Re: [PATCH v2 2/2] LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Resources allocated by kvm_loongarch_env_init() are leaked and lead to a Use-After-Free if kvm_init() fails in kvm_loongarch_init().
--

commit 694694d624a3a8bfec5f756c533d743cd130b9fa
Author: Chaithanya Lagisetty <nagachaithanya9911@gmail.com>

LoongArch: KVM: Fix resource leak in kvm_loongarch_env_init() error path

This commit fixes a resource leak in the error path of kvm_loongarch_env_init().
It ensures that previously acquired resources and device registrations are
unwound in reverse order if any subsequent registration fails.

Fixes: c532de5a67a7 ("LoongArch: KVM: Add IPI device support")

> diff --git a/arch/loongarch/kvm/main.c b/arch/loongarch/kvm/main.c
> index 3e1005526f4bd..c9cb3fc2e5605 100644
> --- a/arch/loongarch/kvm/main.c
> +++ b/arch/loongarch/kvm/main.c
[ ... ]
> @@ -385,27 +385,51 @@ static int kvm_loongarch_env_init(void)
>  	/* Register LoongArch IPI interrupt controller interface. */
>  	ret = kvm_loongarch_register_ipi_device();
>  	if (ret)
> -		return ret;
> +		goto err_env;
>  
>  	/* Register LoongArch EIOINTC interrupt controller interface. */
>  	ret = kvm_loongarch_register_eiointc_device();
>  	if (ret)
> -		return ret;
> +		goto err_ipi;
>  
>  	/* Register LoongArch PCH-PIC interrupt controller interface. */
>  	ret = kvm_loongarch_register_pch_pic_device();
>  	if (ret)
> -		return ret;
> +		goto err_eiointc;
>  
>  	/* Register LoongArch DMSINTC interrupt contrroller interface */
> -	if (cpu_has_msgint)
> +	if (cpu_has_msgint) {
>  		ret = kvm_loongarch_register_dmsintc_device();
> +		if (ret)
> +			goto err_pch_pic;
> +	}
> +
> +	return 0;
> +
> +err_pch_pic:
> +	kvm_loongarch_unregister_pch_pic_device();
> +err_eiointc:
> +	kvm_loongarch_unregister_eiointc_device();
> +err_ipi:
> +	kvm_loongarch_unregister_ipi_device();
> +err_env:
> +	kvm_unregister_perf_callbacks();
> +	kfree(kvm_loongarch_ops);
> +	kvm_loongarch_ops = NULL;
> +	free_percpu(vmcs);
> +	vmcs = NULL;
>  
>  	return ret;
>  }

[Severity: High]
This is a pre-existing issue, but does this leak the vmcs, kvm_loongarch_ops,
and device registrations when kvm_init() fails in kvm_loongarch_init()?

arch/loongarch/kvm/main.c:kvm_loongarch_init() {
    ...
	r = kvm_loongarch_env_init();
	if (r)
		return r;

	return kvm_init(sizeof(struct kvm_vcpu), 0, THIS_MODULE);
}

If kvm_init() fails, kvm_loongarch_init() returns the error directly without
calling kvm_loongarch_env_exit() to clean up the successful
kvm_loongarch_env_init() setup.

Could this leave dangling function pointers in the perf core that lead to a
kernel panic upon the next performance counter event?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902070724.3459457-1-nagachaithanya9911@gmail.com?part=2