On 6/2/20 5:26 pm, Oliver O'Halloran wrote:
The cpufreq driver has a use-after-free that we can hit if:a) There's an OCC message pending when the notifier is registered, and b) The cpufreq driver fails to register with the core. When a) occurs the notifier schedules a workqueue item to handle the message. The backing work_struct is located on chips[].throttle and when b) happens we clean up by freeing the array. Once we get to the (now free) queued item and the kernel crashes. Cc: Vaidyanathan Srinivasan <sva...@linux.vnet.ibm.com> Fixes: c5e29ea ("cpufreq: powernv: Fix bugs in powernv_cpufreq_{init/exit}") Signed-off-by: Oliver O'Halloran <ooh...@gmail.com>
This sounds like it needs to go to stable. -- Andrew Donnellan OzLabs, ADL Canberra a...@linux.ibm.com IBM Australia Limited
