* [PATCH][next] vfio/mdpy: Fix memory leak of object mdev_state->vconfig
@ 2021-06-22 18:37 Colin King
2021-06-22 18:58 ` Jason Gunthorpe
2021-06-25 15:04 ` Alex Williamson
0 siblings, 2 replies; 4+ messages in thread
From: Colin King @ 2021-06-22 18:37 UTC (permalink / raw)
To: Kirti Wankhede, Greg Kroah-Hartman, Jason Gunthorpe,
Alex Williamson, kvm
Cc: kernel-janitors, linux-kernel
From: Colin Ian King <colin.king@canonical.com>
In the case where the call to vfio_register_group_dev fails the error
return path kfree's mdev_state but not mdev_state->vconfig. Fix this
by kfree'ing mdev_state->vconfig before returning.
Addresses-Coverity: ("Resource leak")
Fixes: 437e41368c01 ("vfio/mdpy: Convert to use vfio_register_group_dev()")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
samples/vfio-mdev/mdpy.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
index 7e9c9df0f05b..393c9df6f6a0 100644
--- a/samples/vfio-mdev/mdpy.c
+++ b/samples/vfio-mdev/mdpy.c
@@ -261,6 +261,7 @@ static int mdpy_probe(struct mdev_device *mdev)
ret = vfio_register_group_dev(&mdev_state->vdev);
if (ret) {
+ kfree(mdev_state->vconfig);
kfree(mdev_state);
return ret;
}
--
2.31.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH][next] vfio/mdpy: Fix memory leak of object mdev_state->vconfig
2021-06-22 18:37 [PATCH][next] vfio/mdpy: Fix memory leak of object mdev_state->vconfig Colin King
@ 2021-06-22 18:58 ` Jason Gunthorpe
2021-06-22 20:39 ` Alex Williamson
2021-06-25 15:04 ` Alex Williamson
1 sibling, 1 reply; 4+ messages in thread
From: Jason Gunthorpe @ 2021-06-22 18:58 UTC (permalink / raw)
To: Colin King
Cc: Kirti Wankhede, Greg Kroah-Hartman, Alex Williamson, kvm,
kernel-janitors, linux-kernel
On Tue, Jun 22, 2021 at 07:37:10PM +0100, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> In the case where the call to vfio_register_group_dev fails the error
> return path kfree's mdev_state but not mdev_state->vconfig. Fix this
> by kfree'ing mdev_state->vconfig before returning.
>
> Addresses-Coverity: ("Resource leak")
> Fixes: 437e41368c01 ("vfio/mdpy: Convert to use vfio_register_group_dev()")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> samples/vfio-mdev/mdpy.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> index 7e9c9df0f05b..393c9df6f6a0 100644
> +++ b/samples/vfio-mdev/mdpy.c
> @@ -261,6 +261,7 @@ static int mdpy_probe(struct mdev_device *mdev)
>
> ret = vfio_register_group_dev(&mdev_state->vdev);
> if (ret) {
> + kfree(mdev_state->vconfig);
> kfree(mdev_state);
> return ret;
> }
Thanks Colin, looks right
Alex, this is in your hch-mdev-direct-v4 branch can you squash or
whatever?
Though if we are touching this I prefer the below:
diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
index 7e9c9df0f05bac..868a0e7fa90e98 100644
--- a/samples/vfio-mdev/mdpy.c
+++ b/samples/vfio-mdev/mdpy.c
@@ -235,17 +235,16 @@ static int mdpy_probe(struct mdev_device *mdev)
mdev_state->vconfig = kzalloc(MDPY_CONFIG_SPACE_SIZE, GFP_KERNEL);
if (mdev_state->vconfig == NULL) {
- kfree(mdev_state);
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto err_state;
}
fbsize = roundup_pow_of_two(type->width * type->height * type->bytepp);
mdev_state->memblk = vmalloc_user(fbsize);
if (!mdev_state->memblk) {
- kfree(mdev_state->vconfig);
- kfree(mdev_state);
- return -ENOMEM;
+ ret = -ENOMEM;
+ goto err_vconfig;
}
dev_info(dev, "%s: %s (%dx%d)\n", __func__, type->name, type->width,
type->height);
@@ -260,12 +259,17 @@ static int mdpy_probe(struct mdev_device *mdev)
mdpy_count++;
ret = vfio_register_group_dev(&mdev_state->vdev);
- if (ret) {
- kfree(mdev_state);
- return ret;
- }
+ if (ret)
+ goto err_vconfig;
+
dev_set_drvdata(&mdev->dev, mdev_state);
return 0;
+
+err_vconfig:
+ kfree(mdev_state->vconfig);
+err_state:
+ kfree(mdev_state);
+ return ret;
}
static void mdpy_remove(struct mdev_device *mdev)
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH][next] vfio/mdpy: Fix memory leak of object mdev_state->vconfig
2021-06-22 18:58 ` Jason Gunthorpe
@ 2021-06-22 20:39 ` Alex Williamson
0 siblings, 0 replies; 4+ messages in thread
From: Alex Williamson @ 2021-06-22 20:39 UTC (permalink / raw)
To: Jason Gunthorpe
Cc: Colin King, Kirti Wankhede, Greg Kroah-Hartman, kvm,
kernel-janitors, linux-kernel
On Tue, 22 Jun 2021 15:58:24 -0300
Jason Gunthorpe <jgg@ziepe.ca> wrote:
> On Tue, Jun 22, 2021 at 07:37:10PM +0100, Colin King wrote:
> > From: Colin Ian King <colin.king@canonical.com>
> >
> > In the case where the call to vfio_register_group_dev fails the error
> > return path kfree's mdev_state but not mdev_state->vconfig. Fix this
> > by kfree'ing mdev_state->vconfig before returning.
> >
> > Addresses-Coverity: ("Resource leak")
> > Fixes: 437e41368c01 ("vfio/mdpy: Convert to use vfio_register_group_dev()")
> > Signed-off-by: Colin Ian King <colin.king@canonical.com>
> > samples/vfio-mdev/mdpy.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> > index 7e9c9df0f05b..393c9df6f6a0 100644
> > +++ b/samples/vfio-mdev/mdpy.c
> > @@ -261,6 +261,7 @@ static int mdpy_probe(struct mdev_device *mdev)
> >
> > ret = vfio_register_group_dev(&mdev_state->vdev);
> > if (ret) {
> > + kfree(mdev_state->vconfig);
> > kfree(mdev_state);
> > return ret;
> > }
>
> Thanks Colin, looks right
>
> Alex, this is in your hch-mdev-direct-v4 branch can you squash or
> whatever?
>
> Though if we are touching this I prefer the below:
Discrete fix above as a follow-up patch and later add the below as an
exit path cleanup, if you'd like to post it separately, seems like the
way to go to me. Thanks,
Alex
> diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> index 7e9c9df0f05bac..868a0e7fa90e98 100644
> --- a/samples/vfio-mdev/mdpy.c
> +++ b/samples/vfio-mdev/mdpy.c
> @@ -235,17 +235,16 @@ static int mdpy_probe(struct mdev_device *mdev)
>
> mdev_state->vconfig = kzalloc(MDPY_CONFIG_SPACE_SIZE, GFP_KERNEL);
> if (mdev_state->vconfig == NULL) {
> - kfree(mdev_state);
> - return -ENOMEM;
> + ret = -ENOMEM;
> + goto err_state;
> }
>
> fbsize = roundup_pow_of_two(type->width * type->height * type->bytepp);
>
> mdev_state->memblk = vmalloc_user(fbsize);
> if (!mdev_state->memblk) {
> - kfree(mdev_state->vconfig);
> - kfree(mdev_state);
> - return -ENOMEM;
> + ret = -ENOMEM;
> + goto err_vconfig;
> }
> dev_info(dev, "%s: %s (%dx%d)\n", __func__, type->name, type->width,
> type->height);
> @@ -260,12 +259,17 @@ static int mdpy_probe(struct mdev_device *mdev)
> mdpy_count++;
>
> ret = vfio_register_group_dev(&mdev_state->vdev);
> - if (ret) {
> - kfree(mdev_state);
> - return ret;
> - }
> + if (ret)
> + goto err_vconfig;
> +
> dev_set_drvdata(&mdev->dev, mdev_state);
> return 0;
> +
> +err_vconfig:
> + kfree(mdev_state->vconfig);
> +err_state:
> + kfree(mdev_state);
> + return ret;
> }
>
> static void mdpy_remove(struct mdev_device *mdev)
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH][next] vfio/mdpy: Fix memory leak of object mdev_state->vconfig
2021-06-22 18:37 [PATCH][next] vfio/mdpy: Fix memory leak of object mdev_state->vconfig Colin King
2021-06-22 18:58 ` Jason Gunthorpe
@ 2021-06-25 15:04 ` Alex Williamson
1 sibling, 0 replies; 4+ messages in thread
From: Alex Williamson @ 2021-06-25 15:04 UTC (permalink / raw)
To: Colin King
Cc: Kirti Wankhede, Greg Kroah-Hartman, Jason Gunthorpe, kvm,
kernel-janitors, linux-kernel
On Tue, 22 Jun 2021 19:37:10 +0100
Colin King <colin.king@canonical.com> wrote:
> From: Colin Ian King <colin.king@canonical.com>
>
> In the case where the call to vfio_register_group_dev fails the error
> return path kfree's mdev_state but not mdev_state->vconfig. Fix this
> by kfree'ing mdev_state->vconfig before returning.
>
> Addresses-Coverity: ("Resource leak")
> Fixes: 437e41368c01 ("vfio/mdpy: Convert to use vfio_register_group_dev()")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
> samples/vfio-mdev/mdpy.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/samples/vfio-mdev/mdpy.c b/samples/vfio-mdev/mdpy.c
> index 7e9c9df0f05b..393c9df6f6a0 100644
> --- a/samples/vfio-mdev/mdpy.c
> +++ b/samples/vfio-mdev/mdpy.c
> @@ -261,6 +261,7 @@ static int mdpy_probe(struct mdev_device *mdev)
>
> ret = vfio_register_group_dev(&mdev_state->vdev);
> if (ret) {
> + kfree(mdev_state->vconfig);
> kfree(mdev_state);
> return ret;
> }
Applied to vfio next branch for v5.14, thanks!
Alex
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-06-25 15:04 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-22 18:37 [PATCH][next] vfio/mdpy: Fix memory leak of object mdev_state->vconfig Colin King
2021-06-22 18:58 ` Jason Gunthorpe
2021-06-22 20:39 ` Alex Williamson
2021-06-25 15:04 ` Alex Williamson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).