[PATCH] x86/microcode/intel: Fix memleak in save_microcode_patch

[PATCH] x86/microcode/intel: Fix memleak in save_microcode_patch

[Zhenzhong Duan]

Free useless ucode_patch entry when it's replaced.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
---
 arch/x86/kernel/cpu/microcode/intel.c |   10 +++++++++-
 1 files changed, 9 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 1c2cfa0..461e315 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -150,6 +150,12 @@ static bool microcode_matches(struct microcode_header_intel *mc_header,
 	return false;
 }
 
+static void memfree_patch(struct ucode_patch *p)
+{
+	kfree(p->data);
+	kfree(p);
+}
+
 static struct ucode_patch *memdup_patch(void *data, unsigned int size)
 {
 	struct ucode_patch *p;
@@ -190,8 +196,10 @@ static void save_microcode_patch(void *data, unsigned int size)
 			p = memdup_patch(data, size);
 			if (!p)
 				pr_err("Error allocating buffer %p\n", data);
-			else
+			else {
 				list_replace(&iter->plist, &p->plist);
+				memfree_patch(iter);
+			}
 		}
 	}
 
-- 
1.7.1

Re: [PATCH] x86/microcode/intel: Fix memleak in save_microcode_patch

[Borislav Petkov]

On Thu, May 31, 2018 at 09:51:05PM -0700, Zhenzhong Duan wrote:
> Free useless ucode_patch entry when it's replaced.
> 
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
> ---
>  arch/x86/kernel/cpu/microcode/intel.c |   10 +++++++++-
>  1 files changed, 9 insertions(+), 1 deletions(-)
> 
> diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
> index 1c2cfa0..461e315 100644
> --- a/arch/x86/kernel/cpu/microcode/intel.c
> +++ b/arch/x86/kernel/cpu/microcode/intel.c
> @@ -150,6 +150,12 @@ static bool microcode_matches(struct microcode_header_intel *mc_header,
>  	return false;
>  }
>  
> +static void memfree_patch(struct ucode_patch *p)
> +{
> +	kfree(p->data);
> +	kfree(p);
> +}
> +
>  static struct ucode_patch *memdup_patch(void *data, unsigned int size)
>  {
>  	struct ucode_patch *p;
> @@ -190,8 +196,10 @@ static void save_microcode_patch(void *data, unsigned int size)
>  			p = memdup_patch(data, size);
>  			if (!p)
>  				pr_err("Error allocating buffer %p\n", data);
> -			else
> +			else {
>  				list_replace(&iter->plist, &p->plist);
> +				memfree_patch(iter);

Looks correct. I've dropped the memfree_patch() two-liner though and
made it do kfree() directly.

Thx.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--

[tip:x86/urgent] x86/microcode/intel: Fix memleak in save_microcode_patch()

[tip-bot for Zhenzhong Duan]

Commit-ID:  0218c766263e70795c5eaa17d75ed54bca350950
Gitweb:     https://git.kernel.org/tip/0218c766263e70795c5eaa17d75ed54bca350950
Author:     Zhenzhong Duan <zhenzhong.duan@oracle.com>
AuthorDate: Fri, 22 Jun 2018 13:51:26 +0200
Committer:  Thomas Gleixner <tglx@linutronix.de>
CommitDate: Fri, 22 Jun 2018 14:42:59 +0200

x86/microcode/intel: Fix memleak in save_microcode_patch()

Free useless ucode_patch entry when it's replaced.

[ bp: Drop the memfree_patch() two-liner. ]

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Srinivas REDDY Eeda <srinivas.eeda@oracle.com>
Link: http://lkml.kernel.org/r/888102f0-fd22-459d-b090-a1bd8a00cb2b@default

---
 arch/x86/kernel/cpu/microcode/intel.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 1c2cfa0644aa..97ccf4c3b45b 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -190,8 +190,11 @@ static void save_microcode_patch(void *data, unsigned int size)
 			p = memdup_patch(data, size);
 			if (!p)
 				pr_err("Error allocating buffer %p\n", data);
-			else
+			else {
 				list_replace(&iter->plist, &p->plist);
+				kfree(iter->data);
+				kfree(iter);
+			}
 		}
 	}