From 16da9df01fec3cee6d0ebf1f08e61d9a2cf89415 Mon Sep 17 00:00:00 2001 From: Jamie Iles Date: Fri, 5 Jan 2018 18:13:10 +0000 Subject: [PATCH] x86/ldt: fix crash in ldt freeing. 94b1f3e2c4b7 (kaiser: merged update) factored out __free_ldt_struct() to use vfree/free_page, but in the page allocation case it is actually allocated with kmalloc so needs to be freed with kfree and not free_page(). Reported-by: Vegard Nossum Signed-off-by: Jamie Iles Orabug: 27333760 CVE: CVE-2017-5754 Signed-off-by: Pavel Tatashin Signed-off-by: Kirtikar Kashyap --- arch/x86/kernel/ldt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c index 5797d437710d..17ad4e1929a4 100644 --- a/arch/x86/kernel/ldt.c +++ b/arch/x86/kernel/ldt.c @@ -39,7 +39,7 @@ static void __free_ldt_struct(struct ldt_struct *ldt) if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE) vfree(ldt->entries); else - free_page((unsigned long)ldt->entries); + kfree((unsigned long)ldt->entries); kfree(ldt); } -- 2.50.1