Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753193AbdHWBrS (ORCPT ); Tue, 22 Aug 2017 21:47:18 -0400 Received: from szxga03-in.huawei.com ([45.249.212.189]:10880 "EHLO szxga03-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753142AbdHWBrQ (ORCPT ); Tue, 22 Aug 2017 21:47:16 -0400 From: Nixiaoming To: David Hildenbrand , "agraf@suse.com" , "pbonzini@redhat.com" , "rkrcmar@redhat.com" , "benh@kernel.crashing.org" , "paulus@samba.org" , "mpe@ellerman.id.au" CC: "kvm-ppc@vger.kernel.org" , "kvm@vger.kernel.org" , "linuxppc-dev@lists.ozlabs.org" , "linux-kernel@vger.kernel.org" Subject: Re:Re: [PATCH] fix memory leak on kvm_vm_ioctl_create_spapr_tce Thread-Topic: Re: [PATCH] fix memory leak on kvm_vm_ioctl_create_spapr_tce Thread-Index: AQHTG1mTl3bxlDcSs0uiZR7I7BeFYaKP+G8AgAErucA= Date: Wed, 23 Aug 2017 01:43:08 +0000 Message-ID: References: <20170822142823.69425-1-nixiaoming@huawei.com> <95fe182a-fd21-77a1-33df-0e609c2845fd@redhat.com> <8fd9a878-a8ce-5576-9a5c-1c221ff6ded7@redhat.com> In-Reply-To: <8fd9a878-a8ce-5576-9a5c-1c221ff6ded7@redhat.com> Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.57.88.168] Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090203.599CDDB3.003E,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=169.254.1.46, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 6176858ee86640a1e26fdb006a2c9143 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by nfs id v7N1lLom005641 Content-Length: 2681 Lines: 92 >On 22.08.2017 17:15, David Hildenbrand wrote: >> On 22.08.2017 16:28, nixiaoming wrote: >>> miss kfree(stt) when anon_inode_getfd return fail so add check >>> anon_inode_getfd return val, and kfree stt >>> >>> Signed-off-by: nixiaoming >>> --- >>> arch/powerpc/kvm/book3s_64_vio.c | 5 ++++- >>> 1 file changed, 4 insertions(+), 1 deletion(-) >>> >>> diff --git a/arch/powerpc/kvm/book3s_64_vio.c >>> b/arch/powerpc/kvm/book3s_64_vio.c >>> index a160c14..a0b4459 100644 >>> --- a/arch/powerpc/kvm/book3s_64_vio.c >>> +++ b/arch/powerpc/kvm/book3s_64_vio.c >>> @@ -341,8 +341,11 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm >>> *kvm, >>> >>> mutex_unlock(&kvm->lock); >>> >>> - return anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, >>> + ret = anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, >>> stt, O_RDWR | O_CLOEXEC); >>> + if (ret < 0) >>> + goto fail; >>> + return ret; >>> >>> fail: >>> if (stt) { >>> >> >> >> stt has already been added to kvm->arch.spapr_tce_tables, so freeing >> it is evil IMHO. I don't know that code, so I don't know if there is >> some other place that will make sure that everything in >> kvm->arch.spapr_tce_tables will properly get freed, even when no >> kvm->release >> function has been called (kvm_spapr_tce_release). >> > >If it is really not freed, than also kvm_put_kvm(stt->kvm) is missing. > >-- > >Thanks, > >David > if (!stt) return -ENOMEM; kvm_get_kvm(kvm); if anon_inode_getfd return -ENOMEM The user can not determine whether kvm_get_kvm has been called so need add kvm_pet_kvm when anon_inode_getfd fail stt has already been added to kvm->arch.spapr_tce_tables, but if anon_inode_getfd fail, stt is unused val, so call list_del_rcu, and free as quickly as possible new patch: --- arch/powerpc/kvm/book3s_64_vio.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c index a160c14..e2228f1 100644 --- a/arch/powerpc/kvm/book3s_64_vio.c +++ b/arch/powerpc/kvm/book3s_64_vio.c @@ -341,8 +341,16 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm, mutex_unlock(&kvm->lock); - return anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, + ret = anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, stt, O_RDWR | O_CLOEXEC); + if (ret < 0) { + mutex_lock(&kvm->lock); + list_del_rcu(&stt->list); + mutex_unlock(&kvm->lock); + kvm_put_kvm(kvm); + goto fail; + } + return ret; fail: if (stt) { -- 2.11.0.1