linux-kernel - [PATCH 4.14 37/89] x86/intel_rdt/cqm: Prevent use after free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 Jan 2018 09:45:17 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org,
        Joseph Salisbury <joseph.salisbury@...onical.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ravi Shankar <ravi.v.shankar@...el.com>,
        Peter Zilstra <peterz@...radead.org>,
        Stephane Eranian <eranian@...gle.com>,
        Vikas Shivappa <vikas.shivappa@...ux.intel.com>,
        Andi Kleen <ak@...ux.intel.com>,
        "Roderick W. Smith" <rod.smith@...onical.com>,
        1733662@...s.launchpad.net, Fenghua Yu <fenghua.yu@...el.com>,
        Tony Luck <tony.luck@...el.com>
Subject: [PATCH 4.14 37/89] x86/intel_rdt/cqm: Prevent use after free

4.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@...utronix.de>

commit d47924417319e3b6a728c0b690f183e75bc2a702 upstream.

intel_rdt_iffline_cpu() -> domain_remove_cpu() frees memory first and then
proceeds accessing it.

 BUG: KASAN: use-after-free in find_first_bit+0x1f/0x80
 Read of size 8 at addr ffff883ff7c1e780 by task cpuhp/31/195
 find_first_bit+0x1f/0x80
 has_busy_rmid+0x47/0x70
 intel_rdt_offline_cpu+0x4b4/0x510

 Freed by task 195:
 kfree+0x94/0x1a0
 intel_rdt_offline_cpu+0x17d/0x510

Do the teardown first and then free memory.

Fixes: 24247aeeabe9 ("x86/intel_rdt/cqm: Improve limbo list processing")
Reported-by: Joseph Salisbury <joseph.salisbury@...onical.com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: Ravi Shankar <ravi.v.shankar@...el.com>
Cc: Peter Zilstra <peterz@...radead.org>
Cc: Stephane Eranian <eranian@...gle.com>
Cc: Vikas Shivappa <vikas.shivappa@...ux.intel.com>
Cc: Andi Kleen <ak@...ux.intel.com>
Cc: "Roderick W. Smith" <rod.smith@...onical.com>
Cc: 1733662@...s.launchpad.net
Cc: Fenghua Yu <fenghua.yu@...el.com>
Cc: Tony Luck <tony.luck@...el.com>
Link: https://lkml.kernel.org/r/alpine.DEB.2.20.1801161957510.2366@nanos
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 arch/x86/kernel/cpu/intel_rdt.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/arch/x86/kernel/cpu/intel_rdt.c
+++ b/arch/x86/kernel/cpu/intel_rdt.c
@@ -525,10 +525,6 @@ static void domain_remove_cpu(int cpu, s
 		 */
 		if (static_branch_unlikely(&rdt_mon_enable_key))
 			rmdir_mondata_subdir_allrdtgrp(r, d->id);
-		kfree(d->ctrl_val);
-		kfree(d->rmid_busy_llc);
-		kfree(d->mbm_total);
-		kfree(d->mbm_local);
 		list_del(&d->list);
 		if (is_mbm_enabled())
 			cancel_delayed_work(&d->mbm_over);
@@ -545,6 +541,10 @@ static void domain_remove_cpu(int cpu, s
 			cancel_delayed_work(&d->cqm_limbo);
 		}

+		kfree(d->ctrl_val);
+		kfree(d->rmid_busy_llc);
+		kfree(d->mbm_total);
+		kfree(d->mbm_local);
 		kfree(d);
 		return;
 	}