Files
linux/lib
Matthew Wilcox 4ecd9542db ida: Free correct IDA bitmap
There's a relatively rare race where we look at the per-cpu preallocated
IDA bitmap, see it's NULL, allocate a new one, and atomically update it.
If the kmalloc() happened to sleep and we were rescheduled to a different
CPU, or an interrupt came in at the exact right time, another task
might have successfully allocated a bitmap and already deposited it.
I forgot what the semantics of cmpxchg() were and ended up freeing the
wrong bitmap leading to KASAN reporting a use-after-free.

Dmitry found the bug with syzkaller & wrote the patch.  I wrote the test
case that will reproduce the bug without his patch being applied.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Matthew Wilcox <mawilcox@microsoft.com>
2017-03-07 13:18:23 -05:00
..
2017-02-24 17:46:57 -08:00
2016-10-11 15:06:30 -07:00
2015-11-23 09:44:58 +01:00
2016-03-17 15:09:34 -07:00
2016-02-29 09:35:20 +01:00
2017-02-24 17:46:57 -08:00
2016-02-07 23:17:59 -08:00
2017-01-24 12:23:35 -05:00
2017-01-24 12:23:35 -05:00
2014-04-30 19:49:37 +01:00
2017-02-24 17:46:57 -08:00
2017-02-13 21:44:10 -05:00
2014-05-05 09:09:14 +02:00
2016-05-23 17:04:14 -07:00
2014-08-08 15:57:25 -07:00
2015-02-12 18:54:15 -08:00
2014-06-25 17:45:43 -07:00
2016-12-06 10:17:03 +02:00
2015-02-12 18:54:16 -08:00
2017-03-07 13:18:23 -05:00
2017-02-24 17:46:57 -08:00
2015-03-23 22:12:08 -04:00
2016-03-17 15:09:34 -07:00
2017-02-24 17:46:56 -08:00
2016-05-30 15:26:57 -07:00
2016-08-02 17:31:41 -04:00
2017-02-27 18:43:47 -08:00