Re: [PATCH 2/2] KVM: arm64: vgic-its: Fix memory leak on the error path of vgic_add_lpi()

[Zenghui Yu]

On 2020/4/17 1:23, Marc Zyngier wrote:
> On 2020-04-16 02:17, Zenghui Yu wrote:
> > On 2020/4/14 11:03, Zenghui Yu wrote:
> > > If we're going to fail out the vgic_add_lpi(), let's make sure the
> > > allocated vgic_irq memory is also freed. Though it seems that both
> > > cases are unlikely to fail.
> > >
> > > Cc: Zengruan Ye <yezengruan@xxxxxxxxxx>
> > > Signed-off-by: Zenghui Yu <yuzenghui@xxxxxxxxxx>
> > > ---
> > > Â virt/kvm/arm/vgic/vgic-its.c | 8 ++++++--
> > > Â 1 file changed, 6 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
> > > index d53d34a33e35..3c3b6a0f2dce 100644
> > > --- a/virt/kvm/arm/vgic/vgic-its.c
> > > +++ b/virt/kvm/arm/vgic/vgic-its.c
> > > @@ -98,12 +98,16 @@ static struct vgic_irq *vgic_add_lpi(struct kvm 
> > > *kvm, u32 intid,
> > > ÂÂÂÂÂÂ * the respective config data from memory here upon mapping the 
> > > LPI.
> > > ÂÂÂÂÂÂ */
> > > ÂÂÂÂÂ ret = update_lpi_config(kvm, irq, NULL, false);
> > > -ÂÂÂ if (ret)
> > > +ÂÂÂ if (ret) {
> > > +ÂÂÂÂÂÂÂ kfree(irq);
> > > ÂÂÂÂÂÂÂÂÂ return ERR_PTR(ret);
> > > +ÂÂÂ }
> > > ÂÂÂÂÂÂÂ ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
> > > -ÂÂÂ if (ret)
> > > +ÂÂÂ if (ret) {
> > > +ÂÂÂÂÂÂÂ kfree(irq);
> > > ÂÂÂÂÂÂÂÂÂ return ERR_PTR(ret);
> > > +ÂÂÂ }
> >
> > Looking at it again, I realized that this error handling is still not
> > complete. Maybe we should use a vgic_put_irq() instead so that we can
> > also properly delete the vgic_irq from lpi_list.
>
> Yes, this is a more correct fix indeed. There is still a bit of a bizarre
> behaviour if you have two vgic_add_lpi() racing to create the same 
> interrupt,
> which is pretty dodgy anyway (it means we have two MAPI at the same 
> time...).
> You end-up with re-reading the state from memory... Oh well.
>
> > Marc, what do you think? Could you please help to fix it, or I can
> > resend it.
>
> I've fixed it as such (with a comment for a good measure):
>
> diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
> index 3c3b6a0f2dce..c012a52b19f5 100644
> --- a/virt/kvm/arm/vgic/vgic-its.c
> +++ b/virt/kvm/arm/vgic/vgic-its.c
> @@ -96,16 +96,19 @@ static struct vgic_irq *vgic_add_lpi(struct kvm 
> *kvm, u32 intid,
>  ÂÂÂÂÂ * We "cache" the configuration table entries in our struct 
> vgic_irq's.
>  ÂÂÂÂÂ * However we only have those structs for mapped IRQs, so we read in
>  ÂÂÂÂÂ * the respective config data from memory here upon mapping the LPI.
> +ÂÂÂÂ *
> +ÂÂÂÂ * Should any of these fail, behave as if we couldn't create the LPI
> +ÂÂÂÂ * by dropping the refcount and returning the error.
>  ÂÂÂÂÂ */
>  ÂÂÂÂ ret = update_lpi_config(kvm, irq, NULL, false);
>  ÂÂÂÂ if (ret) {
> -ÂÂÂÂÂÂÂ kfree(irq);
> +ÂÂÂÂÂÂÂ vgic_put_irq(kvm, irq);
>  ÂÂÂÂÂÂÂÂ return ERR_PTR(ret);
>  ÂÂÂÂ }
>
>  ÂÂÂÂ ret = vgic_v3_lpi_sync_pending_status(kvm, irq);
>  ÂÂÂÂ if (ret) {
> -ÂÂÂÂÂÂÂ kfree(irq);
> +ÂÂÂÂÂÂÂ vgic_put_irq(kvm, irq);
>  ÂÂÂÂÂÂÂÂ return ERR_PTR(ret);
>  ÂÂÂÂ }
>
>
> Let me know if you agree with that.

Agreed. Thanks for the fix!


Zenghui