From patchwork Sat May 15 00:27:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 12259313 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A3B7C433ED for ; Sat, 15 May 2021 00:27:16 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 3921961440 for ; Sat, 15 May 2021 00:27:16 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3921961440 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id CEF306B0073; Fri, 14 May 2021 20:27:15 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C9E836B0074; Fri, 14 May 2021 20:27:15 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AF2756B0075; Fri, 14 May 2021 20:27:15 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0037.hostedemail.com [216.40.44.37]) by kanga.kvack.org (Postfix) with ESMTP id 7DE996B0073 for ; Fri, 14 May 2021 20:27:15 -0400 (EDT) Received: from smtpin19.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 1EB7018063C92 for ; Sat, 15 May 2021 00:27:15 +0000 (UTC) X-FDA: 78141576030.19.CD71D98 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf30.hostedemail.com (Postfix) with ESMTP id CE63EE0001B2 for ; Sat, 15 May 2021 00:27:12 +0000 (UTC) Received: by mail.kernel.org (Postfix) with ESMTPSA id A02A961454; Sat, 15 May 2021 00:27:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1621038434; bh=OwbFWl/Il8OIZAeQ4HuX3sY8AeZ38lQtBoqZYgQMyGg=; h=Date:From:To:Subject:In-Reply-To:From; b=qKxIPPEJILUbOXXRIRU35iEy9Lvjne0wGFNY8IYFEY7gMM1X6YA7OTnz2C2yQp69W 5LEl/LBZLmuYYcqLpswUIINYNuiBeVqkyauZP5OWLOg7V+y2cajSFJR9iyauY7pst/ 1GAdeo+604ttLq9OKVLMgh9ESbyXwRAjcoDVOfZ4= Date: Fri, 14 May 2021 17:27:13 -0700 From: Andrew Morton To: akpm@linux-foundation.org, apopple@nvidia.com, bsingharora@gmail.com, dan.j.williams@intel.com, daniel.vetter@ffwll.ch, david@redhat.com, gregkh@linuxfoundation.org, jglisse@redhat.com, jhubbard@nvidia.com, linux-mm@kvack.org, mm-commits@vger.kernel.org, oliver.sang@intel.com, smuchun@gmail.com, torvalds@linux-foundation.org Subject: [patch 04/13] kernel/resource: fix return code check in __request_free_mem_region Message-ID: <20210515002713.ECAlwWgMi%akpm@linux-foundation.org> In-Reply-To: <20210514172634.9018621171d5334ceee97e95@linux-foundation.org> User-Agent: s-nail v14.8.16 Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=qKxIPPEJ; dmarc=none; spf=pass (imf30.hostedemail.com: domain of akpm@linux-foundation.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: CE63EE0001B2 X-Stat-Signature: 7o8as4j7zfk3m6d9ur7shu8sgfbbbkn5 X-HE-Tag: 1621038432-788666 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Alistair Popple Subject: kernel/resource: fix return code check in __request_free_mem_region Splitting an earlier version of a patch that allowed calling __request_region() while holding the resource lock into a series of patches required changing the return code for the newly introduced __request_region_locked(). Unfortunately this change was not carried through to a subsequent commit 56fd94919b8b ("kernel/resource: fix locking in request_free_mem_region") in the series. This resulted in a use-after-free due to freeing the struct resource without properly releasing it. Fix this by correcting the return code check so that the struct is not freed if the request to add it was successful. Link: https://lkml.kernel.org/r/20210512073528.22334-1-apopple@nvidia.com Fixes: 56fd94919b8b ("kernel/resource: fix locking in request_free_mem_region") Signed-off-by: Alistair Popple Reported-by: kernel test robot Reviewed-by: David Hildenbrand Cc: Balbir Singh Cc: Dan Williams Cc: Daniel Vetter Cc: Greg Kroah-Hartman Cc: Jerome Glisse Cc: John Hubbard Cc: Muchun Song Cc: Oliver Sang Signed-off-by: Andrew Morton --- kernel/resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/resource.c~kernel-resource-fix-return-code-check-in-__request_free_mem_region +++ a/kernel/resource.c @@ -1805,7 +1805,7 @@ static struct resource *__request_free_m REGION_DISJOINT) continue; - if (!__request_region_locked(res, &iomem_resource, addr, size, + if (__request_region_locked(res, &iomem_resource, addr, size, name, 0)) break;