All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
@ 2017-05-17 23:56 Prarit Bhargava
  2017-05-18 17:35 ` Verma, Vishal L
  0 siblings, 1 reply; 4+ messages in thread
From: Prarit Bhargava @ 2017-05-17 23:56 UTC (permalink / raw)
  To: linux-acpi
  Cc: Prarit Bhargava, Jeff Moyer, Rafael J. Wysocki, Len Brown,
	Dan Williams, Vishal Verma, Lee, Chun-Yi, Linda Knippers

nfit_init() calls nfit_mce_register() on module load.  When the module
load fails the nfit mce decoder is not unregistered.  The module's
memory is freed leaving the decoder chain referencing junk.  This will
cause panics as future registrations will reference the free'd memory.

Only register the nfit mce decoder on success.

Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Cc: Jeff Moyer <jmoyer@redhat.com>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Cc: Len Brown <lenb@kernel.org>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
Cc: Linda Knippers <linda.knippers@hpe.com>
---
 drivers/acpi/nfit/core.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 656acb5d7166..b60856b4325b 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -3043,6 +3043,8 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
 
 static __init int nfit_init(void)
 {
+	int ret;
+
 	BUILD_BUG_ON(sizeof(struct acpi_table_nfit) != 40);
 	BUILD_BUG_ON(sizeof(struct acpi_nfit_system_address) != 56);
 	BUILD_BUG_ON(sizeof(struct acpi_nfit_memory_map) != 48);
@@ -3069,9 +3071,11 @@ static __init int nfit_init(void)
 	if (!nfit_wq)
 		return -ENOMEM;
 
-	nfit_mce_register();
+	ret = acpi_bus_register_driver(&acpi_nfit_driver);
+	if (!ret)
+		nfit_mce_register();
 
-	return acpi_bus_register_driver(&acpi_nfit_driver);
+	return ret;
 }
 
 static __exit void nfit_exit(void)
-- 
1.7.9.3


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
  2017-05-17 23:56 [PATCH] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure Prarit Bhargava
@ 2017-05-18 17:35 ` Verma, Vishal L
  2017-05-18 18:11   ` Prarit Bhargava
  0 siblings, 1 reply; 4+ messages in thread
From: Verma, Vishal L @ 2017-05-18 17:35 UTC (permalink / raw)
  To: prarit, linux-acpi
  Cc: Williams, Dan J, lenb, joeyli.kernel, jmoyer, rjw, linda.knippers

On Wed, 2017-05-17 at 19:56 -0400, Prarit Bhargava wrote:
> nfit_init() calls nfit_mce_register() on module load.  When the module
> load fails the nfit mce decoder is not unregistered.  The module's
> memory is freed leaving the decoder chain referencing junk.  This will
> cause panics as future registrations will reference the free'd memory.
> 
> Only register the nfit mce decoder on success.

Good find! I'm wondering if registering the mce handler after the rest
of the init will leave a (small) window open where MCEs can happen but
the handler has yet to be registered.. Maybe it is inconsequential, and
we can just do this. Alternatively, if acpi_bus_register_driver fails,
then go back and unregister the mce handler..

> 
> Signed-off-by: Prarit Bhargava <prarit@redhat.com>
> Cc: Jeff Moyer <jmoyer@redhat.com>
> Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
> Cc: Len Brown <lenb@kernel.org>
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: Vishal Verma <vishal.l.verma@intel.com>
> Cc: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
> Cc: Linda Knippers <linda.knippers@hpe.com>
> ---
>  drivers/acpi/nfit/core.c |    8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
> index 656acb5d7166..b60856b4325b 100644
> --- a/drivers/acpi/nfit/core.c
> +++ b/drivers/acpi/nfit/core.c
> @@ -3043,6 +3043,8 @@ static void acpi_nfit_notify(struct acpi_device
> *adev, u32 event)
>  
>  static __init int nfit_init(void)
>  {
> +	int ret;
> +
>  	BUILD_BUG_ON(sizeof(struct acpi_table_nfit) != 40);
>  	BUILD_BUG_ON(sizeof(struct acpi_nfit_system_address) != 56);
>  	BUILD_BUG_ON(sizeof(struct acpi_nfit_memory_map) != 48);
> @@ -3069,9 +3071,11 @@ static __init int nfit_init(void)
>  	if (!nfit_wq)
>  		return -ENOMEM;
>  
> -	nfit_mce_register();
> +	ret = acpi_bus_register_driver(&acpi_nfit_driver);
> +	if (!ret)
> +		nfit_mce_register();
>  
> -	return acpi_bus_register_driver(&acpi_nfit_driver);
> +	return ret;
>  }
>  
>  static __exit void nfit_exit(void)

^ permalink raw reply	[flat|nested] 4+ messages in thread
* Re: [PATCH] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
  2017-05-18 17:35 ` Verma, Vishal L
@ 2017-05-18 18:11   ` Prarit Bhargava
  0 siblings, 0 replies; 4+ messages in thread
From: Prarit Bhargava @ 2017-05-18 18:11 UTC (permalink / raw)
  To: Verma, Vishal L, linux-acpi
  Cc: Williams, Dan J, lenb, joeyli.kernel, jmoyer, rjw, linda.knippers



On 05/18/2017 01:35 PM, Verma, Vishal L wrote:
> On Wed, 2017-05-17 at 19:56 -0400, Prarit Bhargava wrote:
>> nfit_init() calls nfit_mce_register() on module load.  When the module
>> load fails the nfit mce decoder is not unregistered.  The module's
>> memory is freed leaving the decoder chain referencing junk.  This will
>> cause panics as future registrations will reference the free'd memory.
>>
>> Only register the nfit mce decoder on success.
> 
> Good find! I'm wondering if registering the mce handler after the rest
> of the init will leave a (small) window open where MCEs can happen but
> the handler has yet to be registered.. Maybe it is inconsequential, and
> we can just do this. Alternatively, if acpi_bus_register_driver fails,
> then go back and unregister the mce handler..

FWIW my first version did exactly what you describe.  I felt like the version
below was a cleaner approach in terms of code, and because I thought that the
possibility of an MCE occurring in those few moments between the return and
registration was minimal.

I could be wrong though :) and I still have that original patch so it isn't a
big deal to do a v2.

P.

> 
>>
>> Signed-off-by: Prarit Bhargava <prarit@redhat.com>
>> Cc: Jeff Moyer <jmoyer@redhat.com>
>> Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
>> Cc: Len Brown <lenb@kernel.org>
>> Cc: Dan Williams <dan.j.williams@intel.com>
>> Cc: Vishal Verma <vishal.l.verma@intel.com>
>> Cc: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
>> Cc: Linda Knippers <linda.knippers@hpe.com>
>> ---
>>  drivers/acpi/nfit/core.c |    8 ++++++--
>>  1 file changed, 6 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
>> index 656acb5d7166..b60856b4325b 100644
>> --- a/drivers/acpi/nfit/core.c
>> +++ b/drivers/acpi/nfit/core.c
>> @@ -3043,6 +3043,8 @@ static void acpi_nfit_notify(struct acpi_device
>> *adev, u32 event)
>>  
>>  static __init int nfit_init(void)
>>  {
>> +	int ret;
>> +
>>  	BUILD_BUG_ON(sizeof(struct acpi_table_nfit) != 40);
>>  	BUILD_BUG_ON(sizeof(struct acpi_nfit_system_address) != 56);
>>  	BUILD_BUG_ON(sizeof(struct acpi_nfit_memory_map) != 48);
>> @@ -3069,9 +3071,11 @@ static __init int nfit_init(void)
>>  	if (!nfit_wq)
>>  		return -ENOMEM;
>>  
>> -	nfit_mce_register();
>> +	ret = acpi_bus_register_driver(&acpi_nfit_driver);
>> +	if (!ret)
>> +		nfit_mce_register();
>>  
>> -	return acpi_bus_register_driver(&acpi_nfit_driver);
>> +	return ret;
>>  }
>>  
>>  static __exit void nfit_exit(void)

^ permalink raw reply	[flat|nested] 4+ messages in thread
* [PATCH] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
@ 2017-05-31 17:32 Prarit Bhargava
  0 siblings, 0 replies; 4+ messages in thread
From: Prarit Bhargava @ 2017-05-31 17:32 UTC (permalink / raw)
  To: linux-acpi
  Cc: Prarit Bhargava, Rafael J. Wysocki, Len Brown, Dan Williams,
	Vishal Verma, Lee, Chun-Yi, Linda Knippers, jmoyer, lszubowi

nfit_init() calls nfit_mce_register() on module load.  When the module
load fails the nfit mce decoder is not unregistered.  The module's
memory is freed leaving the decoder chain referencing junk.  This will
cause panics as future registrations will reference the free'd memory.

Unregister the nfit mce decoder on module init failure.

[v2]: register and then unregister mce handler to avoid losing mce events
[v3]: also cleanup nfit workqueue

Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Cc: Len Brown <lenb@kernel.org>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>
Cc: Linda Knippers <linda.knippers@hpe.com>
Cc: jmoyer@redhat.com
Cc: lszubowi@redhat.com
---
 drivers/acpi/nfit/core.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 656acb5d7166..f3c3e9d4563c 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -3043,6 +3043,8 @@ static void acpi_nfit_notify(struct acpi_device *adev, u32 event)
 
 static __init int nfit_init(void)
 {
+	int ret;
+
 	BUILD_BUG_ON(sizeof(struct acpi_table_nfit) != 40);
 	BUILD_BUG_ON(sizeof(struct acpi_nfit_system_address) != 56);
 	BUILD_BUG_ON(sizeof(struct acpi_nfit_memory_map) != 48);
@@ -3070,8 +3072,14 @@ static __init int nfit_init(void)
 		return -ENOMEM;
 
 	nfit_mce_register();
+	ret = acpi_bus_register_driver(&acpi_nfit_driver);
+	if (ret) {
+		nfit_mce_unregister();
+		destroy_workqueue(nfit_wq);
+	}
+
+	return ret;
 
-	return acpi_bus_register_driver(&acpi_nfit_driver);
 }
 
 static __exit void nfit_exit(void)
-- 
1.7.9.3


^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-05-31 17:32 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-17 23:56 [PATCH] acpi/nfit: Fix memory corruption/Unregister mce decoder on failure Prarit Bhargava
2017-05-18 17:35 ` Verma, Vishal L
2017-05-18 18:11   ` Prarit Bhargava
2017-05-31 17:32 Prarit Bhargava

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.