kernel-janitors.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Alex Williamson <alex.williamson@redhat.com>
To: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Colin King <colin.king@canonical.com>,
	Kirti Wankhede <kwankhede@nvidia.com>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	kvm@vger.kernel.org, kernel-janitors@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH][next] vfio/mdpy: Fix memory leak of object mdev_state->vconfig
Date: Tue, 22 Jun 2021 14:39:26 -0600	[thread overview]
Message-ID: <20210622143926.7880e698.alex.williamson@redhat.com> (raw)
In-Reply-To: <20210622185824.GU1096940@ziepe.ca>

On Tue, 22 Jun 2021 15:58:24 -0300
Jason Gunthorpe <jgg@ziepe.ca> wrote:

> On Tue, Jun 22, 2021 at 07:37:10PM +0100, Colin King wrote:
> > From: Colin Ian King <colin.king@canonical.com>
> > 
> > In the case where the call to vfio_register_group_dev fails the error
> > return path kfree's mdev_state but not mdev_state->vconfig. Fix this
> > by kfree'ing mdev_state->vconfig before returning.
> > 
> > Addresses-Coverity: ("Resource leak")
> > Fixes: 437e41368c01 ("vfio/mdpy: Convert to use vfio_register_group_dev()")
> > Signed-off-by: Colin Ian King <colin.king@canonical.com>
> >  samples/vfio-mdev/mdpy.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> > index 7e9c9df0f05b..393c9df6f6a0 100644
> > +++ b/samples/vfio-mdev/mdpy.c
> > @@ -261,6 +261,7 @@ static int mdpy_probe(struct mdev_device *mdev)
> >  
> >  	ret = vfio_register_group_dev(&mdev_state->vdev);
> >  	if (ret) {
> > +		kfree(mdev_state->vconfig);
> >  		kfree(mdev_state);
> >  		return ret;
> >  	}  
> 
> Thanks Colin, looks right
> 
> Alex, this is in your hch-mdev-direct-v4 branch can you squash or
> whatever?
> 
> Though if we are touching this I prefer the below:

Discrete fix above as a follow-up patch and later add the below as an
exit path cleanup, if you'd like to post it separately, seems like the
way to go to me.  Thanks,

Alex

> diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> index 7e9c9df0f05bac..868a0e7fa90e98 100644
> --- a/samples/vfio-mdev/mdpy.c
> +++ b/samples/vfio-mdev/mdpy.c
> @@ -235,17 +235,16 @@ static int mdpy_probe(struct mdev_device *mdev)
>  
>  	mdev_state->vconfig = kzalloc(MDPY_CONFIG_SPACE_SIZE, GFP_KERNEL);
>  	if (mdev_state->vconfig == NULL) {
> -		kfree(mdev_state);
> -		return -ENOMEM;
> +		ret = -ENOMEM;
> +		goto err_state;
>  	}
>  
>  	fbsize = roundup_pow_of_two(type->width * type->height * type->bytepp);
>  
>  	mdev_state->memblk = vmalloc_user(fbsize);
>  	if (!mdev_state->memblk) {
> -		kfree(mdev_state->vconfig);
> -		kfree(mdev_state);
> -		return -ENOMEM;
> +		ret = -ENOMEM;
> +		goto err_vconfig;
>  	}
>  	dev_info(dev, "%s: %s (%dx%d)\n", __func__, type->name, type->width,
>  		 type->height);
> @@ -260,12 +259,17 @@ static int mdpy_probe(struct mdev_device *mdev)
>  	mdpy_count++;
>  
>  	ret = vfio_register_group_dev(&mdev_state->vdev);
> -	if (ret) {
> -		kfree(mdev_state);
> -		return ret;
> -	}
> +	if (ret)
> +		goto err_vconfig;
> +
>  	dev_set_drvdata(&mdev->dev, mdev_state);
>  	return 0;
> +
> +err_vconfig:
> +	kfree(mdev_state->vconfig);
> +err_state:
> +	kfree(mdev_state);
> +	return ret;
>  }
>  
>  static void mdpy_remove(struct mdev_device *mdev)
> 


  reply	other threads:[~2021-06-22 20:39 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-22 18:37 [PATCH][next] vfio/mdpy: Fix memory leak of object mdev_state->vconfig Colin King
2021-06-22 18:58 ` Jason Gunthorpe
2021-06-22 20:39   ` Alex Williamson [this message]
2021-06-25 15:04 ` Alex Williamson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210622143926.7880e698.alex.williamson@redhat.com \
    --to=alex.williamson@redhat.com \
    --cc=colin.king@canonical.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=jgg@ziepe.ca \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=kvm@vger.kernel.org \
    --cc=kwankhede@nvidia.com \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).