Commit e5f28623 authored by Ammar Faizi's avatar Ammar Faizi Committed by Borislav Petkov
Browse files

x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails 



In mce_threshold_create_device(), if threshold_create_bank() fails, the
previously allocated threshold banks array @bp will be leaked because
the call to mce_threshold_remove_device() will not free it.

This happens because mce_threshold_remove_device() fetches the pointer
through the threshold_banks per-CPU variable but bp is written there
only after the bank creation is successful, and not before, when
threshold_create_bank() fails.

Add a helper which unwinds all the bank creation work previously done
and pass into it the previously allocated threshold banks array for
freeing.

  [ bp: Massage. ]

Fixes: 6458de97 ("x86/mce/amd: Straighten CPU hotplug path")
Co-developed-by: default avatarAlviro Iskandar Setiawan <alviro.iskandar@gnuweeb.org>
Signed-off-by: default avatarAlviro Iskandar Setiawan <alviro.iskandar@gnuweeb.org>
Co-developed-by: default avatarYazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: default avatarYazen Ghannam <yazen.ghannam@amd.com>
Signed-off-by: default avatarAmmar Faizi <ammarfaizi2@gnuweeb.org>
Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20220329104705.65256-3-ammarfaizi2@gnuweeb.org
parent 9f1b19b9

arch/x86/kernel/cpu/mce/amd.c

+19 −13
Original line number Diff line number Diff line
@@ -1294,10 +1294,23 @@ static void threshold_remove_bank(struct threshold_bank *bank) 
	kfree(bank);

}



static void __threshold_remove_device(struct threshold_bank **bp)

{

	unsigned int bank, numbanks = this_cpu_read(mce_num_banks);



	for (bank = 0; bank < numbanks; bank++) {

		if (!bp[bank])

			continue;



		threshold_remove_bank(bp[bank]);

		bp[bank] = NULL;

	}

	kfree(bp);

}



int mce_threshold_remove_device(unsigned int cpu)

{

	struct threshold_bank **bp = this_cpu_read(threshold_banks);

	unsigned int bank, numbanks = this_cpu_read(mce_num_banks);



	if (!bp)

		return 0;
@@ -1308,13 +1321,7 @@ int mce_threshold_remove_device(unsigned int cpu) 
	 */

	this_cpu_write(threshold_banks, NULL);



	for (bank = 0; bank < numbanks; bank++) {

		if (bp[bank]) {

			threshold_remove_bank(bp[bank]);

			bp[bank] = NULL;

		}

	}

	kfree(bp);

	__threshold_remove_device(bp);

	return 0;

}
@@ -1351,15 +1358,14 @@ int mce_threshold_create_device(unsigned int cpu) 
		if (!(this_cpu_read(bank_map) & (1 << bank)))

			continue;

		err = threshold_create_bank(bp, cpu, bank);

		if (err)

			goto out_err;

		if (err) {

			__threshold_remove_device(bp);

			return err;

		}

	}

	this_cpu_write(threshold_banks, bp);



	if (thresholding_irq_en)

		mce_threshold_vector = amd_threshold_interrupt;

	return 0;

out_err:

	mce_threshold_remove_device(cpu);

	return err;

}