Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Message-ID: <bfa563e6a584bd85d3abe953ca088281dc0e167b.camel@linux.ibm.com>
Subject: Re: [PATCH] KVM: Add separate helper for putting borrowed reference
 to kvm
From:   Leonardo Bras <leonardo@linux.ibm.com>
To:     Paolo Bonzini <pbonzini@redhat.com>,
        Sean Christopherson <sean.j.christopherson@intel.com>
Cc:     Paul Mackerras <paulus@ozlabs.org>,
        Radim =?UTF-8?Q?Kr=C4=8Dm=C3=A1=C5=99?= <rkrcmar@redhat.com>,
        kvm-ppc@vger.kernel.org, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org
Date:   Wed, 27 Nov 2019 15:24:35 -0300
In-Reply-To: <e1a4218f-2a70-3de3-1403-dbebf8a8abdf@redhat.com>
References: <20191021225842.23941-1-sean.j.christopherson@intel.com>
         <de313d549a5ae773aad6bbf04c20b395bea7811f.camel@linux.ibm.com>
         <20191126171416.GA22233@linux.intel.com>
         <0009c6c1bb635098fa68cb6db6414634555039fe.camel@linux.ibm.com>
         <e1a4218f-2a70-3de3-1403-dbebf8a8abdf@redhat.com>
Content-Type: multipart/signed; micalg="pgp-sha256";
        protocol="application/pgp-signature"; boundary="=-othlKLjwGq4RsDZV0+9/"
User-Agent: Evolution 3.34.1 (3.34.1-1.fc31) 
MIME-Version: 1.0
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


--=-othlKLjwGq4RsDZV0+9/
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, 2019-11-27 at 17:38 +0100, Paolo Bonzini wrote:
> On 26/11/19 18:53, Leonardo Bras wrote:
> > I agree an use-after-free more problem than a memory leak, but I
> > think
> > that there is a way to solve this without leaking the memory also.
> >=20
> > One option would be reordering the kvm_put_kvm(), like in this
> > patch:
> > https://lkml.org/lkml/2019/11/26/517
>=20
> It's a tradeoff between "fix one bug" and "mitigate all bugs of that
> class", both are good things to do.  Reordering the kvm_put_kvm()
> fixes
> the bug.  kvm_put_kvm_no_destroy() makes all bugs of that kind less
> severe, but it doesn't try to fix them.
>=20
> Paolo
>=20

I think I understand it better now, thanks Paolo and Sean.

By what I could undestand up to now, these functions that use borrowed
references can only be called while the reference (file descriptor)
exists.=20
So, suppose these threads, where:
- T1 uses a borrowed reference, and=20
- T2 is releasing the reference (close, release):

T1				| T2
kvm_get_kvm()			|
...				| kvm_put_kvm()
kvm_put_kvm_no_destroy()	|

The above would not trigger a use-after-free bug, but will cause a
memory leak.
Is my above understanding right?

Best regards,

Leonardo


--=-othlKLjwGq4RsDZV0+9/
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEMdeUgIzgjf6YmUyOlQYWtz9SttQFAl3ev2QACgkQlQYWtz9S
ttTMfg//TLejnZkRJWcvpxfD9LlYvQaISoSSxkfYCFdvp6vdKss6nm+iThpmNzg/
Jf9eA2A8dnRLdV65V4ZRS7i1CYNEB3CWvqn26HLxD9SOzKgtEBz0q40CTWcGOoHc
GwX9pR7vbN1ZsckdbiX1mu45255eg1xh9yAxegYWOPUU1vccvMAgspXq5pkeHEQP
HE+8N4Cjf/dGt8WUuTe2BcpV5tBNy2cPZ0/clel/VYlfOUsH9RHQ6JSxmCNiF8tT
zs8AnzPIYUWqwo0FX9+KeQIbd9YKxNy6DaUawwNYuDV299kkS65smMc1h9jHHPh7
P4EgqLzDVQ0exNkM/SVOVWInxSpJBm1Q50oJoZO70XvbuBzWPpX6MLhxwwxZWSCR
00XCXs2qsBkBAT0BrD8ZForwNnvHrEhRnk2Zp1jp/0w0Mze/UMZH7UU9le461GZT
N3bDUwuoTlqkiDWB2jdMWu752n4GbCN2fx1CZBNFSWOKrMrgSVbLnnYadwinJY4O
FJG8O40/ZfPkdAy8iqVF9QCwX/3Ft5uXwDO8I6C+wBeWGBOxhejE2MsKlVrUGKyH
m21C9LfeQC7zmowL7E0tSbmyYfR0U1hXTLQ+moG6YFayLq5G9NQ8WQTkTPfn8E8g
w+5mkCrVDX1/s81LqLxH9MoB9fi+CYWdtJV1HuB9hNSiPlznQzg=
=1KbN
-----END PGP SIGNATURE-----

--=-othlKLjwGq4RsDZV0+9/--