x86/mce: Avoid using object after free in genpool
authorTony Luck <[email protected]>
Wed, 6 Apr 2016 08:05:16 +0000 (10:05 +0200)
committerIngo Molnar <[email protected]>
Wed, 13 Apr 2016 08:54:00 +0000 (10:54 +0200)
commita3125494cff084b098c80bb36fbe2061ffed9d52
tree25d862d9e4b129f3b3cddf7bfcc7bc4bb120fdca
parentf87e0434a3bedeb5e4d75d96d9f3ad424dae6b33
x86/mce: Avoid using object after free in genpool

When we loop over all queued machine check error records to pass them
to the registered notifiers we use llist_for_each_entry(). But the loop
calls gen_pool_free() for the entry in the body of the loop - and then
the iterator looks at node->next after the free.

Use llist_for_each_entry_safe() instead.

Signed-off-by: Tony Luck <[email protected]>
Signed-off-by: Borislav Petkov <[email protected]>
Cc: <[email protected]>
Cc: Gong Chen <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: linux-edac <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>
arch/x86/kernel/cpu/mcheck/mce-genpool.c