Commit 1cf180c9 authored by Thomas Gleixner's avatar Thomas Gleixner Committed by H. Peter Anvin

x86, irq: Plug memory leak in sparse irq

free_irq_cfg() is not freeing the cpumask_vars in irq_cfg. Fixing this
triggers a use after free caused by the fact that copying struct
irq_cfg is done with memcpy, which copies the pointer not the cpumask.

Fix both places.
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: Yinghai Lu <yhlu.kernel@gmail.com>
LKML-Reference: <alpine.LFD.2.00.1009282052570.2416@localhost6.localdomain6>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: stable@kernel.org
Signed-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
parent d900329e
...@@ -306,14 +306,19 @@ void arch_init_copy_chip_data(struct irq_desc *old_desc, ...@@ -306,14 +306,19 @@ void arch_init_copy_chip_data(struct irq_desc *old_desc,
old_cfg = old_desc->chip_data; old_cfg = old_desc->chip_data;
memcpy(cfg, old_cfg, sizeof(struct irq_cfg)); cfg->vector = old_cfg->vector;
cfg->move_in_progress = old_cfg->move_in_progress;
cpumask_copy(cfg->domain, old_cfg->domain);
cpumask_copy(cfg->old_domain, old_cfg->old_domain);
init_copy_irq_2_pin(old_cfg, cfg, node); init_copy_irq_2_pin(old_cfg, cfg, node);
} }
static void free_irq_cfg(struct irq_cfg *old_cfg) static void free_irq_cfg(struct irq_cfg *cfg)
{ {
kfree(old_cfg); free_cpumask_var(cfg->domain);
free_cpumask_var(cfg->old_domain);
kfree(cfg);
} }
void arch_free_chip_data(struct irq_desc *old_desc, struct irq_desc *desc) void arch_free_chip_data(struct irq_desc *old_desc, struct irq_desc *desc)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment