Date: Tue, 27 Jun 2017 14:50:07 +0100
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, borntraeger@de.ibm.com,
        frankja@linux.vnet.ibm.com
Subject: Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure
Message-ID: <20170627135007.GG10672@ZenIV.linux.org.uk>
References: <1498564636-20259-1-git-send-email-imbrenda@linux.vnet.ibm.com>
 <66c8737e-20f7-627f-a1dd-8139d3304959@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <66c8737e-20f7-627f-a1dd-8139d3304959@redhat.com>
User-Agent: Mutt/1.8.0 (2017-02-23)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1637
Lines: 42

On Tue, Jun 27, 2017 at 03:08:32PM +0200, Paolo Bonzini wrote:

> On 27/06/2017 13:57, Claudio Imbrenda wrote:
> > If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
> > will have a memory leak due to not freeing the kvm object.
> > 
> > A call to kvm_put_kvm was accidentally removed from an error handling in
> > commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> > 
> > This patch simply restores the call to kvm_put_kvm, so that the kvm
> > object is destroyed before returning an error.
> > 
> > Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
> > Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> > ---
> >  virt/kvm/kvm_main.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index f0fe9d0..257d2a8 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -3194,6 +3194,7 @@ static int kvm_dev_ioctl_create_vm(unsigned long type)
> >  	if (kvm_create_vm_debugfs(kvm, r) < 0) {
> >  		put_unused_fd(r);
> >  		fput(file);
> > +		kvm_put_kvm(kvm);
> >  		return -ENOMEM;
> >  	}
> >  
> > 
> 
> Queued, thanks.

It's broken.  Look: once we are past the anon_inode_getfile(), the
reference we held on kvm is transferred into new struct file.  After
that point we don't drop kvm - we drop file.  And as long as that
file is held, it will keep holding what used to be our reference to
kvm.  Once all references to file are gone, its ->release() will be
called and that's where kvm reference in it will be dropped.

IOW, this patch introduces a double-put.