From: Ammar Faizi <[email protected]>
To: Borislav Petkov <[email protected]>
Cc: Dave Hansen <[email protected]>,
"H. Peter Anvin" <[email protected]>, Ingo Molnar <[email protected]>,
Thomas Gleixner <[email protected]>,
Tony Luck <[email protected]>,
[email protected], [email protected],
[email protected], [email protected], [email protected],
Ammar Faizi <[email protected]>
Subject: [PATCH 0/2] Two x86 fixes
Date: Tue, 1 Mar 2022 14:32:21 +0700 [thread overview]
Message-ID: <[email protected]> (raw)
Hi,
Two fixes for x86 arch.
[PATCH 1/2] x86/delay: Fix the wrong asm constraint in `delay_loop()`
The asm constraint does not reflect that the asm statement can modify
the value of @loops. But the asm statement in delay_loop() does change
the @loops.
If by any chance the compiler inlines this function, it may clobber
random stuff (e.g. local variable, important temporary value in reg,
etc.).
Fortunately, delay_loop() is only called indirectly (so it can't
inline), and then the register it clobbers is %rax (which is by the
nature of the calling convention, it's a caller saved register), so it
didn't yield any bug.
^ That shouldn't be an excuse for using the wrong constraint anyway.
This changes "a" (as an input) to "+a" (as an input and output).
[PATCH 2/2] x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails.
@bp is a local variable, calling mce_threshold_remove_device() when
threshold_create_bank() fails will not free the @bp. Note that
mce_threshold_remove_device() frees the @bp only if it's already
stored in the @threshold_banks per-CPU variable.
At that point, the @threshold_banks per-CPU variable is still NULL,
so the mce_threshold_remove_device() will just be a no-op and the
@bp is leaked.
Fix this by calling kfree() and early returning when we fail.
This bug is introduced by commit 6458de97fc15530b544 ("x86/mce/amd:
Straighten CPU hotplug path") [1].
Link: https://lore.kernel.org/all/[email protected] [1]
v2:
- Fix wrong copy/paste.
Cc: Borislav Petkov <[email protected]>
Cc: Dave Hansen <[email protected]>
Cc: "H. Peter Anvin" <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Tony Luck <[email protected]>
Signed-off-by: Ammar Faizi <[email protected]>
---
Ammar Faizi (2):
x86/delay: Fix the wrong asm constraint in `delay_loop()`
x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails
arch/x86/kernel/cpu/mce/amd.c | 9 ++++-----
arch/x86/lib/delay.c | 4 ++--
2 files changed, 6 insertions(+), 7 deletions(-)
base-commit: 7e57714cd0ad2d5bb90e50b5096a0e671dec1ef3
--
2.32.0
next reply other threads:[~2022-03-01 7:32 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-01 7:32 Ammar Faizi [this message]
2022-03-01 7:32 ` [PATCH v2 1/2] x86/delay: Fix the wrong asm constraint in `delay_loop()` Ammar Faizi
2022-03-01 8:26 ` Greg KH
2022-03-01 8:46 ` Ammar Faizi
2022-03-01 7:32 ` [PATCH v2 2/2] x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails Ammar Faizi
-- strict thread matches above, loose matches on Subject: below --
2022-03-01 7:23 [PATCH 0/2] Two x86 fixes Ammar Faizi
2022-03-01 7:29 ` Ammar Faizi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
[email protected] \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox