Linux-EDAC Archive on
 help / color / Atom feed
* [PATCH 5.3 162/197] EDAC/ghes: Fix Use after free in ghes_edac remove path
       [not found] <>
@ 2019-10-27 21:01 ` Greg Kroah-Hartman
  0 siblings, 0 replies; only message in thread
From: Greg Kroah-Hartman @ 2019-10-27 21:01 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Garry, James Morse,
	Borislav Petkov, linux-edac, Mauro Carvalho Chehab,
	Robert Richter, Tony Luck

From: James Morse <>

commit 1e72e673b9d102ff2e8333e74b3308d012ddf75b upstream.

ghes_edac models a single logical memory controller, and uses a global
ghes_init variable to ensure only the first ghes_edac_register() will
do anything.

ghes_edac is registered the first time a GHES entry in the HEST is
probed. There may be multiple entries, so subsequent attempts to
register ghes_edac are silently ignored as the work has already been

When a GHES entry is unregistered, it calls ghes_edac_unregister(),
which free()s the memory behind the global variables in ghes_edac.

But there may be multiple GHES entries, the next call to
ghes_edac_unregister() will dereference the free()d memory, and attempt
to free it a second time.

This may also be triggered on a platform with one GHES entry, if the
driver is unbound/re-bound and unbound. The re-bind step will do
nothing because of ghes_init, the second unbind will then do the same
work as the first.

Doing the unregister work on the first call is unsafe, as another
CPU may be processing a notification in ghes_edac_report_mem_error(),
using the memory we are about to free.

ghes_init is already half of the reference counting. We only need
to do the register work for the first call, and the unregister work
for the last. Add the unregister check.

This means we no longer free ghes_edac's memory while there are
GHES entries that may receive a notification.

This was detected by KASAN and DEBUG_TEST_DRIVER_REMOVE.

 [ bp: merge into a single patch. ]

Fixes: 0fe5f281f749 ("EDAC, ghes: Model a single, logical memory controller")
Reported-by: John Garry <>
Signed-off-by: James Morse <>
Signed-off-by: Borislav Petkov <>
Cc: linux-edac <>
Cc: Mauro Carvalho Chehab <>
Cc: Robert Richter <>
Cc: Tony Luck <>
Cc: <>
Signed-off-by: Greg Kroah-Hartman <>

 drivers/edac/ghes_edac.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/edac/ghes_edac.c
+++ b/drivers/edac/ghes_edac.c
@@ -553,7 +553,11 @@ void ghes_edac_unregister(struct ghes *g
 	if (!ghes_pvt)
+	if (atomic_dec_return(&ghes_init))
+		return;
 	mci = ghes_pvt->mci;
+	ghes_pvt = NULL;

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <>
2019-10-27 21:01 ` [PATCH 5.3 162/197] EDAC/ghes: Fix Use after free in ghes_edac remove path Greg Kroah-Hartman

Linux-EDAC Archive on

Archives are clonable:
	git clone --mirror linux-edac/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-edac linux-edac/ \
	public-inbox-index linux-edac

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone