2018-08-27 12:48:55

by Li Qiang

Subject: [PATCH] vfio: fix potential memory leak in vfio_msi_cap_len

Free the vdev->msi_perm in error path.

Signed-off-by: Li Qiang <[email protected]>
---
drivers/vfio/pci/vfio_pci_config.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
index 115a36f6f403..62023b4a373b 100644
--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -1180,8 +1180,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
return -ENOMEM;

ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
- if (ret)
+ if (ret) {
+ kfree(vdev->msi_perm);
return ret;
+ }

return len;
}
--
2.11.0

2018-08-30 14:17:52

by David Hildenbrand

Subject: Re: [PATCH] vfio: fix potential memory leak in vfio_msi_cap_len

On 27.08.2018 14:47, Li Qiang wrote:
> Free the vdev->msi_perm in error path.
>
> Signed-off-by: Li Qiang <[email protected]>
> ---
> drivers/vfio/pci/vfio_pci_config.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
> index 115a36f6f403..62023b4a373b 100644
> --- a/drivers/vfio/pci/vfio_pci_config.c
> +++ b/drivers/vfio/pci/vfio_pci_config.c
> @@ -1180,8 +1180,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
> return -ENOMEM;
>
> ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
> - if (ret)
> + if (ret) {
> + kfree(vdev->msi_perm);
> return ret;
> + }
>
> return len;
> }
>

Doesn't vfio_config_free() take care of that in all cases?

--

Thanks,

David / dhildenb

2018-09-03 17:01:55

by Eric Auger

Subject: Re: [PATCH] vfio: fix potential memory leak in vfio_msi_cap_len

Hi Li, David,

On 08/30/2018 04:15 PM, David Hildenbrand wrote:
> On 27.08.2018 14:47, Li Qiang wrote:
>> Free the vdev->msi_perm in error path.
>>
>> Signed-off-by: Li Qiang <[email protected]>
>> ---
>> drivers/vfio/pci/vfio_pci_config.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
>> index 115a36f6f403..62023b4a373b 100644
>> --- a/drivers/vfio/pci/vfio_pci_config.c
>> +++ b/drivers/vfio/pci/vfio_pci_config.c
>> @@ -1180,8 +1180,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
>> return -ENOMEM;
>>
>> ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
>> - if (ret)
>> + if (ret) {
>> + kfree(vdev->msi_perm);
>> return ret;
>> + }
>>
>> return len;
>> }
>>
>
> Doesn't vfio_config_free() take care of that in all cases?

Looks OK to me.
Reviewed-by: Eric Auger <[email protected]>

Looks vfio_config_free is called on vfio_pci_release whereas
vfio_msi_cap_len can fail in vfio_pci_open path.

Thanks

Eric
>

2018-09-04 15:54:37

by Alex Williamson

Subject: Re: [PATCH] vfio: fix potential memory leak in vfio_msi_cap_len

On Mon, 27 Aug 2018 05:47:21 -0700
Li Qiang <[email protected]> wrote:

> Free the vdev->msi_perm in error path.
>
> Signed-off-by: Li Qiang <[email protected]>
> ---
> drivers/vfio/pci/vfio_pci_config.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c
> index 115a36f6f403..62023b4a373b 100644
> --- a/drivers/vfio/pci/vfio_pci_config.c
> +++ b/drivers/vfio/pci/vfio_pci_config.c
> @@ -1180,8 +1180,10 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos)
> return -ENOMEM;
>
> ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags);
> - if (ret)
> + if (ret) {
> + kfree(vdev->msi_perm);
> return ret;
> + }
>
> return len;
> }

Fix looks correct to me, I'll queue this for v4.20 with Eric's R-b.
Thanks,

Alex