From: Ruan Jinjie <ruanjinjie@huawei.com>
To: <kwankhede@nvidia.com>, <alex.williamson@redhat.com>,
<kraxel@redhat.com>, <cjia@nvidia.com>, <kvm@vger.kernel.org>,
<linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] vfio/mdev: fix possible memory leak in module init funcs
Date: Wed, 30 Nov 2022 09:17:34 +0800 [thread overview]
Message-ID: <600ceae6-e476-aa2a-15de-cace3afee2fa@huawei.com> (raw)
In-Reply-To: <20221118032827.3725190-1-ruanjinjie@huawei.com>
Ping.
On 2022/11/18 11:28, ruanjinjie wrote:
> Inject fault while probing module, if device_register() fails,
> but the refcount of kobject is not decreased to 0, the name
> allocated in dev_set_name() is leaked. Fix this by calling
> put_device(), so that name can be freed in callback function
> kobject_cleanup().
>
> unreferenced object 0xffff88807d687008 (size 8):
> comm "modprobe", pid 8280, jiffies 4294807686 (age 12.378s)
> hex dump (first 8 bytes):
> 6d 64 70 79 00 6b 6b a5 mdpy.kk.
> backtrace:
> [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
> [<ffffffff81731d53>] kstrdup+0x33/0x60
> [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
> [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
> [<ffffffffa0260105>] 0xffffffffa0260105
> [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
> [<ffffffff813739cb>] do_init_module+0x1ab/0x640
> [<ffffffff81379d20>] load_module+0x5d00/0x77f0
> [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
> [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
> [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
>
> unreferenced object 0xffff888101ccbcf8 (size 8):
> comm "modprobe", pid 15662, jiffies 4295164481 (age 13.282s)
> hex dump (first 8 bytes):
> 6d 74 74 79 00 6b 6b a5 mtty.kk.
> backtrace:
> [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
> [<ffffffff81731d53>] kstrdup+0x33/0x60
> [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
> [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
> [<ffffffffa0248134>] 0xffffffffa0248134
> [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
> [<ffffffff813739cb>] do_init_module+0x1ab/0x640
> [<ffffffff81379d20>] load_module+0x5d00/0x77f0
> [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
> [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
> [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
>
> unreferenced object 0xffff88810177c6c8 (size 8):
> comm "modprobe", pid 23657, jiffies 4295314656 (age 13.227s)
> hex dump (first 8 bytes):
> 6d 62 6f 63 68 73 00 a5 mbochs..
> backtrace:
> [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150
> [<ffffffff81731d53>] kstrdup+0x33/0x60
> [<ffffffff83aa1421>] kobject_set_name_vargs+0x41/0x110
> [<ffffffff82d91abb>] dev_set_name+0xab/0xe0
> [<ffffffffa0248124>] 0xffffffffa0248124
> [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0
> [<ffffffff813739cb>] do_init_module+0x1ab/0x640
> [<ffffffff81379d20>] load_module+0x5d00/0x77f0
> [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0
> [<ffffffff83c944a5>] do_syscall_64+0x35/0x80
> [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
>
> Fixes: d61fc96f47fd ("sample: vfio mdev display - host device")
> Fixes: 9d1a546c53b4 ("docs: Sample driver to demonstrate how to use Mediated device framework.")
> Fixes: a5e6e6505f38 ("sample: vfio bochs vbe display (host device for bochs-drm)")
> Signed-off-by: ruanjinjie <ruanjinjie@huawei.com>
> ---
> samples/vfio-mdev/mbochs.c | 4 +++-
> samples/vfio-mdev/mdpy.c | 4 +++-
> samples/vfio-mdev/mtty.c | 4 +++-
> 3 files changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/samples/vfio-mdev/mbochs.c b/samples/vfio-mdev/mbochs.c
> index 117a8d799f71..1c47672be815 100644
> --- a/samples/vfio-mdev/mbochs.c
> +++ b/samples/vfio-mdev/mbochs.c
> @@ -1430,8 +1430,10 @@ static int __init mbochs_dev_init(void)
> dev_set_name(&mbochs_dev, "%s", MBOCHS_NAME);
>
> ret = device_register(&mbochs_dev);
> - if (ret)
> + if (ret) {
> + put_device(&mbochs_dev);
> goto err_class;
> + }
>
> ret = mdev_register_parent(&mbochs_parent, &mbochs_dev, &mbochs_driver,
> mbochs_mdev_types,
> diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> index 946e8cfde6fd..bfb93eaf535b 100644
> --- a/samples/vfio-mdev/mdpy.c
> +++ b/samples/vfio-mdev/mdpy.c
> @@ -717,8 +717,10 @@ static int __init mdpy_dev_init(void)
> dev_set_name(&mdpy_dev, "%s", MDPY_NAME);
>
> ret = device_register(&mdpy_dev);
> - if (ret)
> + if (ret) {
> + put_device(&mdpy_dev);
> goto err_class;
> + }
>
> ret = mdev_register_parent(&mdpy_parent, &mdpy_dev, &mdpy_driver,
> mdpy_mdev_types,
> diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
> index e72085fc1376..dddb0619846c 100644
> --- a/samples/vfio-mdev/mtty.c
> +++ b/samples/vfio-mdev/mtty.c
> @@ -1330,8 +1330,10 @@ static int __init mtty_dev_init(void)
> dev_set_name(&mtty_dev.dev, "%s", MTTY_NAME);
>
> ret = device_register(&mtty_dev.dev);
> - if (ret)
> + if (ret) {
> + put_device(&mtty_dev.dev);
> goto err_class;
> + }
>
> ret = mdev_register_parent(&mtty_dev.parent, &mtty_dev.dev,
> &mtty_driver, mtty_mdev_types,
next prev parent reply other threads:[~2022-11-30 1:17 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-18 3:28 [PATCH] vfio/mdev: fix possible memory leak in module init funcs ruanjinjie
2022-11-30 1:17 ` Ruan Jinjie [this message]
2022-11-30 23:06 ` Alex Williamson
2022-12-01 2:00 ` Tian, Kevin
2022-12-01 21:10 ` Alex Williamson
2022-12-02 5:28 ` Tian, Kevin
2022-12-02 15:08 ` Eric Farman
2022-12-01 2:11 ` Ruan Jinjie
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=600ceae6-e476-aa2a-15de-cace3afee2fa@huawei.com \
--to=ruanjinjie@huawei.com \
--cc=alex.williamson@redhat.com \
--cc=cjia@nvidia.com \
--cc=kraxel@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=kwankhede@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox