From patchwork Wed Aug 23 01:43:08 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Xiaoming Ni X-Patchwork-Id: 9916451 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3ACE4603F9 for ; Wed, 23 Aug 2017 01:47:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2D3E628913 for ; Wed, 23 Aug 2017 01:47:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 21CD428924; Wed, 23 Aug 2017 01:47:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9F80228913 for ; Wed, 23 Aug 2017 01:47:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753155AbdHWBrR (ORCPT ); Tue, 22 Aug 2017 21:47:17 -0400 Received: from szxga03-in.huawei.com ([45.249.212.189]:10880 "EHLO szxga03-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753142AbdHWBrQ (ORCPT ); Tue, 22 Aug 2017 21:47:16 -0400 Received: from 172.30.72.56 (EHLO DGGEMA405-HUB.china.huawei.com) ([172.30.72.56]) by dggrg03-dlp.huawei.com (MOS 4.4.6-GA FastPath queued) with ESMTP id AUC08818; Wed, 23 Aug 2017 09:43:13 +0800 (CST) Received: from DGGEMA505-MBX.china.huawei.com ([169.254.1.46]) by DGGEMA405-HUB.china.huawei.com ([10.3.20.46]) with mapi id 14.03.0301.000; Wed, 23 Aug 2017 09:43:09 +0800 From: Nixiaoming To: David Hildenbrand , "agraf@suse.com" , "pbonzini@redhat.com" , "rkrcmar@redhat.com" , "benh@kernel.crashing.org" , "paulus@samba.org" , "mpe@ellerman.id.au" CC: "kvm-ppc@vger.kernel.org" , "kvm@vger.kernel.org" , "linuxppc-dev@lists.ozlabs.org" , "linux-kernel@vger.kernel.org" Subject: Re:Re: [PATCH] fix memory leak on kvm_vm_ioctl_create_spapr_tce Thread-Topic: Re: [PATCH] fix memory leak on kvm_vm_ioctl_create_spapr_tce Thread-Index: AQHTG1mTl3bxlDcSs0uiZR7I7BeFYaKP+G8AgAErucA= Date: Wed, 23 Aug 2017 01:43:08 +0000 Message-ID: References: <20170822142823.69425-1-nixiaoming@huawei.com> <95fe182a-fd21-77a1-33df-0e609c2845fd@redhat.com> <8fd9a878-a8ce-5576-9a5c-1c221ff6ded7@redhat.com> In-Reply-To: <8fd9a878-a8ce-5576-9a5c-1c221ff6ded7@redhat.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.57.88.168] MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090203.599CDDB3.003E, ss=1, re=0.000, recu=0.000, reip=0.000, cl=1, cld=1, fgs=0, ip=169.254.1.46, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 6176858ee86640a1e26fdb006a2c9143 Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP >On 22.08.2017 17:15, David Hildenbrand wrote: >> On 22.08.2017 16:28, nixiaoming wrote: >>> miss kfree(stt) when anon_inode_getfd return fail so add check >>> anon_inode_getfd return val, and kfree stt >>> >>> Signed-off-by: nixiaoming >>> --- >>> arch/powerpc/kvm/book3s_64_vio.c | 5 ++++- >>> 1 file changed, 4 insertions(+), 1 deletion(-) >>> >>> diff --git a/arch/powerpc/kvm/book3s_64_vio.c >>> b/arch/powerpc/kvm/book3s_64_vio.c >>> index a160c14..a0b4459 100644 >>> --- a/arch/powerpc/kvm/book3s_64_vio.c >>> +++ b/arch/powerpc/kvm/book3s_64_vio.c >>> @@ -341,8 +341,11 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm >>> *kvm, >>> >>> mutex_unlock(&kvm->lock); >>> >>> - return anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, >>> + ret = anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, >>> stt, O_RDWR | O_CLOEXEC); >>> + if (ret < 0) >>> + goto fail; >>> + return ret; >>> >>> fail: >>> if (stt) { >>> >> >> >> stt has already been added to kvm->arch.spapr_tce_tables, so freeing >> it is evil IMHO. I don't know that code, so I don't know if there is >> some other place that will make sure that everything in >> kvm->arch.spapr_tce_tables will properly get freed, even when no >> kvm->release >> function has been called (kvm_spapr_tce_release). >> > >If it is really not freed, than also kvm_put_kvm(stt->kvm) is missing. > >-- > >Thanks, > >David > if (!stt) return -ENOMEM; kvm_get_kvm(kvm); if anon_inode_getfd return -ENOMEM The user can not determine whether kvm_get_kvm has been called so need add kvm_pet_kvm when anon_inode_getfd fail stt has already been added to kvm->arch.spapr_tce_tables, but if anon_inode_getfd fail, stt is unused val, so call list_del_rcu, and free as quickly as possible new patch: --- arch/powerpc/kvm/book3s_64_vio.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) -- 2.11.0.1 diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c index a160c14..e2228f1 100644 --- a/arch/powerpc/kvm/book3s_64_vio.c +++ b/arch/powerpc/kvm/book3s_64_vio.c @@ -341,8 +341,16 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm, mutex_unlock(&kvm->lock); - return anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, + ret = anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, stt, O_RDWR | O_CLOEXEC); + if (ret < 0) { + mutex_lock(&kvm->lock); + list_del_rcu(&stt->list); + mutex_unlock(&kvm->lock); + kvm_put_kvm(kvm); + goto fail; + } + return ret; fail: if (stt) {