A memory leak on vgic_irq structure was recently reported by kmemleak
on the guest destroy (or shutdown). It turned out that there're still
pending interrupts (LPI) staying in the vcpu's ap_list during destroy
so that KVM can't free the vgic_irq structure due to an extra refcount.
Patch #1 is intended to fix this issue. Patch #2 is a memory leak fix
on the error path, noticed while debugging.
Zenghui Yu (2):
KVM: arm64: vgic-v3: Retire all pending LPIs on vcpu destroy
KVM: arm64: vgic-its: Fix memory leak on the error path of
vgic_add_lpi()
virt/kvm/arm/vgic/vgic-init.c | 6 ++++++
virt/kvm/arm/vgic/vgic-its.c | 8 ++++++--
2 files changed, 12 insertions(+), 2 deletions(-)
--
2.19.1
If we're going to fail out the vgic_add_lpi(), let's make sure the
allocated vgic_irq memory is also freed. Though it seems that both
cases are unlikely to fail.
Cc: Zengruan Ye <[email protected]>
Signed-off-by: Zenghui Yu <[email protected]>
---
virt/kvm/arm/vgic/vgic-its.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index d53d34a33e35..3c3b6a0f2dce 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -98,12 +98,16 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,
* the respective config data from memory here upon mapping the LPI.
*/
ret = update_lpi_config(kvm, irq, NULL, false);
- if (ret)
+ if (ret) {
+ kfree(irq);
return ERR_PTR(ret);
+ }
ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
- if (ret)
+ if (ret) {
+ kfree(irq);
return ERR_PTR(ret);
+ }
return irq;
}
--
2.19.1
On 2020/4/14 11:03, Zenghui Yu wrote:
> If we're going to fail out the vgic_add_lpi(), let's make sure the
> allocated vgic_irq memory is also freed. Though it seems that both
> cases are unlikely to fail.
>
> Cc: Zengruan Ye <[email protected]>
> Signed-off-by: Zenghui Yu <[email protected]>
> ---
> virt/kvm/arm/vgic/vgic-its.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
> index d53d34a33e35..3c3b6a0f2dce 100644
> --- a/virt/kvm/arm/vgic/vgic-its.c
> +++ b/virt/kvm/arm/vgic/vgic-its.c
> @@ -98,12 +98,16 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid,
> * the respective config data from memory here upon mapping the LPI.
> */
> ret = update_lpi_config(kvm, irq, NULL, false);
> - if (ret)
> + if (ret) {
> + kfree(irq);
> return ERR_PTR(ret);
> + }
>
> ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
> - if (ret)
> + if (ret) {
> + kfree(irq);
> return ERR_PTR(ret);
> + }
Looking at it again, I realized that this error handling is still not
complete. Maybe we should use a vgic_put_irq() instead so that we can
also properly delete the vgic_irq from lpi_list.
Marc, what do you think? Could you please help to fix it, or I can
resend it.
Thanks,
Zenghui
On 2020-04-16 02:17, Zenghui Yu wrote:
> On 2020/4/14 11:03, Zenghui Yu wrote:
>> If we're going to fail out the vgic_add_lpi(), let's make sure the
>> allocated vgic_irq memory is also freed. Though it seems that both
>> cases are unlikely to fail.
>>
>> Cc: Zengruan Ye <[email protected]>
>> Signed-off-by: Zenghui Yu <[email protected]>
>> ---
>> virt/kvm/arm/vgic/vgic-its.c | 8 ++++++--
>> 1 file changed, 6 insertions(+), 2 deletions(-)
>>
>> diff --git a/virt/kvm/arm/vgic/vgic-its.c
>> b/virt/kvm/arm/vgic/vgic-its.c
>> index d53d34a33e35..3c3b6a0f2dce 100644
>> --- a/virt/kvm/arm/vgic/vgic-its.c
>> +++ b/virt/kvm/arm/vgic/vgic-its.c
>> @@ -98,12 +98,16 @@ static struct vgic_irq *vgic_add_lpi(struct kvm
>> *kvm, u32 intid,
>> * the respective config data from memory here upon mapping the
>> LPI.
>> */
>> ret = update_lpi_config(kvm, irq, NULL, false);
>> - if (ret)
>> + if (ret) {
>> + kfree(irq);
>> return ERR_PTR(ret);
>> + }
>> ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
>> - if (ret)
>> + if (ret) {
>> + kfree(irq);
>> return ERR_PTR(ret);
>> + }
>
> Looking at it again, I realized that this error handling is still not
> complete. Maybe we should use a vgic_put_irq() instead so that we can
> also properly delete the vgic_irq from lpi_list.
Yes, this is a more correct fix indeed. There is still a bit of a
bizarre
behaviour if you have two vgic_add_lpi() racing to create the same
interrupt,
which is pretty dodgy anyway (it means we have two MAPI at the same
time...).
You end-up with re-reading the state from memory... Oh well.
> Marc, what do you think? Could you please help to fix it, or I can
> resend it.
I've fixed it as such (with a comment for a good measure):
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index 3c3b6a0f2dce..c012a52b19f5 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -96,16 +96,19 @@ static struct vgic_irq *vgic_add_lpi(struct kvm
*kvm, u32 intid,
* We "cache" the configuration table entries in our struct
vgic_irq's.
* However we only have those structs for mapped IRQs, so we read in
* the respective config data from memory here upon mapping the LPI.
+ *
+ * Should any of these fail, behave as if we couldn't create the LPI
+ * by dropping the refcount and returning the error.
*/
ret = update_lpi_config(kvm, irq, NULL, false);
if (ret) {
- kfree(irq);
+ vgic_put_irq(kvm, irq);
return ERR_PTR(ret);
}
ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
if (ret) {
- kfree(irq);
+ vgic_put_irq(kvm, irq);
return ERR_PTR(ret);
}
Let me know if you agree with that.
Thanks,
M.
--
Jazz is not dead. It just smells funny...
On 2020/4/17 1:23, Marc Zyngier wrote:
> On 2020-04-16 02:17, Zenghui Yu wrote:
>> On 2020/4/14 11:03, Zenghui Yu wrote:
>>> If we're going to fail out the vgic_add_lpi(), let's make sure the
>>> allocated vgic_irq memory is also freed. Though it seems that both
>>> cases are unlikely to fail.
>>>
>>> Cc: Zengruan Ye <[email protected]>
>>> Signed-off-by: Zenghui Yu <[email protected]>
>>> ---
>>> virt/kvm/arm/vgic/vgic-its.c | 8 ++++++--
>>> 1 file changed, 6 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
>>> index d53d34a33e35..3c3b6a0f2dce 100644
>>> --- a/virt/kvm/arm/vgic/vgic-its.c
>>> +++ b/virt/kvm/arm/vgic/vgic-its.c
>>> @@ -98,12 +98,16 @@ static struct vgic_irq *vgic_add_lpi(struct kvm
>>> *kvm, u32 intid,
>>> * the respective config data from memory here upon mapping the
>>> LPI.
>>> */
>>> ret = update_lpi_config(kvm, irq, NULL, false);
>>> - if (ret)
>>> + if (ret) {
>>> + kfree(irq);
>>> return ERR_PTR(ret);
>>> + }
>>> ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
>>> - if (ret)
>>> + if (ret) {
>>> + kfree(irq);
>>> return ERR_PTR(ret);
>>> + }
>>
>> Looking at it again, I realized that this error handling is still not
>> complete. Maybe we should use a vgic_put_irq() instead so that we can
>> also properly delete the vgic_irq from lpi_list.
>
> Yes, this is a more correct fix indeed. There is still a bit of a bizarre
> behaviour if you have two vgic_add_lpi() racing to create the same
> interrupt,
> which is pretty dodgy anyway (it means we have two MAPI at the same
> time...).
> You end-up with re-reading the state from memory... Oh well.
>
>> Marc, what do you think? Could you please help to fix it, or I can
>> resend it.
>
> I've fixed it as such (with a comment for a good measure):
>
> diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
> index 3c3b6a0f2dce..c012a52b19f5 100644
> --- a/virt/kvm/arm/vgic/vgic-its.c
> +++ b/virt/kvm/arm/vgic/vgic-its.c
> @@ -96,16 +96,19 @@ static struct vgic_irq *vgic_add_lpi(struct kvm
> *kvm, u32 intid,
> * We "cache" the configuration table entries in our struct
> vgic_irq's.
> * However we only have those structs for mapped IRQs, so we read in
> * the respective config data from memory here upon mapping the LPI.
> + *
> + * Should any of these fail, behave as if we couldn't create the LPI
> + * by dropping the refcount and returning the error.
> */
> ret = update_lpi_config(kvm, irq, NULL, false);
> if (ret) {
> - kfree(irq);
> + vgic_put_irq(kvm, irq);
> return ERR_PTR(ret);
> }
>
> ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
> if (ret) {
> - kfree(irq);
> + vgic_put_irq(kvm, irq);
> return ERR_PTR(ret);
> }
>
>
> Let me know if you agree with that.
Agreed. Thanks for the fix!
Zenghui