lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 037/879] x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails
    Date
    From: Ammar Faizi <ammarfaizi2@gnuweeb.org>

    commit e5f28623ceb103e13fc3d7bd45edf9818b227fd0 upstream.

    In mce_threshold_create_device(), if threshold_create_bank() fails, the
    previously allocated threshold banks array @bp will be leaked because
    the call to mce_threshold_remove_device() will not free it.

    This happens because mce_threshold_remove_device() fetches the pointer
    through the threshold_banks per-CPU variable but bp is written there
    only after the bank creation is successful, and not before, when
    threshold_create_bank() fails.

    Add a helper which unwinds all the bank creation work previously done
    and pass into it the previously allocated threshold banks array for
    freeing.

    [ bp: Massage. ]

    Fixes: 6458de97fc15 ("x86/mce/amd: Straighten CPU hotplug path")
    Co-developed-by: Alviro Iskandar Setiawan <alviro.iskandar@gnuweeb.org>
    Signed-off-by: Alviro Iskandar Setiawan <alviro.iskandar@gnuweeb.org>
    Co-developed-by: Yazen Ghannam <yazen.ghannam@amd.com>
    Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
    Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Cc: <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20220329104705.65256-3-ammarfaizi2@gnuweeb.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/x86/kernel/cpu/mce/amd.c | 32 +++++++++++++++++++-------------
    1 file changed, 19 insertions(+), 13 deletions(-)

    --- a/arch/x86/kernel/cpu/mce/amd.c
    +++ b/arch/x86/kernel/cpu/mce/amd.c
    @@ -1294,10 +1294,23 @@ out_free:
    kfree(bank);
    }

    +static void __threshold_remove_device(struct threshold_bank **bp)
    +{
    + unsigned int bank, numbanks = this_cpu_read(mce_num_banks);
    +
    + for (bank = 0; bank < numbanks; bank++) {
    + if (!bp[bank])
    + continue;
    +
    + threshold_remove_bank(bp[bank]);
    + bp[bank] = NULL;
    + }
    + kfree(bp);
    +}
    +
    int mce_threshold_remove_device(unsigned int cpu)
    {
    struct threshold_bank **bp = this_cpu_read(threshold_banks);
    - unsigned int bank, numbanks = this_cpu_read(mce_num_banks);

    if (!bp)
    return 0;
    @@ -1308,13 +1321,7 @@ int mce_threshold_remove_device(unsigned
    */
    this_cpu_write(threshold_banks, NULL);

    - for (bank = 0; bank < numbanks; bank++) {
    - if (bp[bank]) {
    - threshold_remove_bank(bp[bank]);
    - bp[bank] = NULL;
    - }
    - }
    - kfree(bp);
    + __threshold_remove_device(bp);
    return 0;
    }

    @@ -1351,15 +1358,14 @@ int mce_threshold_create_device(unsigned
    if (!(this_cpu_read(bank_map) & (1 << bank)))
    continue;
    err = threshold_create_bank(bp, cpu, bank);
    - if (err)
    - goto out_err;
    + if (err) {
    + __threshold_remove_device(bp);
    + return err;
    + }
    }
    this_cpu_write(threshold_banks, bp);

    if (thresholding_irq_en)
    mce_threshold_vector = amd_threshold_interrupt;
    return 0;
    -out_err:
    - mce_threshold_remove_device(cpu);
    - return err;
    }

    \
     
     \ /
      Last update: 2022-06-07 23:59    [W:2.077 / U:1.620 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site