On 01/25/2017 08:23 PM, Borislav Petkov wrote: > On Wed, Jan 25, 2017 at 07:58:39PM +0300, Andrey Ryabinin wrote: >> On 4.10-rc5 >> # echo 0 > /sys/devices/system/cpu/cpu1/online >> # echo 1 > /sys/devices/system/cpu/cpu1/online >> >> triggers use-after-free (probably caused by 06b8534cb72 "x86/microcode: >> Rework microcode loading"). >> >> __load_ucode_intel() accesses initrd which is obviously gone at this point: > > Does that help?
Yup. Tested-by: Andrey Ryabinin <aryabi...@virtuozzo.com> > > --- > diff --git a/arch/x86/kernel/cpu/microcode/core.c > b/arch/x86/kernel/cpu/microcode/core.c > index 2af69d27da62..fdbf8d29ffcf 100644 > --- a/arch/x86/kernel/cpu/microcode/core.c > +++ b/arch/x86/kernel/cpu/microcode/core.c > @@ -248,8 +248,12 @@ struct cpio_data find_microcode_in_initrd(const char > *path, bool use_pa) > * possibly relocates the ramdisk. In either case, initrd_start contains > * the updated address so use that instead. > */ > - if (!use_pa && initrd_start) > - start = initrd_start; > + if (!use_pa) { > + if (initrd_start) > + start = initrd_start; > + else > + return (struct cpio_data){ NULL, 0, "" }; > + } > > return find_cpio_data(path, (void *)start, size, NULL); > #else /* !CONFIG_BLK_DEV_INITRD */ >