From patchwork Tue Mar 29 10:47:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ammar Faizi X-Patchwork-Id: 12794654 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4D64C433EF for ; Tue, 29 Mar 2022 10:47:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235380AbiC2KtI (ORCPT ); Tue, 29 Mar 2022 06:49:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46398 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235382AbiC2KtG (ORCPT ); Tue, 29 Mar 2022 06:49:06 -0400 Received: from gnuweeb.org (gnuweeb.org [51.81.211.47]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 40CA82493E1; Tue, 29 Mar 2022 03:47:24 -0700 (PDT) Received: from integral2.. (unknown [182.2.70.161]) by gnuweeb.org (Postfix) with ESMTPSA id 0076C7E72E; Tue, 29 Mar 2022 10:47:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gnuweeb.org; s=default; t=1648550843; bh=ZrvJYaZ/dGXaHa3O2COi7cmDKWMxBGfg7zKTtQwreOY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BYMidkgOUanB8Jk52lhdqv8mYzAyg8q4Ijnp/myJPf7Vgw/ziXMUl85zhC2+7+ztn JsK3WO/cYNkN4jpG4x37opvzFjmOPLZcQFJUXYhZbGfiiWncLAIM9GRmQWOEMnRgLE AYaabsatBt7OPsn3x1D0LNU0G8mT2uOU8kai0gaNCntbCyHksKMfUDvX9rbmOBTfz2 +FHCFVpEUIHEoXxwp3uhYsJbWLc76IRj5nMo/snsUR2VpYINsHKmovy/3zJwjcadbu ISH6A1iT1XDM9DICHKwdYq2Ftj+WJhEXB8NWZcYUxGqf14Nk14g+pmVafuo7OSX72U 0zD/VGonGv9SA== From: Ammar Faizi To: Borislav Petkov , Thomas Gleixner Cc: Ammar Faizi , Alviro Iskandar Setiawan , Dave Hansen , "H. Peter Anvin" , Ingo Molnar , Tony Luck , Yazen Ghannam , Linux Edac Mailing List , Linux Kernel Mailing List , Stable Kernel , GNU/Weeb Mailing List , x86 Mailing List , David Laight , Jiri Hladky Subject: [PATCH v6 1/2] x86/delay: Fix the wrong asm constraint in `delay_loop()` Date: Tue, 29 Mar 2022 17:47:04 +0700 Message-Id: <20220329104705.65256-2-ammarfaizi2@gnuweeb.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20220329104705.65256-1-ammarfaizi2@gnuweeb.org> References: <20220329104705.65256-1-ammarfaizi2@gnuweeb.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-edac@vger.kernel.org The asm constraint does not reflect that the asm statement can modify the value of @loops. But the asm statement in delay_loop() does modify the @loops. Specifiying the wrong constraint may lead to undefined behavior, it may clobber random stuff (e.g. local variable, important temporary value in regs, etc.). This is especially dangerous when the compiler decides to inline the function and since it doesn't know that the value gets modified, it might decide to use it from a register directly without reloading it. Fix this by changing the constraint from "a" (as an input) to "+a" (as an input and output). Cc: David Laight Cc: Jiri Hladky Cc: Alviro Iskandar Setiawan Fixes: e01b70ef3eb3 ("x86: fix bug in arch/i386/lib/delay.c file, delay_loop function") Signed-off-by: Ammar Faizi --- v6: - Remove unnecessary Cc tags. - Update commit message, emphasize the danger when the compiler decides to inline the function. - Fix the Fixes tag sha1. - Remove stable Cc. --- arch/x86/lib/delay.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c index 65d15df6212d..0e65d00e2339 100644 --- a/arch/x86/lib/delay.c +++ b/arch/x86/lib/delay.c @@ -54,8 +54,8 @@ static void delay_loop(u64 __loops) " jnz 2b \n" "3: dec %0 \n" - : /* we don't need output */ - :"a" (loops) + : "+a" (loops) + : ); } From patchwork Tue Mar 29 10:47:05 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ammar Faizi X-Patchwork-Id: 12794655 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5B09C433F5 for ; Tue, 29 Mar 2022 10:47:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235397AbiC2KtS (ORCPT ); Tue, 29 Mar 2022 06:49:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47082 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235399AbiC2KtQ (ORCPT ); Tue, 29 Mar 2022 06:49:16 -0400 Received: from gnuweeb.org (gnuweeb.org [51.81.211.47]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 519C32493FE; Tue, 29 Mar 2022 03:47:30 -0700 (PDT) Received: from integral2.. (unknown [182.2.70.161]) by gnuweeb.org (Postfix) with ESMTPSA id 95FDE7E730; Tue, 29 Mar 2022 10:47:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gnuweeb.org; s=default; t=1648550849; bh=xQLROf1mQKyJFxRsJjuQiVAUI8GU+Wo/R6YJPVHiVwE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WSnV1KwmemuCBpfphq4rfWvdgDUS8kpsXg+KnxzX4XEVkDkXAKI73cIc+aclqdjDl m2ybsuFLrXfciYGO9JkkBUEGcQP/hD3iennfYyPtLjSdYCtnA63SVAkKtJoGw6FYhz /LKOV4G42N6rH53wrNSWdQaSQD0QESHkCVIBO4ZAPEKiXklvSaIhNrz/iIkgu8S5ZS kdwuwP5vQqEow49tZADiIXZAPNxP1wJdXyhT5qmiZieTYZ0gMhqGJzkFesGX0vcoA0 moIy78du6kGSn6MMUqTdJIooT2BGbtyWJbixyuWtGjFVrO0EiJ++m8dKl4BJNQ8f/W sMGXPj1QdAjww== From: Ammar Faizi To: Borislav Petkov , Thomas Gleixner Cc: Ammar Faizi , Alviro Iskandar Setiawan , Dave Hansen , "H. Peter Anvin" , Ingo Molnar , Tony Luck , Yazen Ghannam , Linux Edac Mailing List , Linux Kernel Mailing List , Stable Kernel , GNU/Weeb Mailing List , x86 Mailing List Subject: [PATCH v6 2/2] x86/MCE/AMD: Fix memory leak when `threshold_create_bank()` fails Date: Tue, 29 Mar 2022 17:47:05 +0700 Message-Id: <20220329104705.65256-3-ammarfaizi2@gnuweeb.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20220329104705.65256-1-ammarfaizi2@gnuweeb.org> References: <20220329104705.65256-1-ammarfaizi2@gnuweeb.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-edac@vger.kernel.org In mce_threshold_create_device(), if threshold_create_bank() fails, the @bp will be leaked, because the call to mce_threshold_remove_device() will not free the @bp. mce_threshold_remove_device() frees @threshold_banks. At that point, the @bp has not been written to @threshold_banks, @threshold_banks is NULL, so the call is just a nop. Fix this by extracting the cleanup part into a new static function __threshold_remove_device(), then call it from create/remove device functions. Also, eliminate the "goto out_err", just early return inside the loop if the creation fails. Cc: stable@vger.kernel.org # v5.8+ Fixes: 6458de97fc15 ("x86/mce/amd: Straighten CPU hotplug path") Co-developed-by: Alviro Iskandar Setiawan Signed-off-by: Alviro Iskandar Setiawan Co-developed-by: Yazen Ghannam Signed-off-by: Yazen Ghannam Signed-off-by: Ammar Faizi --- v6: - Change the helper function name to __threshold_remove_device(). --- arch/x86/kernel/cpu/mce/amd.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/arch/x86/kernel/cpu/mce/amd.c b/arch/x86/kernel/cpu/mce/amd.c index 1940d305db1c..d293ae088d6b 100644 --- a/arch/x86/kernel/cpu/mce/amd.c +++ b/arch/x86/kernel/cpu/mce/amd.c @@ -1294,10 +1294,23 @@ static void threshold_remove_bank(struct threshold_bank *bank) kfree(bank); } +static void __threshold_remove_device(struct threshold_bank **bp, + unsigned int numbanks) +{ + unsigned int bank; + + for (bank = 0; bank < numbanks; bank++) { + if (bp[bank]) { + threshold_remove_bank(bp[bank]); + bp[bank] = NULL; + } + } + kfree(bp); +} + int mce_threshold_remove_device(unsigned int cpu) { struct threshold_bank **bp = this_cpu_read(threshold_banks); - unsigned int bank, numbanks = this_cpu_read(mce_num_banks); if (!bp) return 0; @@ -1308,13 +1321,7 @@ int mce_threshold_remove_device(unsigned int cpu) */ this_cpu_write(threshold_banks, NULL); - for (bank = 0; bank < numbanks; bank++) { - if (bp[bank]) { - threshold_remove_bank(bp[bank]); - bp[bank] = NULL; - } - } - kfree(bp); + __threshold_remove_device(bp, this_cpu_read(mce_num_banks)); return 0; } @@ -1351,15 +1358,14 @@ int mce_threshold_create_device(unsigned int cpu) if (!(this_cpu_read(bank_map) & (1 << bank))) continue; err = threshold_create_bank(bp, cpu, bank); - if (err) - goto out_err; + if (err) { + __threshold_remove_device(bp, numbanks); + return err; + } } this_cpu_write(threshold_banks, bp); if (thresholding_irq_en) mce_threshold_vector = amd_threshold_interrupt; return 0; -out_err: - mce_threshold_remove_device(cpu); - return err; }