Date: Wed, 12 Jun 2013 20:34:18 GMT From: "clarkjc@runbox.com" <John.Clark@FreeBSD.org> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/179523: [patch] Memory leak/corruption in cpuctl pseudo-driver and more Message-ID: <201306122034.r5CKYIg2029115@oldred.freebsd.org> Resent-Message-ID: <201306122040.r5CKe0Ii097435@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 179523
>Category: kern
>Synopsis: [patch] Memory leak/corruption in cpuctl pseudo-driver and more
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Jun 12 20:40:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator: clarkjc@runbox.com
>Release: 9.1-RELEASE-p3
>Organization:
>Environment:
FreeBSD beastie.local 9.1-RELEASE-p3 FreeBSD 9.1-RELEASE-p3 #0: Mon Apr 29 18:27:25 UTC 2013 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64
>Description:
1) Processor microcode update functions update_intel and update_via in sys/dev/cpuctl/cpuctl.c allocate a buffer with malloc but free it with contigfree. update_amd appears to be correct because it does contigmalloc followed by contigfree.
2) Also, the UCODE_SIZE_MAX limit of 10 KB is too small for some microcode updates. I noticed this because I tried to apply the most recent update for an Intel Core i5-3570, which is 16 KB, and it failed due to this limit. Currently, the largest microcode update I can find is 28 KB, so I raised the limit to 32 KB to accommodate this.
I have fixed and tested both issues and attached a patch. The patch applies cleanly both to the head and to 9.1-RELEASE-p3.
>How-To-Repeat:
1) Found by inspection of sys/dev/cpuctl/cpuctl.c
2) Try to apply a microcode update to an Intel, AMD, or VIA processor that exceeds 10 KB in size.
>Fix:
Simply apply the attached patch and rebuild.
Patch attached with submission follows:
--- sys/dev/cpuctl/cpuctl.c.orig 2012-12-03 19:52:24.000000000 -0500
+++ sys/dev/cpuctl/cpuctl.c 2013-06-12 13:15:20.000000000 -0400
@@ -63,7 +63,7 @@
# define DPRINTF(...)
#endif
-#define UCODE_SIZE_MAX (10 * 1024)
+#define UCODE_SIZE_MAX (32 * 1024)
static int cpuctl_do_msr(int cpu, cpuctl_msr_args_t *data, u_long cmd,
struct thread *td);
@@ -295,7 +295,7 @@
static int
update_intel(int cpu, cpuctl_update_args_t *args, struct thread *td)
{
- void *ptr = NULL;
+ void *ptr, *ptr_to_free = NULL;
uint64_t rev0, rev1;
uint32_t tmp[4];
int is_bound = 0;
@@ -314,8 +314,8 @@
/*
* 16 byte alignment required.
*/
- ptr = malloc(args->size + 16, M_CPUCTL, M_WAITOK);
- ptr = (void *)(16 + ((intptr_t)ptr & ~0xf));
+ ptr_to_free = malloc(args->size + 16, M_CPUCTL, M_WAITOK);
+ ptr = (void *)(16 + ((intptr_t)ptr_to_free & ~0xf));
if (copyin(args->data, ptr, args->size) != 0) {
DPRINTF("[cpuctl,%d]: copyin %p->%p of %zd bytes failed",
__LINE__, args->data, ptr, args->size);
@@ -346,8 +346,8 @@
else
ret = EEXIST;
fail:
- if (ptr != NULL)
- contigfree(ptr, args->size, M_CPUCTL);
+ if (ptr_to_free != NULL)
+ free(ptr_to_free, M_CPUCTL);
return (ret);
}
@@ -409,7 +409,7 @@
static int
update_via(int cpu, cpuctl_update_args_t *args, struct thread *td)
{
- void *ptr = NULL;
+ void *ptr, *ptr_to_free = NULL;
uint64_t rev0, rev1, res;
uint32_t tmp[4];
int is_bound = 0;
@@ -428,8 +428,8 @@
/*
* 4 byte alignment required.
*/
- ptr = malloc(args->size + 16, M_CPUCTL, M_WAITOK);
- ptr = (void *)(16 + ((intptr_t)ptr & ~0xf));
+ ptr_to_free = malloc(args->size + 16, M_CPUCTL, M_WAITOK);
+ ptr = (void *)(16 + ((intptr_t)ptr_to_free & ~0xf));
if (copyin(args->data, ptr, args->size) != 0) {
DPRINTF("[cpuctl,%d]: copyin %p->%p of %zd bytes failed",
__LINE__, args->data, ptr, args->size);
@@ -476,8 +476,8 @@
else
ret = 0;
fail:
- if (ptr != NULL)
- contigfree(ptr, args->size, M_CPUCTL);
+ if (ptr_to_free != NULL)
+ free(ptr_to_free, M_CPUCTL);
return (ret);
}
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201306122034.r5CKYIg2029115>