From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756509AbcCWReC (ORCPT ); Wed, 23 Mar 2016 13:34:02 -0400 Received: from mail.skyhub.de ([78.46.96.112]:47375 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754985AbcCWReA (ORCPT ); Wed, 23 Mar 2016 13:34:00 -0400 Date: Wed, 23 Mar 2016 18:33:56 +0100 From: Borislav Petkov To: Tony Luck Cc: linux-kernel@vger.kernel.org, "Chen, Gong" Subject: Re: [PATCH] x86/mce: Avoid using object after free in genpool. Message-ID: <20160323173356.GG6614@pd.tnic> References: <0205920@agluck-desk.sc.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <0205920@agluck-desk.sc.intel.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Mar 23, 2016 at 09:14:40AM -0700, Tony Luck wrote: > When we loop over all queued machine check error records to pass > them to the registered notifiers we use llist_for_each_entry(). > But the loop calls gen_pool_free() for the entry in the body of > the loop - and then the iterator looks at node->next after the > free. > > Use llist_for_each_entry_safe() instead. > > Cc: stable@vger.kernel.org > Signed-off-by: Tony Luck > --- > arch/x86/kernel/cpu/mcheck/mce-genpool.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/x86/kernel/cpu/mcheck/mce-genpool.c b/arch/x86/kernel/cpu/mcheck/mce-genpool.c > index 0a850100c594..2658e2af74ec 100644 > --- a/arch/x86/kernel/cpu/mcheck/mce-genpool.c > +++ b/arch/x86/kernel/cpu/mcheck/mce-genpool.c > @@ -29,7 +29,7 @@ static char gen_pool_buf[MCE_POOLSZ]; > void mce_gen_pool_process(void) > { > struct llist_node *head; > - struct mce_evt_llist *node; > + struct mce_evt_llist *node, *tmp; > struct mce *mce; > > head = llist_del_all(&mce_event_llist); > @@ -37,7 +37,7 @@ void mce_gen_pool_process(void) > return; > > head = llist_reverse_order(head); > - llist_for_each_entry(node, head, llnode) { > + llist_for_each_entry_safe(node, tmp, head, llnode) { > mce = &node->mce; > atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, mce); > gen_pool_free(mce_evt_pool, (unsigned long)node, sizeof(*node)); > -- Acked-by: Borislav Petkov I have a couple more RAS patches for tip, want me to pick that one up too? I'm going to send my pile to tip guys after -rc1 is out. -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply.