* Thomas Gleixner <t...@linutronix.de> wrote:
> The error path in write_ldt() frees the already installed LDT memory
> instead of the newly allocated which cannot be installed.
s/newly allocated
/newly allocated one
>
> Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on")
> Reported-by: Mathieu Desnoyers <mathieu.desnoy...@efficios.com>
> Signed-off-by: Thomas Gleixner <t...@linutronix.de>
> ---
> arch/x86/kernel/ldt.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- a/arch/x86/kernel/ldt.c
> +++ b/arch/x86/kernel/ldt.c
> @@ -421,7 +421,7 @@ static int write_ldt(void __user *ptr, u
> */
> error = map_ldt_struct(mm, new_ldt, old_ldt ? !old_ldt->slot : 0);
> if (error) {
> - free_ldt_struct(old_ldt);
> + free_ldt_struct(new_ldt);
> goto out_unlock;
> }
>
This bug kind of scares me ...
Reviewed-by: Ingo Molnar <mi...@kernel.org>
Thanks,
Ingo
