• Thomas Gleixner's avatar
    x86/mce/amd: Fix kobject lifetime · 51dede9c
    Thomas Gleixner authored
    Accessing the MCA thresholding controls in sysfs concurrently with CPU
    hotplug can lead to a couple of KASAN-reported issues:
    
      BUG: KASAN: use-after-free in sysfs_file_ops+0x155/0x180
      Read of size 8 at addr ffff888367578940 by task grep/4019
    
    and
    
      BUG: KASAN: use-after-free in show_error_count+0x15c/0x180
      Read of size 2 at addr ffff888368a05514 by task grep/4454
    
    for example. Both result from the fact that the threshold block
    creation/teardown code frees the descriptor memory itself instead of
    defining proper ->release function and leaving it to the driver core to
    take care of that, after all sysfs accesses have completed.
    
    Do that and get rid of the custom freeing code, fixing the above UAFs in
    the process.
    
      [ bp: write commit message. ]
    
    Fixes: 95268664 ("[PATCH] x86_64: mce_amd support for family 0x10 processors")
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
    Cc: <stable@vger.kernel.org>
    Link: https://lkml.kernel.org/r/20200214082801.13836-1-bp@alien8.de
    51dede9c
amd.c 36.4 KB