* [PATCH v3 0/2] Two x86 fixes
@ 2022-03-01 8:11 Ammar Faizi
2022-03-01 8:11 ` [PATCH v3 1/2] x86/delay: Fix the wrong asm constraint in `delay_loop()` Ammar Faizi
2022-03-01 8:11 ` [PATCH v3 2/2] x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails Ammar Faizi
0 siblings, 2 replies; 3+ messages in thread
From: Ammar Faizi @ 2022-03-01 8:11 UTC (permalink / raw)
To: Borislav Petkov
Cc: Dave Hansen, H. Peter Anvin, Ingo Molnar, Thomas Gleixner,
Tony Luck, linux-edac, linux-kernel, gwml, x86, stable,
Alviro Iskandar Setiawan, Ammar Faizi
Hi,
Two fixes for x86 arch.
## Changelog
v3:
- Fold in changes from Alviro, the previous version is still
leaking @bank[n].
v2:
- Fix wrong copy/paste.
## Summary
[PATCH v3 1/2] x86/delay: Fix the wrong asm constraint in `delay_loop()`
The asm constraint does not reflect that the asm statement can modify
the value of @loops. But the asm statement in delay_loop() does change
the @loops.
If by any chance the compiler inlines this function, it may clobber
random stuff (e.g. local variable, important temporary value in reg,
etc.).
Fortunately, delay_loop() is only called indirectly (so it can't
inline), and then the register it clobbers is %rax (which is by the
nature of the calling convention, it's a caller saved register), so it
didn't yield any bug.
^ That shouldn't be an excuse for using the wrong constraint anyway.
This changes "a" (as an input) to "+a" (as an input and output).
[PATCH v3 2/2] x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails.
@bp is a local variable, calling mce_threshold_remove_device() when
threshold_create_bank() fails will not free the @bp. Note that
mce_threshold_remove_device() frees the @bp only if it's already
stored in the @threshold_banks per-CPU variable.
At that point, the @threshold_banks per-CPU variable is still NULL,
so the mce_threshold_remove_device() will just be a no-op and the
@bp is leaked.
Fix this by storing @bp to @threshold_banks before the loop, so in
case we fail, mce_threshold_remove_device() will free the @bp.
This bug is introduced by commit 6458de97fc15530b544 ("x86/mce/amd:
Straighten CPU hotplug path") [1].
Cc: Borislav Petkov <[email protected]>
Cc: Dave Hansen <[email protected]>
Cc: "H. Peter Anvin" <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Tony Luck <[email protected]>
Signed-off-by: Alviro Iskandar Setiawan <[email protected]>
Signed-off-by: Ammar Faizi <[email protected]>
---
Ammar Faizi (2):
x86/delay: Fix the wrong asm constraint in `delay_loop()`
x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails
arch/x86/kernel/cpu/mce/amd.c | 16 ++++++++++------
arch/x86/lib/delay.c | 4 ++--
2 files changed, 12 insertions(+), 8 deletions(-)
base-commit: 7e57714cd0ad2d5bb90e50b5096a0e671dec1ef3
--
2.32.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH v3 1/2] x86/delay: Fix the wrong asm constraint in `delay_loop()`
2022-03-01 8:11 [PATCH v3 0/2] Two x86 fixes Ammar Faizi
@ 2022-03-01 8:11 ` Ammar Faizi
2022-03-01 8:11 ` [PATCH v3 2/2] x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails Ammar Faizi
1 sibling, 0 replies; 3+ messages in thread
From: Ammar Faizi @ 2022-03-01 8:11 UTC (permalink / raw)
To: Borislav Petkov
Cc: Dave Hansen, H. Peter Anvin, Ingo Molnar, Thomas Gleixner,
Tony Luck, linux-edac, linux-kernel, gwml, x86, stable,
Alviro Iskandar Setiawan, Ammar Faizi
The asm constraint does not reflect that the asm statement can modify
the value of @loops. But the asm statement in delay_loop() does change
the @loops.
If by any chance the compiler inlines this function, it may clobber
random stuff (e.g. local variable, important temporary value in reg,
etc.).
Fortunately, delay_loop() is only called indirectly (so it can't
inline), and then the register it clobbers is %rax (which is by the
nature of the calling convention, it's a caller saved register), so it
didn't yield any bug.
^ That shouldn't be an excuse for using the wrong constraint anyway.
This changes "a" (as an input) to "+a" (as an input and output).
Cc: Thomas Gleixner <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Dave Hansen <[email protected]>
Cc: "H. Peter Anvin" <[email protected]>
Fixes: e01b70ef3eb3080fecc35e15f68cd274c0a48163 ("x86: fix bug in arch/i386/lib/delay.c file, delay_loop function")
Signed-off-by: Ammar Faizi <[email protected]>
---
arch/x86/lib/delay.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
index 65d15df6212d..0e65d00e2339 100644
--- a/arch/x86/lib/delay.c
+++ b/arch/x86/lib/delay.c
@@ -54,8 +54,8 @@ static void delay_loop(u64 __loops)
" jnz 2b \n"
"3: dec %0 \n"
- : /* we don't need output */
- :"a" (loops)
+ : "+a" (loops)
+ :
);
}
--
2.32.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH v3 2/2] x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails
2022-03-01 8:11 [PATCH v3 0/2] Two x86 fixes Ammar Faizi
2022-03-01 8:11 ` [PATCH v3 1/2] x86/delay: Fix the wrong asm constraint in `delay_loop()` Ammar Faizi
@ 2022-03-01 8:11 ` Ammar Faizi
1 sibling, 0 replies; 3+ messages in thread
From: Ammar Faizi @ 2022-03-01 8:11 UTC (permalink / raw)
To: Borislav Petkov
Cc: Dave Hansen, H. Peter Anvin, Ingo Molnar, Thomas Gleixner,
Tony Luck, linux-edac, linux-kernel, gwml, x86, stable,
Alviro Iskandar Setiawan, Ammar Faizi
@bp is a local variable, calling mce_threshold_remove_device() when
threshold_create_bank() fails will not free the @bp. Note that
mce_threshold_remove_device() frees the @bp only if it's already
stored in the @threshold_banks per-CPU variable.
At that point, the @threshold_banks per-CPU variable is still NULL,
so the mce_threshold_remove_device() will just be a no-op and the
@bp is leaked.
Fix this by storing @bp to @threshold_banks before the loop, so in
case we fail, mce_threshold_remove_device() will free the @bp.
This bug is introduced by commit 6458de97fc15530b544 ("x86/mce/amd:
Straighten CPU hotplug path") [1].
Link: https://lore.kernel.org/all/[email protected] [1]
v3:
- Fold in changes from Alviro, the previous version is still
leaking @bank[n].
v2:
- No changes.
Cc: Borislav Petkov <[email protected]>
Cc: Dave Hansen <[email protected]>
Cc: "H. Peter Anvin" <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Tony Luck <[email protected]>
Fixes: 6458de97fc15530b54477c4e2b70af653e8ac3d9 ("x86/mce/amd: Straighten CPU hotplug path")
Cc: [email protected] # v5.8+
Co-authored-by: Alviro Iskandar Setiawan <[email protected]>
Signed-off-by: Alviro Iskandar Setiawan <[email protected]>
Signed-off-by: Ammar Faizi <[email protected]>
---
arch/x86/kernel/cpu/mce/amd.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c
index 9f4b508886dd..a5ef161facd9 100644
--- a/arch/x86/kernel/cpu/mce/amd.c
+++ b/arch/x86/kernel/cpu/mce/amd.c
@@ -1346,19 +1346,23 @@ int mce_threshold_create_device(unsigned int cpu)
if (!bp)
return -ENOMEM;
+ /*
+ * If we fail, mce_threshold_remove_device() will free the @bp
+ * via @threshold_banks.
+ */
+ this_cpu_write(threshold_banks, bp);
+
for (bank = 0; bank < numbanks; ++bank) {
if (!(this_cpu_read(bank_map) & (1 << bank)))
continue;
err = threshold_create_bank(bp, cpu, bank);
- if (err)
- goto out_err;
+ if (err) {
+ mce_threshold_remove_device(cpu);
+ return err;
+ }
}
- this_cpu_write(threshold_banks, bp);
if (thresholding_irq_en)
mce_threshold_vector = amd_threshold_interrupt;
return 0;
-out_err:
- mce_threshold_remove_device(cpu);
- return err;
}
--
2.32.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-03-01 8:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-01 8:11 [PATCH v3 0/2] Two x86 fixes Ammar Faizi
2022-03-01 8:11 ` [PATCH v3 1/2] x86/delay: Fix the wrong asm constraint in `delay_loop()` Ammar Faizi
2022-03-01 8:11 ` [PATCH v3 2/2] x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails Ammar Faizi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox