]> git.baikalelectronics.ru Git - kernel.git/commit
iommu: fix KASAN use-after-free in iommu_insert_resv_region
authorEric Auger <eric.auger@redhat.com>
Tue, 26 Nov 2019 17:54:13 +0000 (18:54 +0100)
committerLinus Torvalds <torvalds@linux-foundation.org>
Mon, 16 Dec 2019 16:58:42 +0000 (08:58 -0800)
commit6b3206044d2ccb18d36389c2c303ebc6ccebc4b1
tree1c1e5bc6a0ac7fa9d5ff86da7330d0860aaaf9af
parentc28d5c11dc55f6f2a50194cdc14ec7ecf1222032
iommu: fix KASAN use-after-free in iommu_insert_resv_region

In case the new region gets merged into another one, the nr list node is
freed.  Checking its type while completing the merge algorithm leads to
a use-after-free.  Use new->type instead.

Fixes: 3dcd8f78edc4 ("iommu: Revisit iommu_insert_resv_region() implementation")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Qian Cai <cai@lca.pw>
Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
Cc: Stable <stable@vger.kernel.org> #v5.3+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/iommu/iommu.c