From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751095AbdLaKYo (ORCPT ); Sun, 31 Dec 2017 05:24:44 -0500 Received: from Galois.linutronix.de ([146.0.238.70]:35408 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750910AbdLaKYn (ORCPT ); Sun, 31 Dec 2017 05:24:43 -0500 Date: Sun, 31 Dec 2017 11:24:34 +0100 (CET) From: Thomas Gleixner To: LKML cc: Linus Torvalds , x86@kernel.org, Andy Lutomirski , Dave Hansen , Peter Zijlstra , Borislav Petkov , Dominik Brodowski , Mathieu Desnoyers Subject: [patch V2 1/3] x86/ldt: Plug memory leak in error path In-Reply-To: <20171230211829.508293470@linutronix.de> Message-ID: References: <20171230211351.980176980@linutronix.de> <20171230211829.508293470@linutronix.de> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Linutronix-Spam-Score: -1.0 X-Linutronix-Spam-Level: - X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The error path in write_ldt() tries to free old_ldt instead of the newly allocated new_ldt resulting in a memory leak. It also misses to clean up a half populated LDT pagetable, which is not a leak as it gets cleaned up when the process exits. Free both the potentially half populated LDT pagetable and the newly allocated LDT struct. This can be done unconditionally because once a LDT is mapped subsequent maps will succeed because the PTE page is already populated and the two LDTs fit into that single page. Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on") Reported-by: Mathieu Desnoyers Signed-off-by: Thomas Gleixner --- arch/x86/kernel/ldt.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/arch/x86/kernel/ldt.c +++ b/arch/x86/kernel/ldt.c @@ -421,7 +421,13 @@ static int write_ldt(void __user *ptr, u */ error = map_ldt_struct(mm, new_ldt, old_ldt ? !old_ldt->slot : 0); if (error) { - free_ldt_struct(old_ldt); + /* + * This only can fail for the first LDT setup. If a LDT is + * already installed then the PTE page is already + * populated. Mop up a half populated page table. + */ + free_ldt_pgtables(mm); + free_ldt_struct(new_ldt); goto out_unlock; }