linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
@ 2022-03-08  9:20 Xiaolong Huang
  2022-03-08  9:56 ` Greg KH
  0 siblings, 1 reply; 11+ messages in thread
From: Xiaolong Huang @ 2022-03-08  9:20 UTC (permalink / raw)
  To: gregkh, fei1.li; +Cc: linux-kernel, Xiaolong Huang

The vm_param and cpu_regs need to be freed via kfree()
before return -EINVAL error.

Fixes: 9c5137aedd11 ("virt: acrn: Introduce VM management interfaces")
Fixes: 2ad2aaee1bc9 ("virt: acrn: Introduce an ioctl to set vCPU registers state")
Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
Signed-off-by: Fei Li <fei1.li@intel.com>
---
 drivers/virt/acrn/hsm.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/virt/acrn/hsm.c b/drivers/virt/acrn/hsm.c
index 5419794fccf1..423ea888d79a 100644
--- a/drivers/virt/acrn/hsm.c
+++ b/drivers/virt/acrn/hsm.c
@@ -136,8 +136,10 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
 		if (IS_ERR(vm_param))
 			return PTR_ERR(vm_param);
 
-		if ((vm_param->reserved0 | vm_param->reserved1) != 0)
+		if ((vm_param->reserved0 | vm_param->reserved1) != 0) {
+			kfree(vm_param);
 			return -EINVAL;
+		}
 
 		vm = acrn_vm_create(vm, vm_param);
 		if (!vm) {
@@ -182,21 +184,29 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
 			return PTR_ERR(cpu_regs);
 
 		for (i = 0; i < ARRAY_SIZE(cpu_regs->reserved); i++)
-			if (cpu_regs->reserved[i])
+			if (cpu_regs->reserved[i]) {
+				kfree(cpu_regs);
 				return -EINVAL;
+			}
 
 		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_32); i++)
-			if (cpu_regs->vcpu_regs.reserved_32[i])
+			if (cpu_regs->vcpu_regs.reserved_32[i]) {
+				kfree(cpu_regs);
 				return -EINVAL;
+			}
 
 		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_64); i++)
-			if (cpu_regs->vcpu_regs.reserved_64[i])
+			if (cpu_regs->vcpu_regs.reserved_64[i]) {
+				kfree(cpu_regs);
 				return -EINVAL;
+			}
 
 		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.gdt.reserved); i++)
 			if (cpu_regs->vcpu_regs.gdt.reserved[i] |
-			    cpu_regs->vcpu_regs.idt.reserved[i])
+			    cpu_regs->vcpu_regs.idt.reserved[i]) {
+				kfree(cpu_regs);
 				return -EINVAL;
+			}
 
 		ret = hcall_set_vcpu_regs(vm->vmid, virt_to_phys(cpu_regs));
 		if (ret < 0)

base-commit: 5859a2b1991101d6b978f3feb5325dad39421f29
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re: [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
  2022-03-08  9:20 [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl() Xiaolong Huang
@ 2022-03-08  9:56 ` Greg KH
  2022-03-08 10:14   ` butt3rflyh4ck
  2022-03-15  8:04   ` butt3rflyh4ck
  0 siblings, 2 replies; 11+ messages in thread
From: Greg KH @ 2022-03-08  9:56 UTC (permalink / raw)
  To: Xiaolong Huang; +Cc: fei1.li, linux-kernel

On Tue, Mar 08, 2022 at 05:20:47PM +0800, Xiaolong Huang wrote:
> The vm_param and cpu_regs need to be freed via kfree()
> before return -EINVAL error.
> 
> Fixes: 9c5137aedd11 ("virt: acrn: Introduce VM management interfaces")
> Fixes: 2ad2aaee1bc9 ("virt: acrn: Introduce an ioctl to set vCPU registers state")
> Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
> Signed-off-by: Fei Li <fei1.li@intel.com>
> ---
>  drivers/virt/acrn/hsm.c | 20 +++++++++++++++-----
>  1 file changed, 15 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/virt/acrn/hsm.c b/drivers/virt/acrn/hsm.c
> index 5419794fccf1..423ea888d79a 100644
> --- a/drivers/virt/acrn/hsm.c
> +++ b/drivers/virt/acrn/hsm.c
> @@ -136,8 +136,10 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
>  		if (IS_ERR(vm_param))
>  			return PTR_ERR(vm_param);
>  
> -		if ((vm_param->reserved0 | vm_param->reserved1) != 0)
> +		if ((vm_param->reserved0 | vm_param->reserved1) != 0) {
> +			kfree(vm_param);
>  			return -EINVAL;
> +		}
>  
>  		vm = acrn_vm_create(vm, vm_param);
>  		if (!vm) {
> @@ -182,21 +184,29 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
>  			return PTR_ERR(cpu_regs);
>  
>  		for (i = 0; i < ARRAY_SIZE(cpu_regs->reserved); i++)
> -			if (cpu_regs->reserved[i])
> +			if (cpu_regs->reserved[i]) {
> +				kfree(cpu_regs);
>  				return -EINVAL;
> +			}
>  
>  		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_32); i++)
> -			if (cpu_regs->vcpu_regs.reserved_32[i])
> +			if (cpu_regs->vcpu_regs.reserved_32[i]) {
> +				kfree(cpu_regs);
>  				return -EINVAL;
> +			}
>  
>  		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_64); i++)
> -			if (cpu_regs->vcpu_regs.reserved_64[i])
> +			if (cpu_regs->vcpu_regs.reserved_64[i]) {
> +				kfree(cpu_regs);
>  				return -EINVAL;
> +			}
>  
>  		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.gdt.reserved); i++)
>  			if (cpu_regs->vcpu_regs.gdt.reserved[i] |
> -			    cpu_regs->vcpu_regs.idt.reserved[i])
> +			    cpu_regs->vcpu_regs.idt.reserved[i]) {
> +				kfree(cpu_regs);
>  				return -EINVAL;
> +			}
>  
>  		ret = hcall_set_vcpu_regs(vm->vmid, virt_to_phys(cpu_regs));
>  		if (ret < 0)
> 
> base-commit: 5859a2b1991101d6b978f3feb5325dad39421f29
> -- 
> 2.25.1
> 

How did you test this?

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
  2022-03-08  9:56 ` Greg KH
@ 2022-03-08 10:14   ` butt3rflyh4ck
  2022-03-08 10:16     ` Greg KH
  2022-03-15  8:04   ` butt3rflyh4ck
  1 sibling, 1 reply; 11+ messages in thread
From: butt3rflyh4ck @ 2022-03-08 10:14 UTC (permalink / raw)
  To: Greg KH; +Cc: fei1.li, LKML

No, not yet. I just code audit.

Regards,
 butt3rflyh4ck.

On Tue, Mar 8, 2022 at 5:56 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Tue, Mar 08, 2022 at 05:20:47PM +0800, Xiaolong Huang wrote:
> > The vm_param and cpu_regs need to be freed via kfree()
> > before return -EINVAL error.
> >
> > Fixes: 9c5137aedd11 ("virt: acrn: Introduce VM management interfaces")
> > Fixes: 2ad2aaee1bc9 ("virt: acrn: Introduce an ioctl to set vCPU registers state")
> > Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
> > Signed-off-by: Fei Li <fei1.li@intel.com>
> > ---
> >  drivers/virt/acrn/hsm.c | 20 +++++++++++++++-----
> >  1 file changed, 15 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/virt/acrn/hsm.c b/drivers/virt/acrn/hsm.c
> > index 5419794fccf1..423ea888d79a 100644
> > --- a/drivers/virt/acrn/hsm.c
> > +++ b/drivers/virt/acrn/hsm.c
> > @@ -136,8 +136,10 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
> >               if (IS_ERR(vm_param))
> >                       return PTR_ERR(vm_param);
> >
> > -             if ((vm_param->reserved0 | vm_param->reserved1) != 0)
> > +             if ((vm_param->reserved0 | vm_param->reserved1) != 0) {
> > +                     kfree(vm_param);
> >                       return -EINVAL;
> > +             }
> >
> >               vm = acrn_vm_create(vm, vm_param);
> >               if (!vm) {
> > @@ -182,21 +184,29 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
> >                       return PTR_ERR(cpu_regs);
> >
> >               for (i = 0; i < ARRAY_SIZE(cpu_regs->reserved); i++)
> > -                     if (cpu_regs->reserved[i])
> > +                     if (cpu_regs->reserved[i]) {
> > +                             kfree(cpu_regs);
> >                               return -EINVAL;
> > +                     }
> >
> >               for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_32); i++)
> > -                     if (cpu_regs->vcpu_regs.reserved_32[i])
> > +                     if (cpu_regs->vcpu_regs.reserved_32[i]) {
> > +                             kfree(cpu_regs);
> >                               return -EINVAL;
> > +                     }
> >
> >               for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_64); i++)
> > -                     if (cpu_regs->vcpu_regs.reserved_64[i])
> > +                     if (cpu_regs->vcpu_regs.reserved_64[i]) {
> > +                             kfree(cpu_regs);
> >                               return -EINVAL;
> > +                     }
> >
> >               for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.gdt.reserved); i++)
> >                       if (cpu_regs->vcpu_regs.gdt.reserved[i] |
> > -                         cpu_regs->vcpu_regs.idt.reserved[i])
> > +                         cpu_regs->vcpu_regs.idt.reserved[i]) {
> > +                             kfree(cpu_regs);
> >                               return -EINVAL;
> > +                     }
> >
> >               ret = hcall_set_vcpu_regs(vm->vmid, virt_to_phys(cpu_regs));
> >               if (ret < 0)
> >
> > base-commit: 5859a2b1991101d6b978f3feb5325dad39421f29
> > --
> > 2.25.1
> >
>
> How did you test this?



-- 
Active Defense Lab of Venustech

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
  2022-03-08 10:14   ` butt3rflyh4ck
@ 2022-03-08 10:16     ` Greg KH
  2022-03-15  2:44       ` butt3rflyh4ck
  0 siblings, 1 reply; 11+ messages in thread
From: Greg KH @ 2022-03-08 10:16 UTC (permalink / raw)
  To: butt3rflyh4ck; +Cc: fei1.li, LKML

On Tue, Mar 08, 2022 at 06:14:31PM +0800, butt3rflyh4ck wrote:
> No, not yet. I just code audit.

Please test things like this so that we know it actually is correct.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
  2022-03-08 10:16     ` Greg KH
@ 2022-03-15  2:44       ` butt3rflyh4ck
  2022-03-15  6:49         ` Greg KH
  0 siblings, 1 reply; 11+ messages in thread
From: butt3rflyh4ck @ 2022-03-15  2:44 UTC (permalink / raw)
  To: Greg KH; +Cc: Li Fei1, LKML

Hi, Greg, could you tell me how to test (like this)?

Thank you,

 butt3rflyh4ck.

On Tue, Mar 8, 2022 at 6:16 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Tue, Mar 08, 2022 at 06:14:31PM +0800, butt3rflyh4ck wrote:
> > No, not yet. I just code audit.
>
> Please test things like this so that we know it actually is correct.
>
> thanks,
>
> greg k-h



-- 
Active Defense Lab of Venustech

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
  2022-03-15  2:44       ` butt3rflyh4ck
@ 2022-03-15  6:49         ` Greg KH
  2022-03-15  7:36           ` butt3rflyh4ck
  0 siblings, 1 reply; 11+ messages in thread
From: Greg KH @ 2022-03-15  6:49 UTC (permalink / raw)
  To: butt3rflyh4ck; +Cc: Li Fei1, LKML

On Tue, Mar 15, 2022 at 10:44:09AM +0800, butt3rflyh4ck wrote:
> Hi, Greg, could you tell me how to test (like this)?

I have no context at all what "like this" is sorry.

greg k-h

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
  2022-03-15  6:49         ` Greg KH
@ 2022-03-15  7:36           ` butt3rflyh4ck
  2022-03-15  7:50             ` Greg KH
  0 siblings, 1 reply; 11+ messages in thread
From: butt3rflyh4ck @ 2022-03-15  7:36 UTC (permalink / raw)
  To: Greg KH; +Cc: Li Fei1, LKML

Ok, thanks.  By the way, I want to explain, Firstly there is just some
parameter that should be freed before func returns the -EINVAL error
in the patch.
I think it was correct, no need to test it. And  secondly the commitor
Li Fei1 also reviewed the patch code. finally I am sorry that  no arcn
hso hardware to test it.

Regards,
  butt3rflyh4ck.

On Tue, Mar 15, 2022 at 2:49 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Tue, Mar 15, 2022 at 10:44:09AM +0800, butt3rflyh4ck wrote:
> > Hi, Greg, could you tell me how to test (like this)?
>
> I have no context at all what "like this" is sorry.
>
> greg k-h



-- 
Active Defense Lab of Venustech

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
  2022-03-15  7:36           ` butt3rflyh4ck
@ 2022-03-15  7:50             ` Greg KH
  0 siblings, 0 replies; 11+ messages in thread
From: Greg KH @ 2022-03-15  7:50 UTC (permalink / raw)
  To: butt3rflyh4ck; +Cc: Li Fei1, LKML

On Tue, Mar 15, 2022 at 03:36:11PM +0800, butt3rflyh4ck wrote:
> Ok, thanks.  By the way, I want to explain, Firstly there is just some
> parameter that should be freed before func returns the -EINVAL error
> in the patch.

What patch?  I see nothing here :(

> I think it was correct, no need to test it. And  secondly the commitor
> Li Fei1 also reviewed the patch code. finally I am sorry that  no arcn
> hso hardware to test it.

I still have no context at all.  Please properly quote your email
threads so that we can all understand and respond properly.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
  2022-03-08  9:56 ` Greg KH
  2022-03-08 10:14   ` butt3rflyh4ck
@ 2022-03-15  8:04   ` butt3rflyh4ck
  1 sibling, 0 replies; 11+ messages in thread
From: butt3rflyh4ck @ 2022-03-15  8:04 UTC (permalink / raw)
  To: Greg KH; +Cc: Li Fei1, LKML

On Tue, Mar 8, 2022 at 5:56 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Tue, Mar 08, 2022 at 05:20:47PM +0800, Xiaolong Huang wrote:
> > The vm_param and cpu_regs need to be freed via kfree()
> > before return -EINVAL error.
> >
> > Fixes: 9c5137aedd11 ("virt: acrn: Introduce VM management interfaces")
> > Fixes: 2ad2aaee1bc9 ("virt: acrn: Introduce an ioctl to set vCPU registers state")
> > Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
> > Signed-off-by: Fei Li <fei1.li@intel.com>
> > ---
> >  drivers/virt/acrn/hsm.c | 20 +++++++++++++++-----
> >  1 file changed, 15 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/virt/acrn/hsm.c b/drivers/virt/acrn/hsm.c
> > index 5419794fccf1..423ea888d79a 100644
> > --- a/drivers/virt/acrn/hsm.c
> > +++ b/drivers/virt/acrn/hsm.c
> > @@ -136,8 +136,10 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
> >               if (IS_ERR(vm_param))
> >                       return PTR_ERR(vm_param);
> >
> > -             if ((vm_param->reserved0 | vm_param->reserved1) != 0)
> > +             if ((vm_param->reserved0 | vm_param->reserved1) != 0) {
> > +                     kfree(vm_param);
> >                       return -EINVAL;
> > +             }
> >
> >               vm = acrn_vm_create(vm, vm_param);
> >               if (!vm) {
> > @@ -182,21 +184,29 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
> >                       return PTR_ERR(cpu_regs);
> >
> >               for (i = 0; i < ARRAY_SIZE(cpu_regs->reserved); i++)
> > -                     if (cpu_regs->reserved[i])
> > +                     if (cpu_regs->reserved[i]) {
> > +                             kfree(cpu_regs);
> >                               return -EINVAL;
> > +                     }
> >
> >               for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_32); i++)
> > -                     if (cpu_regs->vcpu_regs.reserved_32[i])
> > +                     if (cpu_regs->vcpu_regs.reserved_32[i]) {
> > +                             kfree(cpu_regs);
> >                               return -EINVAL;
> > +                     }
> >
> >               for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_64); i++)
> > -                     if (cpu_regs->vcpu_regs.reserved_64[i])
> > +                     if (cpu_regs->vcpu_regs.reserved_64[i]) {
> > +                             kfree(cpu_regs);
> >                               return -EINVAL;
> > +                     }
> >
> >               for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.gdt.reserved); i++)
> >                       if (cpu_regs->vcpu_regs.gdt.reserved[i] |
> > -                         cpu_regs->vcpu_regs.idt.reserved[i])
> > +                         cpu_regs->vcpu_regs.idt.reserved[i]) {
> > +                             kfree(cpu_regs);
> >                               return -EINVAL;
> > +                     }
> >
> >               ret = hcall_set_vcpu_regs(vm->vmid, virt_to_phys(cpu_regs));
> >               if (ret < 0)
> >
> > base-commit: 5859a2b1991101d6b978f3feb5325dad39421f29
> > --
> > 2.25.1
> >
>
> How did you test this?

Ok, thanks.  Firstly there is just some
parameter that should be freed before func returns the -EINVAL error
in the patch. I think it was correct, no need to test it. And
secondly the commitor
Li Fei1 also reviewed the patch code. finally I am sorry that  no arcn
hso hardware to test it.

Regards,
  butt3rflyh4ck.

-- 
Active Defense Lab of Venustech

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
  2022-03-01 10:00 Xiaolong Huang
@ 2022-03-03  6:01 ` Li Fei1
  0 siblings, 0 replies; 11+ messages in thread
From: Li Fei1 @ 2022-03-03  6:01 UTC (permalink / raw)
  To: Xiaolong Huang; +Cc: linux-kernel, fei1.li

On Tue, Mar 01, 2022 at 06:00:59PM +0800, Xiaolong Huang wrote:
> The vm_param and cpu_regs need to be freed via kfree() before return -EINVAL error.
> 
> Fixes: 9c5137aedd11 ("virt: acrn: Introduce VM management interfaces")
> Fixes: 2ad2aaee1bc9 ("virt: acrn: Introduce an ioctl to set vCPU registers state")
> Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
> ---
>  drivers/virt/acrn/hsm.c | 20 +++++++++++++++-----
>  1 file changed, 15 insertions(+), 5 deletions(-)
> 
Hi Xiaolong

Thanks for helping to fix this issue.

This patch looks good. But I didn't see the base tree information of your patch applies to.
Would you please help to record it.

Thanks.

> diff --git a/drivers/virt/acrn/hsm.c b/drivers/virt/acrn/hsm.c
> index 5419794fccf1..423ea888d79a 100644
> --- a/drivers/virt/acrn/hsm.c
> +++ b/drivers/virt/acrn/hsm.c
> @@ -136,8 +136,10 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
>  		if (IS_ERR(vm_param))
>  			return PTR_ERR(vm_param);
>  
> -		if ((vm_param->reserved0 | vm_param->reserved1) != 0)
> +		if ((vm_param->reserved0 | vm_param->reserved1) != 0) {
> +			kfree(vm_param);
>  			return -EINVAL;
> +		}
>  
>  		vm = acrn_vm_create(vm, vm_param);
>  		if (!vm) {
> @@ -182,21 +184,29 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
>  			return PTR_ERR(cpu_regs);
>  
>  		for (i = 0; i < ARRAY_SIZE(cpu_regs->reserved); i++)
> -			if (cpu_regs->reserved[i])
> +			if (cpu_regs->reserved[i]) {
> +				kfree(cpu_regs);
>  				return -EINVAL;
> +			}
>  
>  		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_32); i++)
> -			if (cpu_regs->vcpu_regs.reserved_32[i])
> +			if (cpu_regs->vcpu_regs.reserved_32[i]) {
> +				kfree(cpu_regs);
>  				return -EINVAL;
> +			}
>  
>  		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_64); i++)
> -			if (cpu_regs->vcpu_regs.reserved_64[i])
> +			if (cpu_regs->vcpu_regs.reserved_64[i]) {
> +				kfree(cpu_regs);
>  				return -EINVAL;
> +			}
>  
>  		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.gdt.reserved); i++)
>  			if (cpu_regs->vcpu_regs.gdt.reserved[i] |
> -			    cpu_regs->vcpu_regs.idt.reserved[i])
> +			    cpu_regs->vcpu_regs.idt.reserved[i]) {
> +				kfree(cpu_regs);
>  				return -EINVAL;
> +			}
>  
>  		ret = hcall_set_vcpu_regs(vm->vmid, virt_to_phys(cpu_regs));
>  		if (ret < 0)
> -- 
> 2.25.1
> 

^ permalink raw reply	[flat|nested] 11+ messages in thread

* [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl()
@ 2022-03-01 10:00 Xiaolong Huang
  2022-03-03  6:01 ` Li Fei1
  0 siblings, 1 reply; 11+ messages in thread
From: Xiaolong Huang @ 2022-03-01 10:00 UTC (permalink / raw)
  To: fei1.li, shuo.a.liu; +Cc: linux-kernel, Xiaolong Huang

The vm_param and cpu_regs need to be freed via kfree() before return -EINVAL error.

Fixes: 9c5137aedd11 ("virt: acrn: Introduce VM management interfaces")
Fixes: 2ad2aaee1bc9 ("virt: acrn: Introduce an ioctl to set vCPU registers state")
Signed-off-by: Xiaolong Huang <butterflyhuangxx@gmail.com>
---
 drivers/virt/acrn/hsm.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/virt/acrn/hsm.c b/drivers/virt/acrn/hsm.c
index 5419794fccf1..423ea888d79a 100644
--- a/drivers/virt/acrn/hsm.c
+++ b/drivers/virt/acrn/hsm.c
@@ -136,8 +136,10 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
 		if (IS_ERR(vm_param))
 			return PTR_ERR(vm_param);
 
-		if ((vm_param->reserved0 | vm_param->reserved1) != 0)
+		if ((vm_param->reserved0 | vm_param->reserved1) != 0) {
+			kfree(vm_param);
 			return -EINVAL;
+		}
 
 		vm = acrn_vm_create(vm, vm_param);
 		if (!vm) {
@@ -182,21 +184,29 @@ static long acrn_dev_ioctl(struct file *filp, unsigned int cmd,
 			return PTR_ERR(cpu_regs);
 
 		for (i = 0; i < ARRAY_SIZE(cpu_regs->reserved); i++)
-			if (cpu_regs->reserved[i])
+			if (cpu_regs->reserved[i]) {
+				kfree(cpu_regs);
 				return -EINVAL;
+			}
 
 		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_32); i++)
-			if (cpu_regs->vcpu_regs.reserved_32[i])
+			if (cpu_regs->vcpu_regs.reserved_32[i]) {
+				kfree(cpu_regs);
 				return -EINVAL;
+			}
 
 		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.reserved_64); i++)
-			if (cpu_regs->vcpu_regs.reserved_64[i])
+			if (cpu_regs->vcpu_regs.reserved_64[i]) {
+				kfree(cpu_regs);
 				return -EINVAL;
+			}
 
 		for (i = 0; i < ARRAY_SIZE(cpu_regs->vcpu_regs.gdt.reserved); i++)
 			if (cpu_regs->vcpu_regs.gdt.reserved[i] |
-			    cpu_regs->vcpu_regs.idt.reserved[i])
+			    cpu_regs->vcpu_regs.idt.reserved[i]) {
+				kfree(cpu_regs);
 				return -EINVAL;
+			}
 
 		ret = hcall_set_vcpu_regs(vm->vmid, virt_to_phys(cpu_regs));
 		if (ret < 0)
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2022-03-15  8:04 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-08  9:20 [PATCH] virt: acrn: fix a memory leak in acrn_dev_ioctl() Xiaolong Huang
2022-03-08  9:56 ` Greg KH
2022-03-08 10:14   ` butt3rflyh4ck
2022-03-08 10:16     ` Greg KH
2022-03-15  2:44       ` butt3rflyh4ck
2022-03-15  6:49         ` Greg KH
2022-03-15  7:36           ` butt3rflyh4ck
2022-03-15  7:50             ` Greg KH
2022-03-15  8:04   ` butt3rflyh4ck
  -- strict thread matches above, loose matches on Subject: below --
2022-03-01 10:00 Xiaolong Huang
2022-03-03  6:01 ` Li Fei1

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).