From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1162135AbdAEXx6 (ORCPT ); Thu, 5 Jan 2017 18:53:58 -0500 Received: from TYO202.gate.nec.co.jp ([210.143.35.52]:35439 "EHLO tyo202.gate.nec.co.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753273AbdAEXxv (ORCPT ); Thu, 5 Jan 2017 18:53:51 -0500 From: Junichi Nomura To: Borislav Petkov CC: "x86@kernel.org" , "linux-kernel@vger.kernel.org" , "tglx@linutronix.de" , "mingo@redhat.com" , "hpa@zytor.com" Subject: Re: [PATCH] x86/microcode/intel: Use correct buffer size for saving microcode data Thread-Topic: [PATCH] x86/microcode/intel: Use correct buffer size for saving microcode data Thread-Index: AQHSZu9vqgnO4kFiAUe6xBh2gmLlJqEouEeAgABczoCAAOJyAA== Date: Thu, 5 Jan 2017 23:47:56 +0000 Message-ID: References: <4f33cbfd-44f2-9bed-3b66-7446cd14256f@ce.jp.nec.com> <20170105101727.jutfvokxxdi4hxl6@pd.tnic> In-Reply-To: <20170105101727.jutfvokxxdi4hxl6@pd.tnic> Accept-Language: en-US, ja-JP Content-Language: ja-JP X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.34.125.85] Content-Type: text/plain; charset="utf-8" Content-ID: MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by mail.home.local id v05Ns1Eu028903 On 01/05/17 19:17, Borislav Petkov wrote: > On Thu, Jan 05, 2017 at 04:45:18AM +0000, Junichi Nomura wrote: >> In generic_load_microcode(), curr_mc_size is the size of the last >> allocated buffer and could be smaller than the actual size of the >> buffer pointed to by "new_mc". >> >> Without this fix, we could get oops like this: >> >> BUG: unable to handle kernel paging request at ffffc9000e30f000 >> IP: __memcpy+0x12/0x20 >> ... >> Call Trace: >> ? kmemdup+0x43/0x60 >> __alloc_microcode_buf+0x44/0x70 >> save_microcode_patch+0xd4/0x150 >> generic_load_microcode+0x1b8/0x260 >> request_microcode_user+0x15/0x20 > > I see you're using the old interface but how exactly do you trigger > this, i.e., can you give me the blob you're using and the exact steps > you're performing? I'd like to reproduce it here. I'm seeing this on RHEL6-based userspace, where 'microcode_ctl -Qu' is run from udev automatically when microcode driver is loaded. The version of microcode_ctl is 1.17. The problem can be reproduced either with the one in RHEL6 ( microcode-20151106.dat) or with the latest blob from Intel, i.e. microcode-20161104.tgz. -- Jun'ichi Nomura, NEC Corporation / NEC Solution Innovators, Ltd.