x86/intel_rdt/cqm: Improve limbo list processing")
    Reported-by: default avatarJoseph Salisbury <joseph.salisbury@canonical.com>
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Cc: Ravi Shankar <ravi.v.shankar@intel.com>
    Cc: Peter Zilstra <peterz@infradead.org>
    Cc: Stephane Eranian <eranian@google.com>
    Cc: Vikas Shivappa <vikas.shivappa@linux.intel.com>
    Cc: Andi Kleen <ak@linux.intel.com>
    Cc: "Roderick W. Smith" <rod.smith@canonical.com>
    Cc: 1733662@bugs.launchpad.net
    Cc: Fenghua Yu <fenghua.yu@intel.com>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: stable@vger.kernel.org
    Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1801161957510.2366@nanos
    d4792441
intel_rdt.c 19.9 KB