* [PATCH v3] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
@ 2017-05-31 17:39 Prarit Bhargava
2017-05-31 19:42 ` Jeff Moyer
2017-05-31 19:46 ` Vishal Verma
0 siblings, 2 replies; 6+ messages in thread
From: Prarit Bhargava @ 2017-05-31 17:39 UTC (permalink / raw)
To: linux-acpi
Cc: Prarit Bhargava, Rafael J. Wysocki, Len Brown, Dan Williams,
Vishal Verma, Lee, Chun-Yi, Linda Knippers, jmoyer, lszubowi
nfit_init() calls nfit_mce_register() on module load. When the module
load fails the nfit mce decoder is not unregistered. The module's
memory is freed leaving the decoder chain referencing junk. This will
cause panics as future registrations will reference the free'd memory.
Unregister the nfit mce decoder on module init failure.
[v2]: register and then unregister mce handler to avoid losing mce events
[v3]: also cleanup nfit workqueue
Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Cc: Len Brown <lenb@kernel.org>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
Cc: Linda Knippers <linda.knippers@hpe.com>
Cc: jmoyer@redhat.com
Cc: lszubowi@redhat.com
---
drivers/acpi/nfit/core.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 656acb5d7166..f3c3e9d4563c 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -3043,6 +3043,8 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
static __init int nfit_init(void)
{
+ int ret;
+
BUILD_BUG_ON(sizeof(struct acpi_table_nfit) != 40);
BUILD_BUG_ON(sizeof(struct acpi_nfit_system_address) != 56);
BUILD_BUG_ON(sizeof(struct acpi_nfit_memory_map) != 48);
@@ -3070,8 +3072,14 @@ static __init int nfit_init(void)
return -ENOMEM;
nfit_mce_register();
+ ret = acpi_bus_register_driver(&acpi_nfit_driver);
+ if (ret) {
+ nfit_mce_unregister();
+ destroy_workqueue(nfit_wq);
+ }
+
+ return ret;
- return acpi_bus_register_driver(&acpi_nfit_driver);
}
static __exit void nfit_exit(void)
--
1.7.9.3
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH v3] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
2017-05-31 17:39 [PATCH v3] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure Prarit Bhargava
@ 2017-05-31 19:42 ` Jeff Moyer
2017-05-31 19:46 ` Vishal Verma
1 sibling, 0 replies; 6+ messages in thread
From: Jeff Moyer @ 2017-05-31 19:42 UTC (permalink / raw)
To: Prarit Bhargava
Cc: linux-acpi, Rafael J. Wysocki, Len Brown, Dan Williams,
Vishal Verma, Lee, Chun-Yi, Linda Knippers, lszubowi
Prarit Bhargava <prarit@redhat.com> writes:
> nfit_init() calls nfit_mce_register() on module load. When the module
> load fails the nfit mce decoder is not unregistered. The module's
> memory is freed leaving the decoder chain referencing junk. This will
> cause panics as future registrations will reference the free'd memory.
>
> Unregister the nfit mce decoder on module init failure.
>
> [v2]: register and then unregister mce handler to avoid losing mce events
> [v3]: also cleanup nfit workqueue
>
> Signed-off-by: Prarit Bhargava <prarit@redhat.com>
> Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
> Cc: Len Brown <lenb@kernel.org>
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: Vishal Verma <vishal.l.verma@intel.com>
> Cc: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
> Cc: Linda Knippers <linda.knippers@hpe.com>
> Cc: jmoyer@redhat.com
> Cc: lszubowi@redhat.com
> ---
> drivers/acpi/nfit/core.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
> index 656acb5d7166..f3c3e9d4563c 100644
> --- a/drivers/acpi/nfit/core.c
> +++ b/drivers/acpi/nfit/core.c
> @@ -3043,6 +3043,8 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
>
> static __init int nfit_init(void)
> {
> + int ret;
> +
> BUILD_BUG_ON(sizeof(struct acpi_table_nfit) != 40);
> BUILD_BUG_ON(sizeof(struct acpi_nfit_system_address) != 56);
> BUILD_BUG_ON(sizeof(struct acpi_nfit_memory_map) != 48);
> @@ -3070,8 +3072,14 @@ static __init int nfit_init(void)
> return -ENOMEM;
>
> nfit_mce_register();
> + ret = acpi_bus_register_driver(&acpi_nfit_driver);
> + if (ret) {
> + nfit_mce_unregister();
> + destroy_workqueue(nfit_wq);
> + }
> +
> + return ret;
>
> - return acpi_bus_register_driver(&acpi_nfit_driver);
> }
>
> static __exit void nfit_exit(void)
Acked-by: Jeff Moyer <jmoyer@redhat.com>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v3] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
2017-05-31 17:39 [PATCH v3] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure Prarit Bhargava
2017-05-31 19:42 ` Jeff Moyer
@ 2017-05-31 19:46 ` Vishal Verma
2017-07-17 15:19 ` Prarit Bhargava
1 sibling, 1 reply; 6+ messages in thread
From: Vishal Verma @ 2017-05-31 19:46 UTC (permalink / raw)
To: Prarit Bhargava
Cc: linux-acpi, Rafael J. Wysocki, Len Brown, Dan Williams,
Lee, Chun-Yi, Linda Knippers, jmoyer, lszubowi
On 05/31, Prarit Bhargava wrote:
> nfit_init() calls nfit_mce_register() on module load. When the module
> load fails the nfit mce decoder is not unregistered. The module's
> memory is freed leaving the decoder chain referencing junk. This will
> cause panics as future registrations will reference the free'd memory.
>
> Unregister the nfit mce decoder on module init failure.
>
> [v2]: register and then unregister mce handler to avoid losing mce events
> [v3]: also cleanup nfit workqueue
>
> Signed-off-by: Prarit Bhargava <prarit@redhat.com>
> Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
> Cc: Len Brown <lenb@kernel.org>
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: Vishal Verma <vishal.l.verma@intel.com>
> Cc: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
> Cc: Linda Knippers <linda.knippers@hpe.com>
> Cc: jmoyer@redhat.com
> Cc: lszubowi@redhat.com
> ---
> drivers/acpi/nfit/core.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
Looks good, you can add:
Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
>
> diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
> index 656acb5d7166..f3c3e9d4563c 100644
> --- a/drivers/acpi/nfit/core.c
> +++ b/drivers/acpi/nfit/core.c
> @@ -3043,6 +3043,8 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
>
> static __init int nfit_init(void)
> {
> + int ret;
> +
> BUILD_BUG_ON(sizeof(struct acpi_table_nfit) != 40);
> BUILD_BUG_ON(sizeof(struct acpi_nfit_system_address) != 56);
> BUILD_BUG_ON(sizeof(struct acpi_nfit_memory_map) != 48);
> @@ -3070,8 +3072,14 @@ static __init int nfit_init(void)
> return -ENOMEM;
>
> nfit_mce_register();
> + ret = acpi_bus_register_driver(&acpi_nfit_driver);
> + if (ret) {
> + nfit_mce_unregister();
> + destroy_workqueue(nfit_wq);
> + }
> +
> + return ret;
>
> - return acpi_bus_register_driver(&acpi_nfit_driver);
> }
>
> static __exit void nfit_exit(void)
> --
> 1.7.9.3
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v3] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
2017-05-31 19:46 ` Vishal Verma
@ 2017-07-17 15:19 ` Prarit Bhargava
2017-07-17 16:52 ` Dan Williams
0 siblings, 1 reply; 6+ messages in thread
From: Prarit Bhargava @ 2017-07-17 15:19 UTC (permalink / raw)
To: Vishal Verma
Cc: linux-acpi, Rafael J. Wysocki, Len Brown, Dan Williams,
Lee, Chun-Yi, Linda Knippers, jmoyer, lszubowi
Rafael?
ping? It's been almost two months ...
P.
On 05/31/2017 03:46 PM, Vishal Verma wrote:
> On 05/31, Prarit Bhargava wrote:
>> nfit_init() calls nfit_mce_register() on module load. When the module
>> load fails the nfit mce decoder is not unregistered. The module's
>> memory is freed leaving the decoder chain referencing junk. This will
>> cause panics as future registrations will reference the free'd memory.
>>
>> Unregister the nfit mce decoder on module init failure.
>>
>> [v2]: register and then unregister mce handler to avoid losing mce events
>> [v3]: also cleanup nfit workqueue
>>
>> Signed-off-by: Prarit Bhargava <prarit@redhat.com>
>> Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
>> Cc: Len Brown <lenb@kernel.org>
>> Cc: Dan Williams <dan.j.williams@intel.com>
>> Cc: Vishal Verma <vishal.l.verma@intel.com>
>> Cc: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
>> Cc: Linda Knippers <linda.knippers@hpe.com>
>> Cc: jmoyer@redhat.com
>> Cc: lszubowi@redhat.com
>> ---
>> drivers/acpi/nfit/core.c | 10 +++++++++-
>> 1 file changed, 9 insertions(+), 1 deletion(-)
>
> Looks good, you can add:
> Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
>
>>
>> diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
>> index 656acb5d7166..f3c3e9d4563c 100644
>> --- a/drivers/acpi/nfit/core.c
>> +++ b/drivers/acpi/nfit/core.c
>> @@ -3043,6 +3043,8 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
>>
>> static __init int nfit_init(void)
>> {
>> + int ret;
>> +
>> BUILD_BUG_ON(sizeof(struct acpi_table_nfit) != 40);
>> BUILD_BUG_ON(sizeof(struct acpi_nfit_system_address) != 56);
>> BUILD_BUG_ON(sizeof(struct acpi_nfit_memory_map) != 48);
>> @@ -3070,8 +3072,14 @@ static __init int nfit_init(void)
>> return -ENOMEM;
>>
>> nfit_mce_register();
>> + ret = acpi_bus_register_driver(&acpi_nfit_driver);
>> + if (ret) {
>> + nfit_mce_unregister();
>> + destroy_workqueue(nfit_wq);
>> + }
>> +
>> + return ret;
>>
>> - return acpi_bus_register_driver(&acpi_nfit_driver);
>> }
>>
>> static __exit void nfit_exit(void)
>> --
>> 1.7.9.3
>>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v3] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
2017-07-17 15:19 ` Prarit Bhargava
@ 2017-07-17 16:52 ` Dan Williams
2017-07-17 16:54 ` Prarit Bhargava
0 siblings, 1 reply; 6+ messages in thread
From: Dan Williams @ 2017-07-17 16:52 UTC (permalink / raw)
To: Prarit Bhargava
Cc: Vishal Verma, Linux ACPI, Rafael J. Wysocki, Len Brown,
Lee, Chun-Yi, Linda Knippers, jmoyer, lszubowi
On Mon, Jul 17, 2017 at 8:19 AM, Prarit Bhargava <prarit@redhat.com> wrote:
>
> Rafael?
>
> ping? It's been almost two months ...
This is my fault. I'll pick this up for 4.13-rc2.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v3] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
2017-07-17 16:52 ` Dan Williams
@ 2017-07-17 16:54 ` Prarit Bhargava
0 siblings, 0 replies; 6+ messages in thread
From: Prarit Bhargava @ 2017-07-17 16:54 UTC (permalink / raw)
To: Dan Williams
Cc: Vishal Verma, Linux ACPI, Rafael J. Wysocki, Len Brown,
Lee, Chun-Yi, Linda Knippers, jmoyer, lszubowi
On 07/17/2017 12:52 PM, Dan Williams wrote:
> On Mon, Jul 17, 2017 at 8:19 AM, Prarit Bhargava <prarit@redhat.com> wrote:
>>
>> Rafael?
>>
>> ping? It's been almost two months ...
>
> This is my fault. I'll pick this up for 4.13-rc2.
Thanks Dan.
P.
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-07-17 16:54 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-05-31 17:39 [PATCH v3] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure Prarit Bhargava
2017-05-31 19:42 ` Jeff Moyer
2017-05-31 19:46 ` Vishal Verma
2017-07-17 15:19 ` Prarit Bhargava
2017-07-17 16:52 ` Dan Williams
2017-07-17 16:54 ` Prarit Bhargava
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox