From: Rustam Kovhaev <rkovhaev@gmail.com>
To: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Cc: pbonzini@redhat.com, vkuznets@redhat.com, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org
Subject: Re: [PATCH v2] KVM: fix memory leak in kvm_io_bus_unregister_dev()
Date: Thu, 3 Sep 2020 10:22:15 -0700 [thread overview]
Message-ID: <20200903172215.GA870347@thinkpad> (raw)
In-Reply-To: <c5990c86-ab01-d748-5505-375f50a4ed7d@embeddedor.com>
On Wed, Sep 02, 2020 at 06:34:11PM -0500, Gustavo A. R. Silva wrote:
> Hi,
>
> On 9/2/20 17:57, Rustam Kovhaev wrote:
> > when kmalloc() fails in kvm_io_bus_unregister_dev(), before removing
> > the bus, we should iterate over all other devices linked to it and call
> > kvm_iodevice_destructor() for them
> >
> > Reported-and-tested-by: syzbot+f196caa45793d6374707@syzkaller.appspotmail.com
> > Link: https://syzkaller.appspot.com/bug?extid=f196caa45793d6374707
> > Signed-off-by: Rustam Kovhaev <rkovhaev@gmail.com>
> > Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
>
> I think it's worthwhile to add a Fixes tag for this, too.
>
> Please, see more comments below...
>
> > ---
> > v2:
> > - remove redundant whitespace
> > - remove goto statement and use if/else
> > ---
> > virt/kvm/kvm_main.c | 21 ++++++++++++---------
> > 1 file changed, 12 insertions(+), 9 deletions(-)
> >
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index 67cd0b88a6b6..cf88233b819a 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -4332,7 +4332,7 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
> > void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
> > struct kvm_io_device *dev)
> > {
> > - int i;
> > + int i, j;
> > struct kvm_io_bus *new_bus, *bus;
> >
> > bus = kvm_get_bus(kvm, bus_idx);
> > @@ -4349,17 +4349,20 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
> >
> > new_bus = kmalloc(struct_size(bus, range, bus->dev_count - 1),
> > GFP_KERNEL_ACCOUNT);
> > - if (!new_bus) {
> > + if (new_bus) {
> > + memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
>
> ^^^
> It seems that you can use struct_size() here (see the allocation code above)...
>
> > + new_bus->dev_count--;
> > + memcpy(new_bus->range + i, bus->range + i + 1,
> > + (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
>
> ^^^
> ...and, if possible, you can also use flex_array_size() here.
>
> Thanks
> --
> Gustavo
>
> > + } else {
> > pr_err("kvm: failed to shrink bus, removing it completely\n");
> > - goto broken;
> > + for (j = 0; j < bus->dev_count; j++) {
> > + if (j == i)
> > + continue;
> > + kvm_iodevice_destructor(bus->range[j].dev);
> > + }
> > }
> >
> > - memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
> > - new_bus->dev_count--;
> > - memcpy(new_bus->range + i, bus->range + i + 1,
> > - (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
> > -
> > -broken:
> > rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
> > synchronize_srcu_expedited(&kvm->srcu);
> > kfree(bus);
> >
hi Gustavo, thank you for the review, i'll send the new patch.
Vitaly, i think i will need to drop your "Reviewed-by", because there is
going to be a bit more changes
next prev parent reply other threads:[~2020-09-03 17:21 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-02 22:57 [PATCH v2] KVM: fix memory leak in kvm_io_bus_unregister_dev() Rustam Kovhaev
2020-09-02 23:34 ` Gustavo A. R. Silva
2020-09-03 17:22 ` Rustam Kovhaev [this message]
2020-09-04 12:04 ` Vitaly Kuznetsov
2020-09-04 14:37 ` Gustavo A. R. Silva
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200903172215.GA870347@thinkpad \
--to=rkovhaev@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=gustavo@embeddedor.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=vkuznets@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).