Messages in this thread | | | Subject | Re: [PATCH 2/2] KVM: arm64: vgic-its: Fix memory leak on the error path of vgic_add_lpi() | From | Zenghui Yu <> | Date | Fri, 17 Apr 2020 14:40:31 +0800 |
| |
On 2020/4/17 1:23, Marc Zyngier wrote: > On 2020-04-16 02:17, Zenghui Yu wrote: >> On 2020/4/14 11:03, Zenghui Yu wrote: >>> If we're going to fail out the vgic_add_lpi(), let's make sure the >>> allocated vgic_irq memory is also freed. Though it seems that both >>> cases are unlikely to fail. >>> >>> Cc: Zengruan Ye <yezengruan@huawei.com> >>> Signed-off-by: Zenghui Yu <yuzenghui@huawei.com> >>> --- >>> virt/kvm/arm/vgic/vgic-its.c | 8 ++++++-- >>> 1 file changed, 6 insertions(+), 2 deletions(-) >>> >>> diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c >>> index d53d34a33e35..3c3b6a0f2dce 100644 >>> --- a/virt/kvm/arm/vgic/vgic-its.c >>> +++ b/virt/kvm/arm/vgic/vgic-its.c >>> @@ -98,12 +98,16 @@ static struct vgic_irq *vgic_add_lpi(struct kvm >>> *kvm, u32 intid, >>> * the respective config data from memory here upon mapping the >>> LPI. >>> */ >>> ret = update_lpi_config(kvm, irq, NULL, false); >>> - if (ret) >>> + if (ret) { >>> + kfree(irq); >>> return ERR_PTR(ret); >>> + } >>> ret = vgic_v3_lpi_sync_pending_status(kvm, irq); >>> - if (ret) >>> + if (ret) { >>> + kfree(irq); >>> return ERR_PTR(ret); >>> + } >> >> Looking at it again, I realized that this error handling is still not >> complete. Maybe we should use a vgic_put_irq() instead so that we can >> also properly delete the vgic_irq from lpi_list. > > Yes, this is a more correct fix indeed. There is still a bit of a bizarre > behaviour if you have two vgic_add_lpi() racing to create the same > interrupt, > which is pretty dodgy anyway (it means we have two MAPI at the same > time...). > You end-up with re-reading the state from memory... Oh well. > >> Marc, what do you think? Could you please help to fix it, or I can >> resend it. > > I've fixed it as such (with a comment for a good measure): > > diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c > index 3c3b6a0f2dce..c012a52b19f5 100644 > --- a/virt/kvm/arm/vgic/vgic-its.c > +++ b/virt/kvm/arm/vgic/vgic-its.c > @@ -96,16 +96,19 @@ static struct vgic_irq *vgic_add_lpi(struct kvm > *kvm, u32 intid, > * We "cache" the configuration table entries in our struct > vgic_irq's. > * However we only have those structs for mapped IRQs, so we read in > * the respective config data from memory here upon mapping the LPI. > + * > + * Should any of these fail, behave as if we couldn't create the LPI > + * by dropping the refcount and returning the error. > */ > ret = update_lpi_config(kvm, irq, NULL, false); > if (ret) { > - kfree(irq); > + vgic_put_irq(kvm, irq); > return ERR_PTR(ret); > } > > ret = vgic_v3_lpi_sync_pending_status(kvm, irq); > if (ret) { > - kfree(irq); > + vgic_put_irq(kvm, irq); > return ERR_PTR(ret); > } > > > Let me know if you agree with that.
Agreed. Thanks for the fix!
Zenghui
| |