Messages in this thread Patch in this message | | | Date | Thu, 16 Apr 2020 18:23:44 +0100 | From | Marc Zyngier <> | Subject | Re: [PATCH 2/2] KVM: arm64: vgic-its: Fix memory leak on the error path of vgic_add_lpi() |
| |
On 2020-04-16 02:17, Zenghui Yu wrote: > On 2020/4/14 11:03, Zenghui Yu wrote: >> If we're going to fail out the vgic_add_lpi(), let's make sure the >> allocated vgic_irq memory is also freed. Though it seems that both >> cases are unlikely to fail. >> >> Cc: Zengruan Ye <yezengruan@huawei.com> >> Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> >> --- >> virt/kvm/arm/vgic/vgic-its.c | 8 ++++++-- >> 1 file changed, 6 insertions(+), 2 deletions(-) >> >> diff --git a/virt/kvm/arm/vgic/vgic-its.c >> b/virt/kvm/arm/vgic/vgic-its.c >> index d53d34a33e35..3c3b6a0f2dce 100644 >> --- a/virt/kvm/arm/vgic/vgic-its.c >> +++ b/virt/kvm/arm/vgic/vgic-its.c >> @@ -98,12 +98,16 @@ static struct vgic_irq *vgic_add_lpi(struct kvm >> *kvm, u32 intid, >> * the respective config data from memory here upon mapping the >> LPI. >> */ >> ret = update_lpi_config(kvm, irq, NULL, false); >> - if (ret) >> + if (ret) { >> + kfree(irq); >> return ERR_PTR(ret); >> + } >> ret = vgic_v3_lpi_sync_pending_status(kvm, irq); >> - if (ret) >> + if (ret) { >> + kfree(irq); >> return ERR_PTR(ret); >> + } > > Looking at it again, I realized that this error handling is still not > complete. Maybe we should use a vgic_put_irq() instead so that we can > also properly delete the vgic_irq from lpi_list.
Yes, this is a more correct fix indeed. There is still a bit of a bizarre behaviour if you have two vgic_add_lpi() racing to create the same interrupt, which is pretty dodgy anyway (it means we have two MAPI at the same time...). You end-up with re-reading the state from memory... Oh well.
> Marc, what do you think? Could you please help to fix it, or I can > resend it.
I've fixed it as such (with a comment for a good measure):
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index 3c3b6a0f2dce..c012a52b19f5 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -96,16 +96,19 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid, * We "cache" the configuration table entries in our struct vgic_irq's. * However we only have those structs for mapped IRQs, so we read in * the respective config data from memory here upon mapping the LPI. + * + * Should any of these fail, behave as if we couldn't create the LPI + * by dropping the refcount and returning the error. */ ret = update_lpi_config(kvm, irq, NULL, false); if (ret) { - kfree(irq); + vgic_put_irq(kvm, irq); return ERR_PTR(ret); }
ret = vgic_v3_lpi_sync_pending_status(kvm, irq); if (ret) { - kfree(irq); + vgic_put_irq(kvm, irq); return ERR_PTR(ret); }
Let me know if you agree with that.
Thanks,
M. -- Jazz is not dead. It just smells funny...
| |