Commit 39968f97 authored by Borislav Petkov's avatar Borislav Petkov Committed by liwei
Browse files

x86/mce/amd: Publish the bank pointer only after setup has succeeded

mainline inclusion
from mainline-v5.6-rc3
commit 6e5cf31f
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8JXM2
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e5cf31fbe651bed7ba1df768f2e123531132417



---------------------------

threshold_create_bank() creates a bank descriptor per MCA error
thresholding counter which can be controlled over sysfs. It publishes
the pointer to that bank in a per-CPU variable and then goes on to
create additional thresholding blocks if the bank has such.

However, that creation of additional blocks in
allocate_threshold_blocks() can fail, leading to a use-after-free
through the per-CPU pointer.

Therefore, publish that pointer only after all blocks have been setup
successfully.

Fixes: 019f34fc ("x86, MCE, AMD: Move shared bank to node descriptor")
Reported-by: default avatarSaar Amar <Saar.Amar@microsoft.com>
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: http://lkml.kernel.org/r/20200128140846.phctkvx5btiexvbx@kili.mountain


Signed-off-by: default avatarliwei <liwei728@huawei.com>
parent 3ed6f984
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment