Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
To:     <linux-kernel@vger.kernel.org>, <kvm@vger.kernel.org>,
        <alex.williamson@redhat.com>
CC:     <kwankhede@nvidia.com>, <xieyingtai@huawei.com>,
        <lizhengui@huawei.com>, <xuxiaoyang2@huawei.com>
From:   "xuxiaoyang (C)" <xuxiaoyang2@huawei.com>
Subject: [PATCH] vfio iommu type1: Fix memory leak in
 vfio_iommu_type1_pin_pages
Message-ID: <f65f1c3c-c1bc-a44a-15ea-4cb6e43c8b4b@huawei.com>
Date:   Fri, 16 Oct 2020 17:35:58 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.3.2
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Language: en-GB
Content-Transfer-Encoding: 7bit
Precedence: bulk

From 099744c26513e386e707faecb3f17726e236d9bc Mon Sep 17 00:00:00 2001
From: Xiaoyang Xu <xuxiaoyang2@huawei.com>
Date: Fri, 16 Oct 2020 15:32:02 +0800
Subject: [PATCH] vfio iommu type1: Fix memory leak in
 vfio_iommu_type1_pin_pages

pfn is not added to pfn_list when vfio_add_to_pfn_list fails.
vfio_unpin_page_external will exit directly without calling
vfio_iova_put_vfio_pfn.This will lead to a memory leak.

Signed-off-by: Xiaoyang Xu <xuxiaoyang2@huawei.com>
---
 drivers/vfio/vfio_iommu_type1.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index c255a6683f31..26f518b02c81 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -640,6 +640,7 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
 	unsigned long remote_vaddr;
 	struct vfio_dma *dma;
 	bool do_accounting;
+	int unlocked;

 	if (!iommu || !user_pfn || !phys_pfn)
 		return -EINVAL;
@@ -693,7 +694,9 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,

 		ret = vfio_add_to_pfn_list(dma, iova, phys_pfn[i]);
 		if (ret) {
-			vfio_unpin_page_external(dma, iova, do_accounting);
+			unlocked = put_pfn(phys_pfn[i], dma->prot);
+			if (do_accounting)
+				vfio_lock_acct(dma, -unlocked, true);
 			goto pin_unwind;
 		}

--
2.19.1