* [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure
@ 2017-06-27 11:57 Claudio Imbrenda
2017-06-27 13:08 ` Paolo Bonzini
2017-06-27 13:34 ` Al Viro
0 siblings, 2 replies; 6+ messages in thread
From: Claudio Imbrenda @ 2017-06-27 11:57 UTC (permalink / raw)
To: kvm; +Cc: linux-kernel, borntraeger, frankja, viro, pbonzini
If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
will have a memory leak due to not freeing the kvm object.
A call to kvm_put_kvm was accidentally removed from an error handling in
commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
This patch simply restores the call to kvm_put_kvm, so that the kvm
object is destroyed before returning an error.
Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
---
virt/kvm/kvm_main.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index f0fe9d0..257d2a8 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3194,6 +3194,7 @@ static int kvm_dev_ioctl_create_vm(unsigned long type)
if (kvm_create_vm_debugfs(kvm, r) < 0) {
put_unused_fd(r);
fput(file);
+ kvm_put_kvm(kvm);
return -ENOMEM;
}
--
2.7.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure
2017-06-27 11:57 [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure Claudio Imbrenda
@ 2017-06-27 13:08 ` Paolo Bonzini
2017-06-27 13:50 ` Al Viro
2017-06-27 13:34 ` Al Viro
1 sibling, 1 reply; 6+ messages in thread
From: Paolo Bonzini @ 2017-06-27 13:08 UTC (permalink / raw)
To: Claudio Imbrenda, kvm; +Cc: linux-kernel, borntraeger, frankja, viro
On 27/06/2017 13:57, Claudio Imbrenda wrote:
> If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
> will have a memory leak due to not freeing the kvm object.
>
> A call to kvm_put_kvm was accidentally removed from an error handling in
> commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
>
> This patch simply restores the call to kvm_put_kvm, so that the kvm
> object is destroyed before returning an error.
>
> Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
> Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> ---
> virt/kvm/kvm_main.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index f0fe9d0..257d2a8 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -3194,6 +3194,7 @@ static int kvm_dev_ioctl_create_vm(unsigned long type)
> if (kvm_create_vm_debugfs(kvm, r) < 0) {
> put_unused_fd(r);
> fput(file);
> + kvm_put_kvm(kvm);
> return -ENOMEM;
> }
>
>
Queued, thanks.
Paolo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure
2017-06-27 11:57 [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure Claudio Imbrenda
2017-06-27 13:08 ` Paolo Bonzini
@ 2017-06-27 13:34 ` Al Viro
2017-06-27 13:40 ` Paolo Bonzini
1 sibling, 1 reply; 6+ messages in thread
From: Al Viro @ 2017-06-27 13:34 UTC (permalink / raw)
To: Claudio Imbrenda; +Cc: kvm, linux-kernel, borntraeger, frankja, pbonzini
On Tue, Jun 27, 2017 at 01:57:16PM +0200, Claudio Imbrenda wrote:
> If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
> will have a memory leak due to not freeing the kvm object.
>
> A call to kvm_put_kvm was accidentally removed from an error handling in
> commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
>
> This patch simply restores the call to kvm_put_kvm, so that the kvm
> object is destroyed before returning an error.
>
> Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
> Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
What you are missing is that by that point we have file->f_op already
set, with ->release() being kvm_vm_release(). It will be called by
final fput(), and that's what will do your "missing" kvm_put_kvm().
IOW, NAK - removal was not accidental and you've just introduced
double-put there.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure
2017-06-27 13:34 ` Al Viro
@ 2017-06-27 13:40 ` Paolo Bonzini
0 siblings, 0 replies; 6+ messages in thread
From: Paolo Bonzini @ 2017-06-27 13:40 UTC (permalink / raw)
To: Al Viro, Claudio Imbrenda; +Cc: kvm, linux-kernel, borntraeger, frankja
On 27/06/2017 15:34, Al Viro wrote:
> On Tue, Jun 27, 2017 at 01:57:16PM +0200, Claudio Imbrenda wrote:
>> If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
>> will have a memory leak due to not freeing the kvm object.
>>
>> A call to kvm_put_kvm was accidentally removed from an error handling in
>> commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
>>
>> This patch simply restores the call to kvm_put_kvm, so that the kvm
>> object is destroyed before returning an error.
>>
>> Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
>> Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
>
> What you are missing is that by that point we have file->f_op already
> set, with ->release() being kvm_vm_release(). It will be called by
> final fput(), and that's what will do your "missing" kvm_put_kvm().
>
> IOW, NAK - removal was not accidental and you've just introduced
> double-put there.
Better add a comment, I'll reuse your wording. Thanks.
Paolo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure
2017-06-27 13:08 ` Paolo Bonzini
@ 2017-06-27 13:50 ` Al Viro
2017-06-27 13:57 ` Paolo Bonzini
0 siblings, 1 reply; 6+ messages in thread
From: Al Viro @ 2017-06-27 13:50 UTC (permalink / raw)
To: Paolo Bonzini; +Cc: Claudio Imbrenda, kvm, linux-kernel, borntraeger, frankja
On Tue, Jun 27, 2017 at 03:08:32PM +0200, Paolo Bonzini wrote:
> On 27/06/2017 13:57, Claudio Imbrenda wrote:
> > If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
> > will have a memory leak due to not freeing the kvm object.
> >
> > A call to kvm_put_kvm was accidentally removed from an error handling in
> > commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> >
> > This patch simply restores the call to kvm_put_kvm, so that the kvm
> > object is destroyed before returning an error.
> >
> > Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
> > Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> > ---
> > virt/kvm/kvm_main.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index f0fe9d0..257d2a8 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -3194,6 +3194,7 @@ static int kvm_dev_ioctl_create_vm(unsigned long type)
> > if (kvm_create_vm_debugfs(kvm, r) < 0) {
> > put_unused_fd(r);
> > fput(file);
> > + kvm_put_kvm(kvm);
> > return -ENOMEM;
> > }
> >
> >
>
> Queued, thanks.
It's broken. Look: once we are past the anon_inode_getfile(), the
reference we held on kvm is transferred into new struct file. After
that point we don't drop kvm - we drop file. And as long as that
file is held, it will keep holding what used to be our reference to
kvm. Once all references to file are gone, its ->release() will be
called and that's where kvm reference in it will be dropped.
IOW, this patch introduces a double-put.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure
2017-06-27 13:50 ` Al Viro
@ 2017-06-27 13:57 ` Paolo Bonzini
0 siblings, 0 replies; 6+ messages in thread
From: Paolo Bonzini @ 2017-06-27 13:57 UTC (permalink / raw)
To: Al Viro; +Cc: Claudio Imbrenda, kvm, linux-kernel, borntraeger, frankja
On 27/06/2017 15:50, Al Viro wrote:
>> Queued, thanks.
> It's broken. Look: once we are past the anon_inode_getfile(), the
> reference we held on kvm is transferred into new struct file. After
> that point we don't drop kvm - we drop file. And as long as that
> file is held, it will keep holding what used to be our reference to
> kvm. Once all references to file are gone, its ->release() will be
> called and that's where kvm reference in it will be dropped.
>
> IOW, this patch introduces a double-put.
Yup, I've noticed your other reply (hopefully would have noticed during
regression testing). Thanks Al.
Paolo
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-06-27 13:57 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-27 11:57 [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure Claudio Imbrenda
2017-06-27 13:08 ` Paolo Bonzini
2017-06-27 13:50 ` Al Viro
2017-06-27 13:57 ` Paolo Bonzini
2017-06-27 13:34 ` Al Viro
2017-06-27 13:40 ` Paolo Bonzini
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.