Xiaochen Shen 222b0c56d2 x86/resctrl: Prevent NULL pointer dereference when reading mondata ... [ Upstream commit 26467b0f84 ] When a mon group is being deleted, rdtgrp->flags is set to RDT_DELETED in rdtgroup_rmdir_mon() firstly. The structure of rdtgrp will be freed until rdtgrp->waitcount is dropped to 0 in rdtgroup_kn_unlock() later. During the window of deleting a mon group, if an application calls rdtgroup_mondata_show() to read mondata under this mon group, 'rdtgrp' returned from rdtgroup_kn_lock_live() is a NULL pointer when rdtgrp->flags is RDT_DELETED. And then 'rdtgrp' is passed in this path: rdtgroup_mondata_show() --> mon_event_read() --> mon_event_count(). Thus it results in NULL pointer dereference in mon_event_count(). Check 'rdtgrp' in rdtgroup_mondata_show(), and return -ENOENT immediately when reading mondata during the window of deleting a mon group. Fixes: d89b737901 ("x86/intel_rdt/cqm: Add mon_data") Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Fenghua Yu <fenghua.yu@intel.com> Reviewed-by: Tony Luck <tony.luck@intel.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: pei.p.jia@intel.com Cc: Reinette Chatre <reinette.chatre@intel.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: x86-ml <x86@kernel.org> Link: https://lkml.kernel.org/r/1572326702-27577-1-git-send-email-xiaochen.shen@intel.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-12-05 15:36:55 +01:00
..
alpha	alpha: Fix Eiger NR_IRQS to 128	2019-02-20 10:20:53 +01:00
arc	ARC: perf: Accommodate big-endian CPU	2019-12-01 09:14:21 +01:00
arm	ARM: 8904/1: skip nomap memblocks while finding the lowmem/highmem boundary	2019-12-01 09:14:20 +01:00
arm64	arm64: fix for bad_mode() handler to always result in panic	2019-12-01 09:14:19 +01:00
blackfin
c6x
cris
frv
h8300	h8300: use cc-cross-prefix instead of hardcoding h8300-unknown-linux-	2019-04-05 22:31:25 +02:00
hexagon
ia64	ia64:unwind: fix double free for mod->arch.init_unw_table	2019-10-05 12:47:48 +02:00
m32r
m68k	m68k: fix command-line parsing when passed from u-boot	2019-12-01 09:13:24 +01:00
metag
microblaze
mips	MIPS: kexec: Relax memory restriction	2019-11-20 18:00:28 +01:00
mn10300
nios2
openrisc
parisc	parisc: Fix vmap memory leak in ioremap()/iounmap()	2019-10-29 09:17:40 +01:00
powerpc	KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernel	2019-12-01 09:14:36 +01:00
s390	s390/perf: Return error when debug_register fails	2019-12-01 09:13:43 +01:00
score
sh	sh: kernel: hw_breakpoint: Fix missing break in switch statement	2019-08-25 10:50:01 +02:00
sparc	sparc64: Rework xchg() definition to avoid warnings.	2019-12-01 09:13:47 +01:00
tile
um	um: Make line/tty semantics use true write IRQ	2019-12-01 09:13:50 +01:00
unicore32
x86	x86/resctrl: Prevent NULL pointer dereference when reading mondata	2019-12-05 15:36:55 +01:00
xtensa	xtensa: drop EXPORT_SYMBOL for outs*/ins*	2019-10-29 09:17:40 +01:00
.gitignore
Kconfig