kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zipl/boot: fix memory use after free in stage2

Browse Source 
Prevent access to freed memory still pointed to by entry.
entry still points into load_page that has been released with free_page.

Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Alexander Egorenkov
2020-11-27 07:59:13 +01:00
committed by Jan Höppner
parent 75675ec627
commit 2dca5d193f
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
zipl/boot/stage2.c
View File

@@ -90,6 +90,7 @@ void start(void)
void *load_address;
struct component_entry *entry;
disk_blockptr_t *blockptr;
uint64_t load_psw;
void *load_page;
int config_nr;
@@ -133,11 +134,13 @@ void start(void)
if (entry->type != COMPONENT_EXECUTE)
panic(EWRONGTYPE, "");
load_psw = entry->address.load_psw;
free_page((unsigned long)load_page);
io_irq_disable();
set_device(subchannel_id, DISABLED);
execute(entry->address.load_psw);
execute(load_psw);
}
void panic_notify(unsigned long UNUSED(reason))