]> www.infradead.org Git - users/jedix/linux-maple.git/commit
sparc64: fix cdev_put() use-after-free when unbinding an LDom
authorThomas Tai <thomas.tai@oracle.com>
Thu, 27 Apr 2017 17:51:48 +0000 (10:51 -0700)
committerShannon Nelson <shannon.nelson@oracle.com>
Wed, 31 May 2017 23:43:46 +0000 (16:43 -0700)
commited30c69dc727699218cf49ff6f6e2f533ba1e4a2
tree0df760e4b63f9582924b5612fd854ee71efeeb8e
parent892aa9eaad44034a6d227f7d6b933a3953feb59a
sparc64: fix cdev_put() use-after-free when unbinding an LDom

After turning on slub_debug=P kernel option, a kernel panic happens when
unbinding an LDom. This suggests that there is memory corruption.
The memory corruption is caused by vlds_fops_release() freeing a memory
structure containing a cdev. The cdev is needed by fs/file_table.c
after the file is released.

The common approach to solve this issue is to add a kobject member
in the structure and set it to be the parent of cdev. The kobject is
then responsible to free the structure when the reference count is
zero. The reference solution is based on the following patch.

https://patchwork.kernel.org/patch/8985881/

Orabug: 25911389

Signed-off-by: Thomas Tai <thomas.tai@oracle.com>
Reviewed-By: Liam Merwick <liam.merwick@oracle.com>
Reviewed-by: Shannon Nelson <shannon.nelson@oracle.com>
Reviewed-by: Tom Saeger <tom.saeger@oracle.com>
Signed-off-by: Allen Pais <allen.pais@oracle.com>
drivers/char/vlds.c