From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751781AbdGSEVk (ORCPT ); Wed, 19 Jul 2017 00:21:40 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37676 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751179AbdGSEVj (ORCPT ); Wed, 19 Jul 2017 00:21:39 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com C3A7E61BB0 Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx10.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=shuwang@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com C3A7E61BB0 From: shuwang@redhat.com To: bp@alien8.de, tglx@linutronix.de, mingo@redhat.com, hpa@zytor.com Cc: x86@kernel.org, linux-kernel@vger.kernel.org, liwang@redhat.com, chuhu@redhat.com, Shu Wang Subject: [PATCH] x86/microcode/AMD: fix memleak in update_cache() Date: Wed, 19 Jul 2017 12:21:23 +0800 Message-Id: <1500438083-15996-1-git-send-email-shuwang@redhat.com> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Wed, 19 Jul 2017 04:21:39 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Shu Wang Found this issue by kmemleak. The mem is allocated in verify_and_add_patch(), passed to update_cache(patch), and just dropped the reference without free if (p->patch_id >= new_patch->patch_id) return; unreferenced object 0xffff88010e780b40 (size 32): comm "bash", pid 860, jiffies 4294690939 (age 29.297s) backtrace: [] kmemleak_alloc+0x4a/0xa0 [] kmem_cache_alloc_trace+0xca/0x1d0 [] load_microcode_amd.isra.0+0x1d0/0x400 [] request_microcode_amd+0xc3/0x160 [] reload_store+0xe1/0x170 [] dev_attr_store+0x18/0x30 [] sysfs_kf_write+0x3a/0x50 [] kernfs_fop_write+0xff/0x180 [] __vfs_write+0x37/0x170 [] vfs_write+0xb2/0x1b0 [] SyS_write+0x55/0xc0 [] do_syscall_64+0x67/0x150 [] return_from_SYSCALL_64+0x0/0x6a [] 0xffffffffffffffff (gdb) list *0xffffffff81050d60 0xffffffff81050d60 is in load_microcode_amd (arch/x86/kernel/cpu/microcode/amd.c:616). Signed-off-by: Shu Wang --- arch/x86/kernel/cpu/microcode/amd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c index 21b1857..c6daec4 100644 --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -400,9 +400,12 @@ static void update_cache(struct ucode_patch *new_patch) list_for_each_entry(p, µcode_cache, plist) { if (p->equiv_cpu == new_patch->equiv_cpu) { - if (p->patch_id >= new_patch->patch_id) + if (p->patch_id >= new_patch->patch_id) { /* we already have the latest patch */ + kfree(new_patch->data); + kfree(new_patch); return; + } list_replace(&p->plist, &new_patch->plist); kfree(p->data); -- 2.5.0