From nobody@FreeBSD.org  Wed Jun 12 20:34:18 2013
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1])
	by hub.freebsd.org (Postfix) with ESMTP id D0F4FEDE
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 12 Jun 2013 20:34:18 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from oldred.freebsd.org (oldred.freebsd.org [8.8.178.121])
	by mx1.freebsd.org (Postfix) with ESMTP id B3BD01062
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 12 Jun 2013 20:34:18 +0000 (UTC)
Received: from oldred.freebsd.org ([127.0.1.6])
	by oldred.freebsd.org (8.14.5/8.14.7) with ESMTP id r5CKYITI029119
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 12 Jun 2013 20:34:18 GMT
	(envelope-from nobody@oldred.freebsd.org)
Received: (from nobody@localhost)
	by oldred.freebsd.org (8.14.5/8.14.5/Submit) id r5CKYIg2029115;
	Wed, 12 Jun 2013 20:34:18 GMT
	(envelope-from nobody)
Message-Id: <201306122034.r5CKYIg2029115@oldred.freebsd.org>
Date: Wed, 12 Jun 2013 20:34:18 GMT
From: "clarkjc@runbox.com"
To: freebsd-gnats-submit@FreeBSD.org
Subject: [patch] Memory leak/corruption in cpuctl pseudo-driver and more
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         179523
>Category:       kern
>Synopsis:       [cpuctl] [patch] Memory leak/corruption in cpuctl pseudo-driver and more
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun 12 20:40:00 UTC 2013
>Closed-Date:    
>Last-Modified:  Mon Jun 17 00:15:46 UTC 2013
>Originator:     clarkjc@runbox.com
>Release:        9.1-RELEASE-p3
>Organization:
>Environment:
FreeBSD beastie.local 9.1-RELEASE-p3 FreeBSD 9.1-RELEASE-p3 #0: Mon Apr 29 18:27:25 UTC 2013 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64
>Description:
1) Processor microcode update functions update_intel and update_via in sys/dev/cpuctl/cpuctl.c allocate a buffer with malloc but free it with contigfree.  update_amd appears to be correct because it does contigmalloc followed by contigfree.

2) Also, the UCODE_SIZE_MAX limit of 10 KB is too small for some microcode updates.  I noticed this because I tried to apply the most recent update for an Intel Core i5-3570, which is 16 KB, and it failed due to this limit.  Currently, the largest microcode update I can find is 28 KB, so I raised the limit to 32 KB to accommodate this.

I have fixed and tested both issues and attached a patch.  The patch applies cleanly both to the head and to 9.1-RELEASE-p3.
>How-To-Repeat:
1) Found by inspection of sys/dev/cpuctl/cpuctl.c
2) Try to apply a microcode update to an Intel, AMD, or VIA processor that exceeds 10 KB in size.
>Fix:
Simply apply the attached patch and rebuild.

Patch attached with submission follows:

--- sys/dev/cpuctl/cpuctl.c.orig	2012-12-03 19:52:24.000000000 -0500
+++ sys/dev/cpuctl/cpuctl.c	2013-06-12 13:15:20.000000000 -0400
@@ -63,7 +63,7 @@
 # define	DPRINTF(...)
 #endif
 
-#define	UCODE_SIZE_MAX	(10 * 1024)
+#define	UCODE_SIZE_MAX	(32 * 1024)
 
 static int cpuctl_do_msr(int cpu, cpuctl_msr_args_t *data, u_long cmd,
     struct thread *td);
@@ -295,7 +295,7 @@
 static int
 update_intel(int cpu, cpuctl_update_args_t *args, struct thread *td)
 {
-	void *ptr = NULL;
+	void *ptr, *ptr_to_free = NULL;
 	uint64_t rev0, rev1;
 	uint32_t tmp[4];
 	int is_bound = 0;
@@ -314,8 +314,8 @@
 	/*
 	 * 16 byte alignment required.
 	 */
-	ptr = malloc(args->size + 16, M_CPUCTL, M_WAITOK);
-	ptr = (void *)(16 + ((intptr_t)ptr & ~0xf));
+	ptr_to_free = malloc(args->size + 16, M_CPUCTL, M_WAITOK);
+	ptr = (void *)(16 + ((intptr_t)ptr_to_free & ~0xf));
 	if (copyin(args->data, ptr, args->size) != 0) {
 		DPRINTF("[cpuctl,%d]: copyin %p->%p of %zd bytes failed",
 		    __LINE__, args->data, ptr, args->size);
@@ -346,8 +346,8 @@
 	else
 		ret = EEXIST;
 fail:
-	if (ptr != NULL)
-		contigfree(ptr, args->size, M_CPUCTL);
+	if (ptr_to_free != NULL)
+		free(ptr_to_free, M_CPUCTL);
 	return (ret);
 }
 
@@ -409,7 +409,7 @@
 static int
 update_via(int cpu, cpuctl_update_args_t *args, struct thread *td)
 {
-	void *ptr = NULL;
+	void *ptr, *ptr_to_free = NULL;
 	uint64_t rev0, rev1, res;
 	uint32_t tmp[4];
 	int is_bound = 0;
@@ -428,8 +428,8 @@
 	/*
 	 * 4 byte alignment required.
 	 */
-	ptr = malloc(args->size + 16, M_CPUCTL, M_WAITOK);
-	ptr = (void *)(16 + ((intptr_t)ptr & ~0xf));
+	ptr_to_free = malloc(args->size + 16, M_CPUCTL, M_WAITOK);
+	ptr = (void *)(16 + ((intptr_t)ptr_to_free & ~0xf));
 	if (copyin(args->data, ptr, args->size) != 0) {
 		DPRINTF("[cpuctl,%d]: copyin %p->%p of %zd bytes failed",
 		    __LINE__, args->data, ptr, args->size);
@@ -476,8 +476,8 @@
 	else
 		ret = 0;
 fail:
-	if (ptr != NULL)
-		contigfree(ptr, args->size, M_CPUCTL);
+	if (ptr_to_free != NULL)
+		free(ptr_to_free, M_CPUCTL);
 	return (ret);
 }
 


>Release-Note:
>Audit-Trail:

From: John Clark <clarkjc@runbox.com>
To: bug-followup@FreeBSD.org, clarkjc@runbox.com
Cc:  
Subject: Re: kern/179523: [patch] Memory leak/corruption in cpuctl pseudo-driver
 and more
Date: Wed, 12 Jun 2013 16:46:57 -0400

 P.S.  Oops, it looks like I reversed my name and email address in the
 web submission form.  I should have set up sendmail and used send-pr...
 
 - John
>Unformatted:
