From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from integral2.. (unknown [182.2.70.248]) by gnuweeb.org (Postfix) with ESMTPSA id 284457ED80; Tue, 1 Mar 2022 09:46:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gnuweeb.org; s=default; t=1646128012; bh=j98NA/icKc1vIKoEwnqpn4Du2N9NevWPX/k0GkOdjAQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fm5AOB6qvULrfkk5Xz+tfEN27TFtT2xY2zQScl9ibHQTSJXY3u0R6VgJuLevnXhh3 dw027FYdZ1dRhgPbsTkhjuvnELrSjCPWEOvDmte6ZpF7J/KcgGaP9WGdzVWN8x433s lQRwhhfXNBpohckavPsAhFPfeIYHuqctJwB7RVjKNWw6IiQY36qGmEM2QpudJgAoNz lI4oQ5dMwv7Q8vjs9ZZvngYqbdcyQiv1VrcS0i07+oE8e7zbFP/X6qd+iMYPve/0Pg 2/4Poa3lHEvPJVRAKh/s4DbO2Uo5Qre0viSbf0R4o1mUy35oAAQKs8WDvry8HVDyqo Kd82nPyya9FjQ== From: Ammar Faizi To: Borislav Petkov Cc: Dave Hansen , "H. Peter Anvin" , Ingo Molnar , Thomas Gleixner , Tony Luck , linux-edac@vger.kernel.org, linux-kernel@vger.kernel.org, gwml@vger.gnuweeb.org, x86@kernel.org, stable@vger.kernel.org, Alviro Iskandar Setiawan , Jiri Hladky , Greg Kroah-Hartman , Ammar Faizi Subject: [PATCH v4 2/2] x86/mce/amd: Fix memory leak when `threshold_create_bank()` fails Date: Tue, 1 Mar 2022 16:46:08 +0700 Message-Id: <20220301094608.118879-3-ammarfaizi2@gnuweeb.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20220301094608.118879-1-ammarfaizi2@gnuweeb.org> References: <20220301094608.118879-1-ammarfaizi2@gnuweeb.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit List-Id: From: Ammar Faizi @bp is a local variable, calling mce_threshold_remove_device() when threshold_create_bank() fails will not free the @bp. Note that mce_threshold_remove_device() frees the @bp only if it's already stored in the @threshold_banks per-CPU variable. At that point, the @threshold_banks per-CPU variable is still NULL, so the mce_threshold_remove_device() will just be a no-op and the @bp is leaked. Fix this by storing @bp to @threshold_banks before the loop, so in case we fail, mce_threshold_remove_device() will free the @bp. This bug is introduced by commit 6458de97fc15530b544 ("x86/mce/amd: Straighten CPU hotplug path") [1]. Link: https://lore.kernel.org/all/20200403161943.1458-6-bp@alien8.de [1] v4: - Add the link to the commit reference again. v3: - Fold in changes from Alviro, the previous version is still leaking @bank[n]. v2: - No changes. Cc: Borislav Petkov Cc: Dave Hansen Cc: Greg Kroah-Hartman Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Tony Luck Cc: stable@vger.kernel.org # v5.8+ Fixes: 6458de97fc15 ("x86/mce/amd: Straighten CPU hotplug path") Co-authored-by: Alviro Iskandar Setiawan Signed-off-by: Alviro Iskandar Setiawan Signed-off-by: Ammar Faizi --- arch/x86/kernel/cpu/mce/amd.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c index 9f4b508886dd..a5ef161facd9 100644 --- a/arch/x86/kernel/cpu/mce/amd.c +++ b/arch/x86/kernel/cpu/mce/amd.c @@ -1346,19 +1346,23 @@ int mce_threshold_create_device(unsigned int cpu) if (!bp) return -ENOMEM; + /* + * If we fail, mce_threshold_remove_device() will free the @bp + * via @threshold_banks. + */ + this_cpu_write(threshold_banks, bp); + for (bank = 0; bank < numbanks; ++bank) { if (!(this_cpu_read(bank_map) & (1 << bank))) continue; err = threshold_create_bank(bp, cpu, bank); - if (err) - goto out_err; + if (err) { + mce_threshold_remove_device(cpu); + return err; + } } - this_cpu_write(threshold_banks, bp); if (thresholding_irq_en) mce_threshold_vector = amd_threshold_interrupt; return 0; -out_err: - mce_threshold_remove_device(cpu); - return err; } -- 2.32.0