diff mbox series

[2/3] EDAC/device: Fix potential slab-use-after-free

Message ID 20231008080231.51917-2-qiuxu.zhuo@intel.com (mailing list archive)
State New, archived
Headers show
Series [1/3] EDAC/igen6: Fix slab-use-after-free in igen6_unregister_mci() | expand

Commit Message

Qiuxu Zhuo Oct. 8, 2023, 8:02 a.m. UTC 
From: Lili Li <lili.li@intel.com>

If the EDAC driver invokes edac_device_alloc_ctl_info() with pvt_sz=0,
the EDAC driver itself may manage 'pvt_info' and the EDAC core shouldn't
kfree it when unloading the EDAC driver. Otherwise it may lead to a
slab-use-after-free bug. Fix the potential bug by adding a flag to indicate
whether 'pvt_info' is managed by the EDAC core. The EDAC core will only
kfree 'pvt_info' when the flag is set to true.

Fixes: 9fb9ce392aae ("EDAC/device: Get rid of the silly one-shot memory allocation in edac_device_alloc_ctl_info()")
Suggested-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Signed-off-by: Lili Li <lili.li@intel.com>
---
 drivers/edac/edac_device.c | 1 +
 drivers/edac/edac_device.h | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
index 0689e1510721..b990431df2eb 100644
--- a/drivers/edac/edac_device.c
+++ b/drivers/edac/edac_device.c
@@ -100,6 +100,7 @@  edac_device_alloc_ctl_info(unsigned pvt_sz, char *dev_name, unsigned nr_instance
 			goto free;
 
 		dev_ctl->pvt_info = pvt;
+		dev_ctl->pvt_managed_by_edac_core = true;
 	}
 
 	dev_ctl->dev_idx	= device_index;
diff --git a/drivers/edac/edac_device.h b/drivers/edac/edac_device.h
index 3f44e6b9d387..cc6a364a4b83 100644
--- a/drivers/edac/edac_device.h
+++ b/drivers/edac/edac_device.h
@@ -197,6 +197,11 @@  struct edac_device_ctl_info {
 	const char *dev_name;	/* pci/platform/etc... name */
 
 	void *pvt_info;		/* pointer to 'private driver' info */
+	/*
+	 * Indicate whether the resource pointed by pvt_info is managed by
+	 * the EDAC core.
+	 */
+	bool pvt_managed_by_edac_core;
 
 	unsigned long start_time;	/* edac_device load start time (jiffies) */
 
@@ -355,7 +360,8 @@  extern const char *edac_layer_name[];
 static inline void __edac_device_free_ctl_info(struct edac_device_ctl_info *ci)
 {
 	if (ci) {
-		kfree(ci->pvt_info);
+		if (ci->pvt_managed_by_edac_core)
+			kfree(ci->pvt_info);
 		kfree(ci->attribs);
 		kfree(ci->blocks);
 		kfree(ci->instances);