Re: [PATCH 2/2] KVM: arm64: vgic-its: Fix memory leak on the error path of vgic_add_lpi()

[Marc Zyngier <maz@kernel.org>]

On 2020-04-16 02:17, Zenghui Yu wrote:
> On 2020/4/14 11:03, Zenghui Yu wrote:
>> If we're going to fail out the vgic_add_lpi(), let's make sure the
>> allocated vgic_irq memory is also freed. Though it seems that both
>> cases are unlikely to fail.
>> 
>> Cc: Zengruan Ye <yezengruan@huawei.com>
>> Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
>> ---
>>   virt/kvm/arm/vgic/vgic-its.c | 8 ++++++--
>>   1 file changed, 6 insertions(+), 2 deletions(-)
>> 
>> diff --git a/virt/kvm/arm/vgic/vgic-its.c 
>> b/virt/kvm/arm/vgic/vgic-its.c
>> index d53d34a33e35..3c3b6a0f2dce 100644
>> --- a/virt/kvm/arm/vgic/vgic-its.c
>> +++ b/virt/kvm/arm/vgic/vgic-its.c
>> @@ -98,12 +98,16 @@ static struct vgic_irq *vgic_add_lpi(struct kvm 
>> *kvm, u32 intid,
>>   	 * the respective config data from memory here upon mapping the 
>> LPI.
>>   	 */
>>   	ret = update_lpi_config(kvm, irq, NULL, false);
>> -	if (ret)
>> +	if (ret) {
>> +		kfree(irq);
>>   		return ERR_PTR(ret);
>> +	}
>>     	ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
>> -	if (ret)
>> +	if (ret) {
>> +		kfree(irq);
>>   		return ERR_PTR(ret);
>> +	}
> 
> Looking at it again, I realized that this error handling is still not
> complete. Maybe we should use a vgic_put_irq() instead so that we can
> also properly delete the vgic_irq from lpi_list.

Yes, this is a more correct fix indeed. There is still a bit of a 
bizarre
behaviour if you have two vgic_add_lpi() racing to create the same 
interrupt,
which is pretty dodgy anyway (it means we have two MAPI at the same 
time...).
You end-up with re-reading the state from memory... Oh well.

> Marc, what do you think? Could you please help to fix it, or I can
> resend it.

I've fixed it as such (with a comment for a good measure):

diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index 3c3b6a0f2dce..c012a52b19f5 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -96,16 +96,19 @@ static struct vgic_irq *vgic_add_lpi(struct kvm 
*kvm, u32 intid,
  	 * We "cache" the configuration table entries in our struct 
vgic_irq's.
  	 * However we only have those structs for mapped IRQs, so we read in
  	 * the respective config data from memory here upon mapping the LPI.
+	 *
+	 * Should any of these fail, behave as if we couldn't create the LPI
+	 * by dropping the refcount and returning the error.
  	 */
  	ret = update_lpi_config(kvm, irq, NULL, false);
  	if (ret) {
-		kfree(irq);
+		vgic_put_irq(kvm, irq);
  		return ERR_PTR(ret);
  	}

  	ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
  	if (ret) {
-		kfree(irq);
+		vgic_put_irq(kvm, irq);
  		return ERR_PTR(ret);
  	}


Let me know if you agree with that.

Thanks,

         M.
-- 
Jazz is not dead. It just smells funny...

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel