x86, irq: Plug memory leak in sparse irq

KAGA-KOKO · H. Peter Anvin · commit 1cf180c94e91 · 2010-09-30T15:57:35.000-07:00
free_irq_cfg() is not freeing the cpumask_vars in irq_cfg. Fixing this
triggers a use after free caused by the fact that copying struct
irq_cfg is done with memcpy, which copies the pointer not the cpumask.

Fix both places.

Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Yinghai Lu &lt;yhlu.kernel@gmail.com&gt;
LKML-Reference: &lt;alpine.LFD.2.00.1009282052570.2416@localhost6.localdomain6&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: stable@kernel.org
Signed-off-by: H. Peter Anvin &lt;hpa@linux.intel.com&gt;
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
@@ -306,14 +306,19 @@ void arch_init_copy_chip_data(struct irq_desc *old_desc,
 
 	old_cfg = old_desc->chip_data;
 
-	memcpy(cfg, old_cfg, sizeof(struct irq_cfg));
+	cfg->vector = old_cfg->vector;
+	cfg->move_in_progress = old_cfg->move_in_progress;
+	cpumask_copy(cfg->domain, old_cfg->domain);
+	cpumask_copy(cfg->old_domain, old_cfg->old_domain);
 
 	init_copy_irq_2_pin(old_cfg, cfg, node);
 }
 
-static void free_irq_cfg(struct irq_cfg *old_cfg)
+static void free_irq_cfg(struct irq_cfg *cfg)
 {
-	kfree(old_cfg);
+	free_cpumask_var(cfg->domain);
+	free_cpumask_var(cfg->old_domain);
+	kfree(cfg);
 }
 
 void arch_free_chip_data(struct irq_desc *old_desc, struct irq_desc *desc)

Original file line number	Diff line number	Diff line change
`@@ -306,14 +306,19 @@ void arch_init_copy_chip_data(struct irq_desc *old_desc,`
`306`	`306`
`307`	`307`	`old_cfg = old_desc->chip_data;`
`308`	`308`
`309`		`- memcpy(cfg, old_cfg, sizeof(struct irq_cfg));`
	`309`	`+ cfg->vector = old_cfg->vector;`
	`310`	`+ cfg->move_in_progress = old_cfg->move_in_progress;`
	`311`	`+ cpumask_copy(cfg->domain, old_cfg->domain);`
	`312`	`+ cpumask_copy(cfg->old_domain, old_cfg->old_domain);`
`310`	`313`
`311`	`314`	`init_copy_irq_2_pin(old_cfg, cfg, node);`
`312`	`315`	`}`
`313`	`316`
`314`		`-static void free_irq_cfg(struct irq_cfg *old_cfg)`
	`317`	`+static void free_irq_cfg(struct irq_cfg *cfg)`
`315`	`318`	`{`
`316`		`- kfree(old_cfg);`
	`319`	`+ free_cpumask_var(cfg->domain);`
	`320`	`+ free_cpumask_var(cfg->old_domain);`
	`321`	`+ kfree(cfg);`
`317`	`322`	`}`
`318`	`323`
`319`	`324`	`void arch_free_chip_data(struct irq_desc old_desc, struct irq_desc desc)`