From patchwork Thu May 26 20:39:56 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Qian Cai X-Patchwork-Id: 12862697 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 252F2C433EF for ; Thu, 26 May 2022 20:42:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:CC :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=0uhdB898fXPR+D5JyxAdcizoTdTjccTSM8woQcATQds=; b=I9slKjDgqBLGLp Zl+rkKH8RAsU6IvhkTIolM+F01QtVsZbroEdbeuy4wGHIewmCWKQ7D0DZac2lmyTwejNioMfZCPfF A19wDzrIVde55gF57R++70TzXk6uza8JzMu45e8iD0YF3OCEvIwn1DSbmI9XMbQlk+/u4wEc8qGSL xPoA1dDrmhGM0JoNC9YvQS6/g7X7Dr2/gdoR1CFlZWuH2OAQpe8a6bFUF9stAnzy1MCgT9JOaodbs S5h5/T94mjKoVrlRA7hbCJDlDns1dZQ5YQQ3f5rxd8QjZfdk9j1PTfjuiSPYxULOC5u6wFq2zYQx+ xW3fEPLERJicvQO2HPVw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nuKHl-00FnVZ-Bg; Thu, 26 May 2022 20:40:45 +0000 Received: from alexa-out.qualcomm.com ([129.46.98.28]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nuKHg-00FnT6-Gx for linux-arm-kernel@lists.infradead.org; Thu, 26 May 2022 20:40:42 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; i=@quicinc.com; q=dns/txt; s=qcdkim; t=1653597640; x=1685133640; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=IJdm9DSkjzkpq4cQM5uzeP+0z5TWT/S2S0U1NnQ9ajs=; b=DyKOD3RVFcgh74utBFulOazW9hGyYVBoUmdXwU29QPQBGgG9hsuC5m1h HpVZVmO8ulOGH9feNkR2OSXdjAaRYze1Jz7GFomS/OsdWbOPOiq1o2dbT ecCitoMe81l2DNvm8AeZM7KNyHojvU68zjC+v2iOKaFAEkQLPGo0Radmg Q=; Received: from ironmsg08-lv.qualcomm.com ([10.47.202.152]) by alexa-out.qualcomm.com with ESMTP; 26 May 2022 13:40:37 -0700 X-QCInternal: smtphost Received: from nasanex01c.na.qualcomm.com ([10.47.97.222]) by ironmsg08-lv.qualcomm.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 26 May 2022 13:40:36 -0700 Received: from nalasex01a.na.qualcomm.com (10.47.209.196) by nasanex01c.na.qualcomm.com (10.47.97.222) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.22; Thu, 26 May 2022 13:40:36 -0700 Received: from ubuntu.qualcomm.com (10.80.80.8) by nalasex01a.na.qualcomm.com (10.47.209.196) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.22; Thu, 26 May 2022 13:40:34 -0700 From: Qian Cai To: Marc Zyngier CC: James Morse , Alexandru Elisei , Suzuki K Poulose , Catalin Marinas , Will Deacon , , , , Qian Cai Subject: [PATCH] KVM: arm64: Fix memory leaks from stage2 pagetable Date: Thu, 26 May 2022 16:39:56 -0400 Message-ID: <20220526203956.143873-1-quic_qiancai@quicinc.com> X-Mailer: git-send-email 2.32.0 MIME-Version: 1.0 X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01b.na.qualcomm.com (10.46.141.250) To nalasex01a.na.qualcomm.com (10.47.209.196) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220526_134040_638191_9F2CA078 X-CRM114-Status: GOOD ( 14.19 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Running some SR-IOV workloads could trigger some leak reports from kmemleak. unreferenced object 0xffff080243cef500 (size 128): comm "qemu-system-aar", pid 179935, jiffies 4298359506 (age 1629.732s) hex dump (first 32 bytes): 28 00 00 00 01 00 00 00 00 e0 4c 52 03 08 ff ff (.........LR.... e0 af a4 7f 7c d1 ff ff a8 3c b3 08 00 80 ff ff ....|....<...... backtrace: kmem_cache_alloc_trace kvm_init_stage2_mmu kvm_arch_init_vm kvm_create_vm kvm_dev_ioctl __arm64_sys_ioctl invoke_syscall el0_svc_common.constprop.0 do_el0_svc el0_svc el0t_64_sync_handler el0t_64_sync Since I yet to find a way to reproduce this at will, I just did a code inspection and found this one spot that could happen. It is unlikely that will fix my issue because I don't see mine went into the error paths. But, we should fix it regardless. If hardware_enable_all() or kvm_init_mmu_notifier() failed in kvm_create_vm(), we ended up leaking stage2 pagetable memory from kvm_init_stage2_mmu() because we will no longer call kvm_arch_flush_shadow_all(). It seems that it is impossible to simply move kvm_free_stage2_pgd() from kvm_arch_flush_shadow_all() into kvm_arch_destroy_vm() due to the issue mentioned in the "Fixes" commit below. Thus, fixed it by freeing the memory from kvm_arch_destroy_vm() only if the MMU notifier is not even initialized. Fixes: 293f293637b5 ("kvm-arm: Unmap shadow pagetables properly") Signed-off-by: Qian Cai --- arch/arm64/kvm/arm.c | 3 +++ arch/arm64/kvm/mmu.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 400bb0fe2745..7d12824f2034 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -180,6 +180,9 @@ vm_fault_t kvm_arch_vcpu_fault(struct kvm_vcpu *vcpu, struct vm_fault *vmf) */ void kvm_arch_destroy_vm(struct kvm *kvm) { + if (!kvm->mmu_notifier.ops) + kvm_free_stage2_pgd(&kvm->arch.mmu); + bitmap_free(kvm->arch.pmu_filter); free_cpumask_var(kvm->arch.supported_cpus); diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c index f5651a05b6a8..13a527656ba7 100644 --- a/arch/arm64/kvm/mmu.c +++ b/arch/arm64/kvm/mmu.c @@ -1739,7 +1739,8 @@ void kvm_arch_memslots_updated(struct kvm *kvm, u64 gen) void kvm_arch_flush_shadow_all(struct kvm *kvm) { - kvm_free_stage2_pgd(&kvm->arch.mmu); + if (kvm->mmu_notifier.ops) + kvm_free_stage2_pgd(&kvm->arch.mmu); } void kvm_arch_flush_shadow_memslot(struct kvm *kvm,