From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S970025AbdAEBz2 convert rfc822-to-8bit (ORCPT ); Wed, 4 Jan 2017 20:55:28 -0500 Received: from TYO200.gate.nec.co.jp ([210.143.35.50]:57116 "EHLO tyo200.gate.nec.co.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966247AbdAEBz0 (ORCPT ); Wed, 4 Jan 2017 20:55:26 -0500 X-Greylist: delayed 2762 seconds by postgrey-1.27 at vger.kernel.org; Wed, 04 Jan 2017 20:49:30 EST From: Junichi Nomura To: "bp@alien8.de" , "x86@kernel.org" , "linux-kernel@vger.kernel.org" CC: "tglx@linutronix.de" , "mingo@redhat.com" , "hpa@zytor.com" Subject: [PATCH] x86/microcode/intel: Use correct buffer size for saving microcode data Thread-Topic: [PATCH] x86/microcode/intel: Use correct buffer size for saving microcode data Thread-Index: AQHSZu9vqgnO4kFiAUe6xBh2gmLlJg== Date: Thu, 5 Jan 2017 01:02:51 +0000 Message-ID: Accept-Language: en-US, ja-JP Content-Language: ja-JP X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.34.125.85] Content-Type: text/plain; charset="iso-2022-jp" Content-ID: <415977B97F5227409EEC21A2F4DBE6F8@gisp.nec.co.jp> Content-Transfer-Encoding: 8BIT MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In generic_load_microcode(), curr_mc_size is the size of the last allocated buffer and not always the size of the buffer pointed to by "new_mc". Without this fix, we could get oops like this: BUG: unable to handle kernel paging request at ffffc9000e30f000 IP: __memcpy+0x12/0x20 ... Call Trace: ? kmemdup+0x43/0x60 __alloc_microcode_buf+0x44/0x70 save_microcode_patch+0xd4/0x150 generic_load_microcode+0x1b8/0x260 request_microcode_user+0x15/0x20 microcode_write+0x91/0x100 __vfs_write+0x34/0x120 vfs_write+0xc1/0x130 SyS_write+0x56/0xc0 do_syscall_64+0x6c/0x160 entry_SYSCALL64_slow_path+0x25/0x25 Signed-off-by: Jun'ichi Nomura Fixes: 06b8534cb728 ("x86/microcode: Rework microcode loading") diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c index faec8fa..aee3cb5 100644 --- a/arch/x86/kernel/cpu/microcode/intel.c +++ b/arch/x86/kernel/cpu/microcode/intel.c @@ -823,7 +823,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, u8 *ucode_ptr = data, *new_mc = NULL, *mc = NULL; int new_rev = uci->cpu_sig.rev; unsigned int leftover = size; - unsigned int curr_mc_size = 0; + unsigned int curr_mc_size = 0, new_mc_size = 0; unsigned int csig, cpf; while (leftover) { @@ -864,6 +864,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, vfree(new_mc); new_rev = mc_header.rev; new_mc = mc; + new_mc_size = curr_mc_size; mc = NULL; /* trigger new vmalloc */ } @@ -889,7 +890,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, * permanent memory. So it will be loaded early when a CPU is hot added * or resumes. */ - save_mc_for_early(new_mc, curr_mc_size); + save_mc_for_early(new_mc, new_mc_size); pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n", cpu, new_rev, uci->cpu_sig.rev); -- Jun'ichi Nomura, NEC Corporation / NEC Solution Innovators, Ltd.