2023-03-15 15:39:58

by Anthony Krowiak

Subject: [PATCH] s390/vfio_ap: fix memory leak in vfio_ap device driver

The device release callback function invoked to release the matrix device
uses the dev_get_drvdata(device *dev) function to retrieve the
pointer to the vfio_matrix_dev object in order to free its storage. The
problem is, this object is not stored as drvdata with the device; since the
kfree function will accept a NULL pointer, the memory for the
vfio_matrix_dev object is never freed.

Since the device being released is contained within the vfio_matrix_dev
object, the container_of macro will be used to retrieve its pointer.

Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP device driver")
Signed-off-by: Tony Krowiak <[email protected]>
---
drivers/s390/crypto/vfio_ap_drv.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c
index 997b524bdd2b..15e9de9f4574 100644
--- a/drivers/s390/crypto/vfio_ap_drv.c
+++ b/drivers/s390/crypto/vfio_ap_drv.c
@@ -54,8 +54,9 @@ static struct ap_driver vfio_ap_drv = {

static void vfio_ap_matrix_dev_release(struct device *dev)
{
- struct ap_matrix_dev *matrix_dev = dev_get_drvdata(dev);
-
+ struct ap_matrix_dev *matrix_dev = container_of(dev,
+ struct ap_matrix_dev,
+ device);
kfree(matrix_dev);
}

--
2.31.1

2023-03-15 17:25:45

by Harald Freudenberger

Subject: Re: [PATCH] s390/vfio_ap: fix memory leak in vfio_ap device driver

On 2023-03-15 16:39, Tony Krowiak wrote:
> The device release callback function invoked to release the matrix
> device
> uses the dev_get_drvdata(device *dev) function to retrieve the
> pointer to the vfio_matrix_dev object in order to free its storage. The
> problem is, this object is not stored as drvdata with the device; since
> the
> kfree function will accept a NULL pointer, the memory for the
> vfio_matrix_dev object is never freed.
>
> Since the device being released is contained within the vfio_matrix_dev
> object, the container_of macro will be used to retrieve its pointer.
>
> Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP
> device driver")
> Signed-off-by: Tony Krowiak <[email protected]>
> ---
> drivers/s390/crypto/vfio_ap_drv.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/s390/crypto/vfio_ap_drv.c
> b/drivers/s390/crypto/vfio_ap_drv.c
> index 997b524bdd2b..15e9de9f4574 100644
> --- a/drivers/s390/crypto/vfio_ap_drv.c
> +++ b/drivers/s390/crypto/vfio_ap_drv.c
> @@ -54,8 +54,9 @@ static struct ap_driver vfio_ap_drv = {
>
> static void vfio_ap_matrix_dev_release(struct device *dev)
> {
> - struct ap_matrix_dev *matrix_dev = dev_get_drvdata(dev);
> -
> + struct ap_matrix_dev *matrix_dev = container_of(dev,
> + struct ap_matrix_dev,
> + device);
> kfree(matrix_dev);
> }

I needed some indirections to follow what exactly happens here and how
you
fix it, but finally I got it.
Reviewed-by: Harald Freudenberger <[email protected]>

2023-03-15 17:57:36

by Anthony Krowiak

Subject: Re: [PATCH] s390/vfio_ap: fix memory leak in vfio_ap device driver

snip ...


> I needed some indirections to follow what exactly happens here and how
> you
> fix it, but finally I got it.
> Reviewed-by: Harald Freudenberger <[email protected]>

Sorry about the indirections. Thanks for the review.

2023-03-16 08:40:15

by Heiko Carstens

Subject: Re: [PATCH] s390/vfio_ap: fix memory leak in vfio_ap device driver

On Wed, Mar 15, 2023 at 11:39:32AM -0400, Tony Krowiak wrote:
> The device release callback function invoked to release the matrix device
> uses the dev_get_drvdata(device *dev) function to retrieve the
> pointer to the vfio_matrix_dev object in order to free its storage. The
> problem is, this object is not stored as drvdata with the device; since the
> kfree function will accept a NULL pointer, the memory for the
> vfio_matrix_dev object is never freed.
>
> Since the device being released is contained within the vfio_matrix_dev
> object, the container_of macro will be used to retrieve its pointer.
>
> Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP device driver")
> Signed-off-by: Tony Krowiak <[email protected]>
> ---
> drivers/s390/crypto/vfio_ap_drv.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c
> index 997b524bdd2b..15e9de9f4574 100644
> --- a/drivers/s390/crypto/vfio_ap_drv.c
> +++ b/drivers/s390/crypto/vfio_ap_drv.c
> @@ -54,8 +54,9 @@ static struct ap_driver vfio_ap_drv = {
>
> static void vfio_ap_matrix_dev_release(struct device *dev)
> {
> - struct ap_matrix_dev *matrix_dev = dev_get_drvdata(dev);
> -
> + struct ap_matrix_dev *matrix_dev = container_of(dev,
> + struct ap_matrix_dev,
> + device);
> kfree(matrix_dev);

Could you keep this code more readable, including adding the missing
blank line after the declaration, please? Something like:

static void vfio_ap_matrix_dev_release(struct device *dev)
{
struct ap_matrix_dev *matrix_dev;

matrix_dev = container_of(dev, struct ap_matrix_dev, device);
kfree(matrix_dev);
}

Thanks!

2023-03-16 13:36:04

by Anthony Krowiak

Subject: Re: [PATCH] s390/vfio_ap: fix memory leak in vfio_ap device driver

On 3/16/23 4:39 AM, Heiko Carstens wrote:
> On Wed, Mar 15, 2023 at 11:39:32AM -0400, Tony Krowiak wrote:
>> The device release callback function invoked to release the matrix device
>> uses the dev_get_drvdata(device *dev) function to retrieve the
>> pointer to the vfio_matrix_dev object in order to free its storage. The
>> problem is, this object is not stored as drvdata with the device; since the
>> kfree function will accept a NULL pointer, the memory for the
>> vfio_matrix_dev object is never freed.
>>
>> Since the device being released is contained within the vfio_matrix_dev
>> object, the container_of macro will be used to retrieve its pointer.
>>
>> Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP device driver")
>> Signed-off-by: Tony Krowiak <[email protected]>
>> ---
>> drivers/s390/crypto/vfio_ap_drv.c | 5 +++--
>> 1 file changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c
>> index 997b524bdd2b..15e9de9f4574 100644
>> --- a/drivers/s390/crypto/vfio_ap_drv.c
>> +++ b/drivers/s390/crypto/vfio_ap_drv.c
>> @@ -54,8 +54,9 @@ static struct ap_driver vfio_ap_drv = {
>>
>> static void vfio_ap_matrix_dev_release(struct device *dev)
>> {
>> - struct ap_matrix_dev *matrix_dev = dev_get_drvdata(dev);
>> -
>> + struct ap_matrix_dev *matrix_dev = container_of(dev,
>> + struct ap_matrix_dev,
>> + device);
>> kfree(matrix_dev);
> Could you keep this code more readable, including adding the missing
> blank line after the declaration, please? Something like:
>
> static void vfio_ap_matrix_dev_release(struct device *dev)
> {
> struct ap_matrix_dev *matrix_dev;
>
> matrix_dev = container_of(dev, struct ap_matrix_dev, device);
> kfree(matrix_dev);
> }
>
> Thanks!


Will do.