xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails

Browse Source 
commit e5f28623ceb103e13fc3d7bd45edf9818b227fd0 upstream.

In mce_threshold_create_device(), if threshold_create_bank() fails, the
previously allocated threshold banks array @bp will be leaked because
the call to mce_threshold_remove_device() will not free it.

This happens because mce_threshold_remove_device() fetches the pointer
through the threshold_banks per-CPU variable but bp is written there
only after the bank creation is successful, and not before, when
threshold_create_bank() fails.

Add a helper which unwinds all the bank creation work previously done
and pass into it the previously allocated threshold banks array for
freeing.

  [ bp: Massage. ]

Fixes: 6458de97fc ("x86/mce/amd: Straighten CPU hotplug path")
Co-developed-by: Alviro Iskandar Setiawan <alviro.iskandar@gnuweeb.org>
Signed-off-by: Alviro Iskandar Setiawan <alviro.iskandar@gnuweeb.org>
Co-developed-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Yazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220329104705.65256-3-ammarfaizi2@gnuweeb.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ammar Faizi
2022-03-29 17:47:05 +07:00
committed by Greg Kroah-Hartman
parent 860e44f21f
commit b4acb8e7f1
1 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
arch/x86/kernel/cpu/mce/amd.c
View File

@@ -1457,10 +1457,23 @@ out_free:
kfree(bank); kfree(bank);
} }
static void __threshold_remove_device(struct threshold_bank **bp)
{
unsigned int bank, numbanks = this_cpu_read(mce_num_banks);
for (bank = 0; bank < numbanks; bank++) {
if (!bp[bank])
continue;
threshold_remove_bank(bp[bank]);
bp[bank] = NULL;
}
kfree(bp);
}
int mce_threshold_remove_device(unsigned int cpu) int mce_threshold_remove_device(unsigned int cpu)
{ {
struct threshold_bank **bp = this_cpu_read(threshold_banks); struct threshold_bank **bp = this_cpu_read(threshold_banks);
unsigned int bank, numbanks = this_cpu_read(mce_num_banks);
if (!bp) if (!bp)
return 0; return 0;
@@ -1471,13 +1484,7 @@ int mce_threshold_remove_device(unsigned int cpu)
*/ */
this_cpu_write(threshold_banks, NULL); this_cpu_write(threshold_banks, NULL);
for (bank = 0; bank < numbanks; bank++) { __threshold_remove_device(bp);
if (bp[bank]) {
threshold_remove_bank(bp[bank]);
bp[bank] = NULL;
}
}
kfree(bp);
return 0; return 0;
} }
@@ -1514,15 +1521,14 @@ int mce_threshold_create_device(unsigned int cpu)
if (!(this_cpu_read(bank_map) & (1 << bank))) if (!(this_cpu_read(bank_map) & (1 << bank)))
continue; continue;
err = threshold_create_bank(bp, cpu, bank); err = threshold_create_bank(bp, cpu, bank);
if (err) if (err) {
goto out_err; __threshold_remove_device(bp);
return err;
}
} }
this_cpu_write(threshold_banks, bp); this_cpu_write(threshold_banks, bp);
if (thresholding_irq_en) if (thresholding_irq_en)
mce_threshold_vector = amd_threshold_interrupt; mce_threshold_vector = amd_threshold_interrupt;
return 0; return 0;
out_err:
mce_threshold_remove_device(cpu);
return err;
} }