From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934465Ab1ESSdu (ORCPT ); Thu, 19 May 2011 14:33:50 -0400 Received: from out2.smtp.messagingengine.com ([66.111.4.26]:33575 "EHLO out2.smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934431Ab1ESSc5 (ORCPT ); Thu, 19 May 2011 14:32:57 -0400 X-Sasl-enc: lx+KMwp5k7dgARvqhhyEp41tFxN2UGIkZt/ghZD3js7f 1305829976 X-Mailbox-Line: From gregkh@clark.kroah.org Thu May 19 11:31:27 2011 Message-Id: <20110519183127.811831002@clark.kroah.org> User-Agent: quilt/0.48-16.4 Date: Thu, 19 May 2011 11:30:54 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: stable-review@kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Julia Lawall , Borislav Petkov , Robert Richter , Yinghai Lu , Andreas Herrmann , Ingo Molnar Subject: [22/24] x86, mce, AMD: Fix leaving freed data in a list In-Reply-To: <20110519182446.GA23751@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.33-longterm review patch. If anyone has any objections, please let us know. ------------------ Content-Length: 1265 Lines: 49 From: Julia Lawall commit d9a5ac9ef306eb5cc874f285185a15c303c50009 upstream. b may be added to a list, but is not removed before being freed in the case of an error. This is done in the corresponding deallocation function, so the code here has been changed to follow that. The sematic match that finds this problem is as follows: (http://coccinelle.lip6.fr/) // @@ expression E,E1,E2; identifier l; @@ *list_add(&E->l,E1); ... when != E1 when != list_del(&E->l) when != list_del_init(&E->l) when != E = E2 *kfree(E);// Signed-off-by: Julia Lawall Cc: Borislav Petkov Cc: Robert Richter Cc: Yinghai Lu Cc: Andreas Herrmann Link: http://lkml.kernel.org/r/1305294731-12127-1-git-send-email-julia@diku.dk Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman --- arch/x86/kernel/cpu/mcheck/mce_amd.c | 1 + 1 file changed, 1 insertion(+) --- a/arch/x86/kernel/cpu/mcheck/mce_amd.c +++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c @@ -468,6 +468,7 @@ recurse: out_free: if (b) { kobject_put(&b->kobj); + list_del(&b->miscj); kfree(b); } return err;