x86/mce/amd: Publish the bank pointer only after setup has succeeded
mainline inclusion from mainline-v5.6-rc3 commit 6e5cf31f category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8JXM2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e5cf31fbe651bed7ba1df768f2e123531132417 --------------------------- threshold_create_bank() creates a bank descriptor per MCA error thresholding counter which can be controlled over sysfs. It publishes the pointer to that bank in a per-CPU variable and then goes on to create additional thresholding blocks if the bank has such. However, that creation of additional blocks in allocate_threshold_blocks() can fail, leading to a use-after-free through the per-CPU pointer. Therefore, publish that pointer only after all blocks have been setup successfully. Fixes: 019f34fc ("x86, MCE, AMD: Move shared bank to node descriptor") Reported-by:Saar Amar <Saar.Amar@microsoft.com> Reported-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
Borislav Petkov <bp@suse.de> Cc: <stable@vger.kernel.org> Link: http://lkml.kernel.org/r/20200128140846.phctkvx5btiexvbx@kili.mountain Signed-off-by:
liwei <liwei728@huawei.com>
Loading
Please sign in to comment