tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'edac_urgent_for_5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras

Pull EDAC fixes from Borislav Petkov:
"Two fixes for use-after-free and memory leaking in the EDAC core, by
Robert Richter.

Debug options like DEBUG_TEST_DRIVER_REMOVE, KASAN and DEBUG_KMEMLEAK
unearthed issues with the lifespan of memory allocated by the EDAC
memory controller descriptor due to misdesigned memory freeing, done
partially by the EDAC core *and* the driver core, which is problematic
to say the least.

These two are minimal fixes to take care of stable - a proper rework
is following which cleans up that mess properly"

* tag 'edac_urgent_for_5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
EDAC/sysfs: Remove csrow objects on errors
EDAC/mc: Fix use-after-free and memleaks during device removal

Linus Torvalds b982df72 e29c6a13

+7 -23
+3 -9
drivers/edac/edac_mc.c
··· 505 505 { 506 506 edac_dbg(1, "\n"); 507 507 508 - /* If we're not yet registered with sysfs free only what was allocated 509 - * in edac_mc_alloc(). 510 - */ 511 - if (!device_is_registered(&mci->dev)) { 512 - _edac_mc_free(mci); 513 - return; 514 - } 508 + if (device_is_registered(&mci->dev)) 509 + edac_unregister_sysfs(mci); 515 510 516 - /* the mci instance is freed here, when the sysfs object is dropped */ 517 - edac_unregister_sysfs(mci); 511 + _edac_mc_free(mci); 518 512 } 519 513 EXPORT_SYMBOL_GPL(edac_mc_free); 520 514
+4 -14
drivers/edac/edac_mc_sysfs.c
··· 276 276 277 277 static void csrow_attr_release(struct device *dev) 278 278 { 279 - struct csrow_info *csrow = container_of(dev, struct csrow_info, dev); 280 - 281 - edac_dbg(1, "device %s released\n", dev_name(dev)); 282 - kfree(csrow); 279 + /* release device with _edac_mc_free() */ 283 280 } 284 281 285 282 static const struct device_type csrow_attr_type = { ··· 444 447 csrow = mci->csrows[i]; 445 448 if (!nr_pages_per_csrow(csrow)) 446 449 continue; 447 - 448 - device_del(&mci->csrows[i]->dev); 450 + device_unregister(&mci->csrows[i]->dev); 449 451 } 450 452 451 453 return err; ··· 604 608 605 609 static void dimm_attr_release(struct device *dev) 606 610 { 607 - struct dimm_info *dimm = container_of(dev, struct dimm_info, dev); 608 - 609 - edac_dbg(1, "device %s released\n", dev_name(dev)); 610 - kfree(dimm); 611 + /* release device with _edac_mc_free() */ 611 612 } 612 613 613 614 static const struct device_type dimm_attr_type = { ··· 886 893 887 894 static void mci_attr_release(struct device *dev) 888 895 { 889 - struct mem_ctl_info *mci = container_of(dev, struct mem_ctl_info, dev); 890 - 891 - edac_dbg(1, "device %s released\n", dev_name(dev)); 892 - kfree(mci); 896 + /* release device with _edac_mc_free() */ 893 897 } 894 898 895 899 static const struct device_type mci_attr_type = {