A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 19:51:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

x86, irq: Plug memory leak in sparse irq

Browse source 
free_irq_cfg() is not freeing the cpumask_vars in irq_cfg. Fixing this
triggers a use after free caused by the fact that copying struct
irq_cfg is done with memcpy, which copies the pointer not the cpumask.

Fix both places.

Signed-off-by: Thomas Gleixner <[email protected]>
Cc: Yinghai Lu <[email protected]>
LKML-Reference: <[email protected]>
Signed-off-by: Thomas Gleixner <[email protected]>
Cc: [email protected]
Signed-off-by: H. Peter Anvin <[email protected]>
This commit is contained in:
Thomas Gleixner 2010-09-28 20:57:19 +02:00 • committed by H. Peter Anvin
commit 1cf180c94e
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
arch/x86/kernel/apic/io_apic.c
View file

@ -306,14 +306,19 @@ void arch_init_copy_chip_data(struct irq_desc *old_desc,
old_cfg = old_desc->chip_data;
memcpy(cfg, old_cfg, sizeof(struct irq_cfg));
cfg->vector = old_cfg->vector;
cfg->move_in_progress = old_cfg->move_in_progress;
cpumask_copy(cfg->domain, old_cfg->domain);
cpumask_copy(cfg->old_domain, old_cfg->old_domain);
init_copy_irq_2_pin(old_cfg, cfg, node);
}
static void free_irq_cfg(struct irq_cfg *old_cfg)
static void free_irq_cfg(struct irq_cfg *cfg)
{
kfree(old_cfg);
free_cpumask_var(cfg->domain);
free_cpumask_var(cfg->old_domain);
kfree(cfg);
}
void arch_free_chip_data(struct irq_desc *old_desc, struct irq_desc *desc)