| From 7fb5f18faa3d8f6b37d8719b35721b0640f8085a Mon Sep 17 00:00:00 2001 |
| From: Thomas Gleixner <tglx@linutronix.de> |
| Date: Tue, 28 Sep 2010 20:57:19 +0200 |
| Subject: [PATCH] x86, irq: Plug memory leak in sparse irq |
| |
| commit 1cf180c94e9166cda083ff65333883ab3648e852 upstream. |
| |
| free_irq_cfg() is not freeing the cpumask_vars in irq_cfg. Fixing this |
| triggers a use after free caused by the fact that copying struct |
| irq_cfg is done with memcpy, which copies the pointer not the cpumask. |
| |
| Fix both places. |
| |
| Signed-off-by: Thomas Gleixner <tglx@linutronix.de> |
| Cc: Yinghai Lu <yhlu.kernel@gmail.com> |
| LKML-Reference: <alpine.LFD.2.00.1009282052570.2416@localhost6.localdomain6> |
| Signed-off-by: Thomas Gleixner <tglx@linutronix.de> |
| Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| --- |
| arch/x86/kernel/apic/io_apic.c | 11 ++++++++--- |
| 1 files changed, 8 insertions(+), 3 deletions(-) |
| |
| diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c |
| index abb136a..469d45a 100644 |
| --- a/arch/x86/kernel/apic/io_apic.c |
| +++ b/arch/x86/kernel/apic/io_apic.c |
| @@ -303,14 +303,19 @@ void arch_init_copy_chip_data(struct irq_desc *old_desc, |
| |
| old_cfg = old_desc->chip_data; |
| |
| - memcpy(cfg, old_cfg, sizeof(struct irq_cfg)); |
| + cfg->vector = old_cfg->vector; |
| + cfg->move_in_progress = old_cfg->move_in_progress; |
| + cpumask_copy(cfg->domain, old_cfg->domain); |
| + cpumask_copy(cfg->old_domain, old_cfg->old_domain); |
| |
| init_copy_irq_2_pin(old_cfg, cfg, node); |
| } |
| |
| -static void free_irq_cfg(struct irq_cfg *old_cfg) |
| +static void free_irq_cfg(struct irq_cfg *cfg) |
| { |
| - kfree(old_cfg); |
| + free_cpumask_var(cfg->domain); |
| + free_cpumask_var(cfg->old_domain); |
| + kfree(cfg); |
| } |
| |
| void arch_free_chip_data(struct irq_desc *old_desc, struct irq_desc *desc) |
| -- |
| 1.7.0.4 |
| |