[PATCH v3 0/2] Drivers: hv: vmbus: fix two issues

[PATCH v3 0/2] Drivers: hv: vmbus: fix two issues

[Yang Yingliang]

This patchset fixes a double free and a memory leak problems.

v2 -> v3:
  Update commit message and comment suggested by Michael.

v1 -> v2:
  Add a comment before vmbus_device_register().

Yang Yingliang (2):
  Drivers: hv: vmbus: fix double free in the error path of
    vmbus_add_channel_work()
  Drivers: hv: vmbus: fix possible memory leak in
    vmbus_device_register()

 drivers/hv/channel_mgmt.c | 5 ++++-
 drivers/hv/vmbus_drv.c    | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

-- 
2.25.1

[PATCH v3 1/2] Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()

[Yang Yingliang]

In the error path of vmbus_device_register(), device_unregister()
is called, which calls vmbus_device_release().  The latter frees
the struct hv_device that was passed in to vmbus_device_register().
So remove the kfree() in vmbus_add_channel_work() to avoid a double
free.

Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")
Suggested-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
 drivers/hv/channel_mgmt.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 5b120402d405..0ebd73d571bc 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -533,13 +533,16 @@ static void vmbus_add_channel_work(struct work_struct *work)
 	 * Add the new device to the bus. This will kick off device-driver
 	 * binding which eventually invokes the device driver's AddDevice()
 	 * method.
+	 * If vmbus_device_register() fails, the 'device_obj' is freed in
+	 * vmbus_device_release() as called by device_unregister() in the
+	 * error path of vmbus_device_register(). In the outside error
+	 * path, there's no need to free it.
 	 */
 	ret = vmbus_device_register(newchannel->device_obj);
 
 	if (ret != 0) {
 		pr_err("unable to add child device object (relid %d)\n",
 			newchannel->offermsg.child_relid);
-		kfree(newchannel->device_obj);
 		goto err_deq_chan;
 	}
 
-- 
2.25.1

RE: [PATCH v3 1/2] Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()

[Michael Kelley (LINUX)]

From: Yang Yingliang <yangyingliang@huawei.com>
> 
> In the error path of vmbus_device_register(), device_unregister()
> is called, which calls vmbus_device_release().  The latter frees
> the struct hv_device that was passed in to vmbus_device_register().
> So remove the kfree() in vmbus_add_channel_work() to avoid a double
> free.
> 
> Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")
> Suggested-by: Michael Kelley <mikelley@microsoft.com>
> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
> ---
>  drivers/hv/channel_mgmt.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
> index 5b120402d405..0ebd73d571bc 100644
> --- a/drivers/hv/channel_mgmt.c
> +++ b/drivers/hv/channel_mgmt.c
> @@ -533,13 +533,16 @@ static void vmbus_add_channel_work(struct work_struct *work)
>  	 * Add the new device to the bus. This will kick off device-driver
>  	 * binding which eventually invokes the device driver's AddDevice()
>  	 * method.
> +	 * If vmbus_device_register() fails, the 'device_obj' is freed in
> +	 * vmbus_device_release() as called by device_unregister() in the
> +	 * error path of vmbus_device_register(). In the outside error
> +	 * path, there's no need to free it.
>  	 */
>  	ret = vmbus_device_register(newchannel->device_obj);
> 
>  	if (ret != 0) {
>  		pr_err("unable to add child device object (relid %d)\n",
>  			newchannel->offermsg.child_relid);
> -		kfree(newchannel->device_obj);
>  		goto err_deq_chan;
>  	}
> 
> --
> 2.25.1

Reviewed-by: Michael Kelley <mikelley@microsoft.com>

[PATCH v3 2/2] Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()

[Yang Yingliang]

If device_register() returns error in vmbus_device_register(),
the name allocated by dev_set_name() must be freed. As comment
of device_register() says, it should use put_device() to give
up the reference in the error path. So fix this by calling
put_device(), then the name can be freed in kobject_cleanup().

Fixes: 09d50ff8a233 ("Staging: hv: make the Hyper-V virtual bus code build")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
 drivers/hv/vmbus_drv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index 8b2e413bf19c..e592c481f7ae 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -2082,6 +2082,7 @@ int vmbus_device_register(struct hv_device *child_device_obj)
 	ret = device_register(&child_device_obj->device);
 	if (ret) {
 		pr_err("Unable to register child device\n");
+		put_device(&child_device_obj->device);
 		return ret;
 	}
 
-- 
2.25.1

RE: [PATCH v3 2/2] Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()

[Michael Kelley (LINUX)]

From: Yang Yingliang <yangyingliang@huawei.com> Sent: Saturday, November 19, 2022 12:12 AM
> 
> If device_register() returns error in vmbus_device_register(),
> the name allocated by dev_set_name() must be freed. As comment
> of device_register() says, it should use put_device() to give
> up the reference in the error path. So fix this by calling
> put_device(), then the name can be freed in kobject_cleanup().
> 
> Fixes: 09d50ff8a233 ("Staging: hv: make the Hyper-V virtual bus code build")
> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
> ---
>  drivers/hv/vmbus_drv.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
> index 8b2e413bf19c..e592c481f7ae 100644
> --- a/drivers/hv/vmbus_drv.c
> +++ b/drivers/hv/vmbus_drv.c
> @@ -2082,6 +2082,7 @@ int vmbus_device_register(struct hv_device
> *child_device_obj)
>  	ret = device_register(&child_device_obj->device);
>  	if (ret) {
>  		pr_err("Unable to register child device\n");
> +		put_device(&child_device_obj->device);
>  		return ret;
>  	}
> 
> --
> 2.25.1

Reviewed-by: Michael Kelley <mikelley@microsoft.com>

Re: [PATCH v3 0/2] Drivers: hv: vmbus: fix two issues

[Wei Liu]

On Sat, Nov 19, 2022 at 04:11:33PM +0800, Yang Yingliang wrote:
> This patchset fixes a double free and a memory leak problems.
> 
> v2 -> v3:
>   Update commit message and comment suggested by Michael.
> 
> v1 -> v2:
>   Add a comment before vmbus_device_register().
> 
> Yang Yingliang (2):
>   Drivers: hv: vmbus: fix double free in the error path of
>     vmbus_add_channel_work()
>   Drivers: hv: vmbus: fix possible memory leak in
>     vmbus_device_register()

I added a new line between the old and new paragraphs in the second
commit.

Applied to hyperv-fixes. Thanks.