The patch titled
Subject: kernel/resource: fix return code check in __request_free_mem_region
has been added to the -mm tree. Its filename is
kernel-resource-fix-return-code-check-in-__request_free_mem_region.patch
This patch should soon appear at
https://ozlabs.org/~akpm/mmots/broken-out/kernel-resource-fix-return-code-check-in-__request_free_mem_region.patch
and later at
https://ozlabs.org/~akpm/mmotm/broken-out/kernel-resource-fix-return-code-check-in-__request_free_mem_region.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Alistair Popple <apopple@xxxxxxxxxx>
Subject: kernel/resource: fix return code check in __request_free_mem_region
Splitting an earlier version of a patch that allowed calling
__request_region() while holding the resource lock into a series of
patches required changing the return code for the newly introduced
__request_region_locked().
Unfortunately this change was not carried through to a subsequent commit
56fd94919b8b ("kernel/resource: fix locking in request_free_mem_region")
in the series. This resulted in a use-after-free due to freeing the
struct resource without properly releasing it. Fix this by correcting the
return code check so that the struct is not freed if the request to add it
was successful.
Link: https://lkml.kernel.org/r/20210512073528.22334-1-apopple@xxxxxxxxxx
Fixes: 56fd94919b8b ("kernel/resource: fix locking in request_free_mem_region")
Signed-off-by: Alistair Popple <apopple@xxxxxxxxxx>
Reported-by: kernel test robot <oliver.sang@xxxxxxxxx>
Reviewed-by: David Hildenbrand <david@xxxxxxxxxx>
Cc: Balbir Singh <bsingharora@xxxxxxxxx>
Cc: Dan Williams <dan.j.williams@xxxxxxxxx>
Cc: Daniel Vetter <daniel.vetter@xxxxxxxx>
Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Cc: Jerome Glisse <jglisse@xxxxxxxxxx>
Cc: John Hubbard <jhubbard@xxxxxxxxxx>
Cc: Muchun Song <smuchun@xxxxxxxxx>
Cc: Oliver Sang <oliver.sang@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
kernel/resource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/resource.c~kernel-resource-fix-return-code-check-in-__request_free_mem_region
+++ a/kernel/resource.c
@@ -1805,7 +1805,7 @@ static struct resource *__request_free_m
REGION_DISJOINT)
continue;
- if (!__request_region_locked(res, &iomem_resource, addr, size,
+ if (__request_region_locked(res, &iomem_resource, addr, size,
name, 0))
break;
_
Patches currently in -mm which might be from apopple@xxxxxxxxxx are
kernel-resource-fix-return-code-check-in-__request_free_mem_region.patch
