Hi,
Two fixes for x86 arch.
## Changelog v3: - Fold in changes from Alviro, the previous version is still leaking @bank[n].
v2: - Fix wrong copy/paste.
## Summary [PATCH v3 1/2] x86/delay: Fix the wrong asm constraint in `delay_loop()`
The asm constraint does not reflect that the asm statement can modify the value of @loops. But the asm statement in delay_loop() does change the @loops.
If by any chance the compiler inlines this function, it may clobber random stuff (e.g. local variable, important temporary value in reg, etc.).
Fortunately, delay_loop() is only called indirectly (so it can't inline), and then the register it clobbers is %rax (which is by the nature of the calling convention, it's a caller saved register), so it didn't yield any bug.
^ That shouldn't be an excuse for using the wrong constraint anyway.
This changes "a" (as an input) to "+a" (as an input and output).
[PATCH v3 2/2] x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails.
@bp is a local variable, calling mce_threshold_remove_device() when threshold_create_bank() fails will not free the @bp. Note that mce_threshold_remove_device() frees the @bp only if it's already stored in the @threshold_banks per-CPU variable.
At that point, the @threshold_banks per-CPU variable is still NULL, so the mce_threshold_remove_device() will just be a no-op and the @bp is leaked.
Fix this by storing @bp to @threshold_banks before the loop, so in case we fail, mce_threshold_remove_device() will free the @bp.
This bug is introduced by commit 6458de97fc15530b544 ("x86/mce/amd: Straighten CPU hotplug path") [1].
Cc: Borislav Petkov bp@alien8.de Cc: Dave Hansen dave.hansen@linux.intel.com Cc: "H. Peter Anvin" hpa@zytor.com Cc: Ingo Molnar mingo@redhat.com Cc: Thomas Gleixner tglx@linutronix.de Cc: Tony Luck tony.luck@intel.com Signed-off-by: Alviro Iskandar Setiawan alviro.iskandar@gnuweeb.org Signed-off-by: Ammar Faizi ammarfaizi2@gnuweeb.org --- Ammar Faizi (2): x86/delay: Fix the wrong asm constraint in `delay_loop()` x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails
arch/x86/kernel/cpu/mce/amd.c | 16 ++++++++++------ arch/x86/lib/delay.c | 4 ++-- 2 files changed, 12 insertions(+), 8 deletions(-)
base-commit: 7e57714cd0ad2d5bb90e50b5096a0e671dec1ef3
The asm constraint does not reflect that the asm statement can modify the value of @loops. But the asm statement in delay_loop() does change the @loops.
If by any chance the compiler inlines this function, it may clobber random stuff (e.g. local variable, important temporary value in reg, etc.).
Fortunately, delay_loop() is only called indirectly (so it can't inline), and then the register it clobbers is %rax (which is by the nature of the calling convention, it's a caller saved register), so it didn't yield any bug.
^ That shouldn't be an excuse for using the wrong constraint anyway.
This changes "a" (as an input) to "+a" (as an input and output).
Cc: Thomas Gleixner tglx@linutronix.de Cc: Ingo Molnar mingo@redhat.com Cc: Borislav Petkov bp@alien8.de Cc: Dave Hansen dave.hansen@linux.intel.com Cc: "H. Peter Anvin" hpa@zytor.com Fixes: e01b70ef3eb3080fecc35e15f68cd274c0a48163 ("x86: fix bug in arch/i386/lib/delay.c file, delay_loop function") Signed-off-by: Ammar Faizi ammarfaizi2@gnuweeb.org --- arch/x86/lib/delay.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c index 65d15df6212d..0e65d00e2339 100644 --- a/arch/x86/lib/delay.c +++ b/arch/x86/lib/delay.c @@ -54,8 +54,8 @@ static void delay_loop(u64 __loops) " jnz 2b \n" "3: dec %0 \n"
- : /* we don't need output */ - :"a" (loops) + : "+a" (loops) + : ); }
@bp is a local variable, calling mce_threshold_remove_device() when threshold_create_bank() fails will not free the @bp. Note that mce_threshold_remove_device() frees the @bp only if it's already stored in the @threshold_banks per-CPU variable.
At that point, the @threshold_banks per-CPU variable is still NULL, so the mce_threshold_remove_device() will just be a no-op and the @bp is leaked.
Fix this by storing @bp to @threshold_banks before the loop, so in case we fail, mce_threshold_remove_device() will free the @bp.
This bug is introduced by commit 6458de97fc15530b544 ("x86/mce/amd: Straighten CPU hotplug path") [1].
Link: https://lore.kernel.org/all/20200403161943.1458-6-bp@alien8.de [1]
v3: - Fold in changes from Alviro, the previous version is still leaking @bank[n].
v2: - No changes.
Cc: Borislav Petkov bp@alien8.de Cc: Dave Hansen dave.hansen@linux.intel.com Cc: "H. Peter Anvin" hpa@zytor.com Cc: Ingo Molnar mingo@redhat.com Cc: Thomas Gleixner tglx@linutronix.de Cc: Tony Luck tony.luck@intel.com Fixes: 6458de97fc15530b54477c4e2b70af653e8ac3d9 ("x86/mce/amd: Straighten CPU hotplug path") Cc: stable@vger.kernel.org # v5.8+ Co-authored-by: Alviro Iskandar Setiawan alviro.iskandar@gnuweeb.org Signed-off-by: Alviro Iskandar Setiawan alviro.iskandar@gnuweeb.org Signed-off-by: Ammar Faizi ammarfaizi2@gnuweeb.org --- arch/x86/kernel/cpu/mce/amd.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c index 9f4b508886dd..a5ef161facd9 100644 --- a/arch/x86/kernel/cpu/mce/amd.c +++ b/arch/x86/kernel/cpu/mce/amd.c @@ -1346,19 +1346,23 @@ int mce_threshold_create_device(unsigned int cpu) if (!bp) return -ENOMEM;
+ /* + * If we fail, mce_threshold_remove_device() will free the @bp + * via @threshold_banks. + */ + this_cpu_write(threshold_banks, bp); + for (bank = 0; bank < numbanks; ++bank) { if (!(this_cpu_read(bank_map) & (1 << bank))) continue; err = threshold_create_bank(bp, cpu, bank); - if (err) - goto out_err; + if (err) { + mce_threshold_remove_device(cpu); + return err; + } } - this_cpu_write(threshold_banks, bp);
if (thresholding_irq_en) mce_threshold_vector = amd_threshold_interrupt; return 0; -out_err: - mce_threshold_remove_device(cpu); - return err; }
linux-stable-mirror@lists.linaro.org
-
Ammar Faizi