Messages in this thread | | | Date | Sun, 8 Oct 2023 12:57:40 +0200 | From | Borislav Petkov <> | Subject | Re: [PATCH 1/3] EDAC/igen6: Fix slab-use-after-free in igen6_unregister_mci() |
| |
On Sun, Oct 08, 2023 at 04:02:29PM +0800, Qiuxu Zhuo wrote: > When unloading the igen6_edac driver, the EDAC core wrongly kfreed > 'pvt_info,' which was private data and managed by the igen6_edac > driver. This resulted in a slab-use-after-free bug. Fix it by adding > a flag to indicate whether 'pvt_info' is managed by the EDAC core. > The EDAC core will only kfree 'pvt_info' when the flag is set to true.
That's because your silly driver is wrongly allocating stuff:
igen6_probe() allocates the whole pvt struct and then igen6_register_mci() assigns it piece-meal-wise to each MC's ->pvt_info.
On the unreg path, you then call edac_mc_free(), it frees ->mct_info and then you do wonder why it complains when you call kfree(igen6_pvt) in igen6_remove().
You should do the exact opposite of the allocation steps on the unreg path and it'll all work fine. Definitely not add ugly hacks to the EDAC core.
-- Regards/Gruss, Boris.
https://people.kernel.org/tglx/notes-about-netiquette
| |