KVM Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages
@ 2020-10-16  9:35 xuxiaoyang (C)
  2020-10-20 16:34 ` Alex Williamson
  0 siblings, 1 reply; 2+ messages in thread
From: xuxiaoyang (C) @ 2020-10-16  9:35 UTC (permalink / raw)
  To: linux-kernel, kvm, alex.williamson
  Cc: kwankhede, xieyingtai, lizhengui, xuxiaoyang2

From 099744c26513e386e707faecb3f17726e236d9bc Mon Sep 17 00:00:00 2001
From: Xiaoyang Xu <xuxiaoyang2@huawei.com>
Date: Fri, 16 Oct 2020 15:32:02 +0800
Subject: [PATCH] vfio iommu type1: Fix memory leak in
 vfio_iommu_type1_pin_pages

pfn is not added to pfn_list when vfio_add_to_pfn_list fails.
vfio_unpin_page_external will exit directly without calling
vfio_iova_put_vfio_pfn.This will lead to a memory leak.

Signed-off-by: Xiaoyang Xu <xuxiaoyang2@huawei.com>
---
 drivers/vfio/vfio_iommu_type1.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index c255a6683f31..26f518b02c81 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -640,6 +640,7 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
 	unsigned long remote_vaddr;
 	struct vfio_dma *dma;
 	bool do_accounting;
+	int unlocked;

 	if (!iommu || !user_pfn || !phys_pfn)
 		return -EINVAL;
@@ -693,7 +694,9 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,

 		ret = vfio_add_to_pfn_list(dma, iova, phys_pfn[i]);
 		if (ret) {
-			vfio_unpin_page_external(dma, iova, do_accounting);
+			unlocked = put_pfn(phys_pfn[i], dma->prot);
+			if (do_accounting)
+				vfio_lock_acct(dma, -unlocked, true);
 			goto pin_unwind;
 		}

--
2.19.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages
  2020-10-16  9:35 [PATCH] vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages xuxiaoyang (C)
@ 2020-10-20 16:34 ` Alex Williamson
  0 siblings, 0 replies; 2+ messages in thread
From: Alex Williamson @ 2020-10-20 16:34 UTC (permalink / raw)
  To: xuxiaoyang (C); +Cc: linux-kernel, kvm, kwankhede, xieyingtai, lizhengui

On Fri, 16 Oct 2020 17:35:58 +0800
"xuxiaoyang (C)" <xuxiaoyang2@huawei.com> wrote:

> From 099744c26513e386e707faecb3f17726e236d9bc Mon Sep 17 00:00:00 2001
> From: Xiaoyang Xu <xuxiaoyang2@huawei.com>
> Date: Fri, 16 Oct 2020 15:32:02 +0800
> Subject: [PATCH] vfio iommu type1: Fix memory leak in
>  vfio_iommu_type1_pin_pages
> 
> pfn is not added to pfn_list when vfio_add_to_pfn_list fails.
> vfio_unpin_page_external will exit directly without calling
> vfio_iova_put_vfio_pfn.This will lead to a memory leak.
> 
> Signed-off-by: Xiaoyang Xu <xuxiaoyang2@huawei.com>
> ---
>  drivers/vfio/vfio_iommu_type1.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
> index c255a6683f31..26f518b02c81 100644
> --- a/drivers/vfio/vfio_iommu_type1.c
> +++ b/drivers/vfio/vfio_iommu_type1.c
> @@ -640,6 +640,7 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
>  	unsigned long remote_vaddr;
>  	struct vfio_dma *dma;
>  	bool do_accounting;
> +	int unlocked;
> 
>  	if (!iommu || !user_pfn || !phys_pfn)
>  		return -EINVAL;
> @@ -693,7 +694,9 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
> 
>  		ret = vfio_add_to_pfn_list(dma, iova, phys_pfn[i]);
>  		if (ret) {
> -			vfio_unpin_page_external(dma, iova, do_accounting);
> +			unlocked = put_pfn(phys_pfn[i], dma->prot);
> +			if (do_accounting)
> +				vfio_lock_acct(dma, -unlocked, true);
>  			goto pin_unwind;
>  		}
> 

Thanks, this looks correct to me, but can also be simplified to:

diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index defd44522319..57b068abceb9 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -693,7 +693,8 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
 
 		ret = vfio_add_to_pfn_list(dma, iova, phys_pfn[i]);
 		if (ret) {
-			vfio_unpin_page_external(dma, iova, do_accounting);
+			if (put_pfn(phys_pfn[i], dma->prot) && do_accounting)
+				vfio_lock_acct(dma, -1, true);
 			goto pin_unwind;
 		}
 
ie. we don't need a variable to track the one page we unpin that might
be accounted and we can avoid branching to vfio_lock_acct() for -0 unlocked.

We should also add a Fixes tag so this propagates back to the relevant
stable releases:

    Fixes: a54eb55045ae ("vfio iommu type1: Add support for mediated devices")

I've made both of these changes in my next queue, please let me know if
I've overlooked something or there's an objection.  Thanks,

Alex


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-16  9:35 [PATCH] vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages xuxiaoyang (C)
2020-10-20 16:34 ` Alex Williamson

KVM Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/kvm/0 kvm/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 kvm kvm/ https://lore.kernel.org/kvm \
		kvm@vger.kernel.org
	public-inbox-index kvm

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.kvm


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git