From patchwork Wed Aug 23 01:43:08 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiaoming Ni X-Patchwork-Id: 804723 X-Patchwork-Delegate: paulus@samba.org Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [103.22.144.68]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3xcVgy3CJFz9sNd for ; Wed, 23 Aug 2017 11:48:30 +1000 (AEST) Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 3xcVgy1tJtzDqgf for ; Wed, 23 Aug 2017 11:48:30 +1000 (AEST) X-Original-To: linuxppc-dev@lists.ozlabs.org Delivered-To: linuxppc-dev@lists.ozlabs.org Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 3xcVfc1w27zDqln for ; Wed, 23 Aug 2017 11:47:19 +1000 (AEST) Received: from 172.30.72.56 (EHLO DGGEMA405-HUB.china.huawei.com) ([172.30.72.56]) by dggrg03-dlp.huawei.com (MOS 4.4.6-GA FastPath queued) with ESMTP id AUC08818; Wed, 23 Aug 2017 09:43:13 +0800 (CST) Received: from DGGEMA505-MBX.china.huawei.com ([169.254.1.46]) by DGGEMA405-HUB.china.huawei.com ([10.3.20.46]) with mapi id 14.03.0301.000; Wed, 23 Aug 2017 09:43:09 +0800 From: Nixiaoming To: David Hildenbrand , "agraf@suse.com" , "pbonzini@redhat.com" , "rkrcmar@redhat.com" , "benh@kernel.crashing.org" , "paulus@samba.org" , "mpe@ellerman.id.au" Subject: Re:Re: [PATCH] fix memory leak on kvm_vm_ioctl_create_spapr_tce Thread-Topic: Re: [PATCH] fix memory leak on kvm_vm_ioctl_create_spapr_tce Thread-Index: AQHTG1mTl3bxlDcSs0uiZR7I7BeFYaKP+G8AgAErucA= Date: Wed, 23 Aug 2017 01:43:08 +0000 Message-ID: References: <20170822142823.69425-1-nixiaoming@huawei.com> <95fe182a-fd21-77a1-33df-0e609c2845fd@redhat.com> <8fd9a878-a8ce-5576-9a5c-1c221ff6ded7@redhat.com> In-Reply-To: <8fd9a878-a8ce-5576-9a5c-1c221ff6ded7@redhat.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.57.88.168] MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090203.599CDDB3.003E, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=169.254.1.46, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 6176858ee86640a1e26fdb006a2c9143 X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "linuxppc-dev@lists.ozlabs.org" , "kvm@vger.kernel.org" , "kvm-ppc@vger.kernel.org" , "linux-kernel@vger.kernel.org" Errors-To: linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org Sender: "Linuxppc-dev" >On 22.08.2017 17:15, David Hildenbrand wrote: >> On 22.08.2017 16:28, nixiaoming wrote: >>> miss kfree(stt) when anon_inode_getfd return fail so add check >>> anon_inode_getfd return val, and kfree stt >>> >>> Signed-off-by: nixiaoming >>> --- >>> arch/powerpc/kvm/book3s_64_vio.c | 5 ++++- >>> 1 file changed, 4 insertions(+), 1 deletion(-) >>> >>> diff --git a/arch/powerpc/kvm/book3s_64_vio.c >>> b/arch/powerpc/kvm/book3s_64_vio.c >>> index a160c14..a0b4459 100644 >>> --- a/arch/powerpc/kvm/book3s_64_vio.c >>> +++ b/arch/powerpc/kvm/book3s_64_vio.c >>> @@ -341,8 +341,11 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm >>> *kvm, >>> >>> mutex_unlock(&kvm->lock); >>> >>> - return anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, >>> + ret = anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, >>> stt, O_RDWR | O_CLOEXEC); >>> + if (ret < 0) >>> + goto fail; >>> + return ret; >>> >>> fail: >>> if (stt) { >>> >> >> >> stt has already been added to kvm->arch.spapr_tce_tables, so freeing >> it is evil IMHO. I don't know that code, so I don't know if there is >> some other place that will make sure that everything in >> kvm->arch.spapr_tce_tables will properly get freed, even when no >> kvm->release >> function has been called (kvm_spapr_tce_release). >> > >If it is really not freed, than also kvm_put_kvm(stt->kvm) is missing. > >-- > >Thanks, > >David > if (!stt) return -ENOMEM; kvm_get_kvm(kvm); if anon_inode_getfd return -ENOMEM The user can not determine whether kvm_get_kvm has been called so need add kvm_pet_kvm when anon_inode_getfd fail stt has already been added to kvm->arch.spapr_tce_tables, but if anon_inode_getfd fail, stt is unused val, so call list_del_rcu, and free as quickly as possible new patch: --- arch/powerpc/kvm/book3s_64_vio.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) -- 2.11.0.1 diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c index a160c14..e2228f1 100644 --- a/arch/powerpc/kvm/book3s_64_vio.c +++ b/arch/powerpc/kvm/book3s_64_vio.c @@ -341,8 +341,16 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm, mutex_unlock(&kvm->lock); - return anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, + ret = anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, stt, O_RDWR | O_CLOEXEC); + if (ret < 0) { + mutex_lock(&kvm->lock); + list_del_rcu(&stt->list); + mutex_unlock(&kvm->lock); + kvm_put_kvm(kvm); + goto fail; + } + return ret; fail: if (stt) {