Commit 54f9555d authored by Miaohe Lin's avatar Miaohe Lin Committed by Andrew Morton
Browse files

mm, hwpoison: fix possible use-after-free in mf_dax_kill_procs() 

After kill_procs(), tk will be freed without being removed from the
to_kill list.  In the next iteration, the freed list entry in the to_kill
list will be accessed, thus leading to use-after-free issue.  Adding
list_del() in kill_procs() to fix the issue.

Link: https://lkml.kernel.org/r/20220823032346.4260-5-linmiaohe@huawei.com


Fixes: c36e2024 ("mm: introduce mf_dax_kill_procs() for fsdax case")
Signed-off-by: default avatarMiaohe Lin <linmiaohe@huawei.com>
Acked-by: default avatarNaoya Horiguchi <naoya.horiguchi@nec.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 12f1dbcf

mm/memory-failure.c

+2 −1
Original line number Diff line number Diff line
@@ -437,6 +437,7 @@ static void kill_procs(struct list_head *to_kill, int forcekill, bool fail, 
				pr_err("%#lx: Cannot send advisory machine check signal to %s:%d\n",

				       pfn, tk->tsk->comm, tk->tsk->pid);

		}

		list_del(&tk->nd);

		put_task_struct(tk->tsk);

		kfree(tk);

	}