* [PATCH v2] vhost-vsock: delete vqs in vhost_vsock_unrealize to avoid memleaks
@ 2020-01-15 6:25 pannengyuan
2020-01-15 8:41 ` Stefano Garzarella
2020-01-20 10:41 ` Stefan Hajnoczi
0 siblings, 2 replies; 3+ messages in thread
From: pannengyuan @ 2020-01-15 6:25 UTC (permalink / raw)
To: mst; +Cc: Euler Robot, Pan Nengyuan, qemu-devel, zhang.zhanghailiang
From: Pan Nengyuan <pannengyuan@huawei.com>
Receive/transmit/event vqs forgot to cleanup in vhost_vsock_unrealize. This
patch save receive/transmit vq pointer in realize() and cleanup vqs
through those vq pointers in unrealize(). The leak stack is as follow:
Direct leak of 21504 byte(s) in 3 object(s) allocated from:
#0 0x7f86a1356970 (/lib64/libasan.so.5+0xef970) ??:?
#1 0x7f86a09aa49d (/lib64/libglib-2.0.so.0+0x5249d) ??:?
#2 0x5604852f85ca (./x86_64-softmmu/qemu-system-x86_64+0x2c3e5ca) /mnt/sdb/qemu/hw/virtio/virtio.c:2333
#3 0x560485356208 (./x86_64-softmmu/qemu-system-x86_64+0x2c9c208) /mnt/sdb/qemu/hw/virtio/vhost-vsock.c:339
#4 0x560485305a17 (./x86_64-softmmu/qemu-system-x86_64+0x2c4ba17) /mnt/sdb/qemu/hw/virtio/virtio.c:3531
#5 0x5604858e6b65 (./x86_64-softmmu/qemu-system-x86_64+0x322cb65) /mnt/sdb/qemu/hw/core/qdev.c:865
#6 0x5604861e6c41 (./x86_64-softmmu/qemu-system-x86_64+0x3b2cc41) /mnt/sdb/qemu/qom/object.c:2102
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
---
Changes V2 to V1:
- delete virtqueues after vhost cleanup to avoid use-after-free
- aslo delete virtqueues in the error path of realize()
---
hw/virtio/vhost-vsock.c | 12 ++++++++++--
include/hw/virtio/vhost-vsock.h | 2 ++
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/hw/virtio/vhost-vsock.c b/hw/virtio/vhost-vsock.c
index f5744363a8..b6cee479bb 100644
--- a/hw/virtio/vhost-vsock.c
+++ b/hw/virtio/vhost-vsock.c
@@ -335,8 +335,10 @@ static void vhost_vsock_device_realize(DeviceState *dev, Error **errp)
sizeof(struct virtio_vsock_config));
/* Receive and transmit queues belong to vhost */
- virtio_add_queue(vdev, VHOST_VSOCK_QUEUE_SIZE, vhost_vsock_handle_output);
- virtio_add_queue(vdev, VHOST_VSOCK_QUEUE_SIZE, vhost_vsock_handle_output);
+ vsock->recv_vq = virtio_add_queue(vdev, VHOST_VSOCK_QUEUE_SIZE,
+ vhost_vsock_handle_output);
+ vsock->trans_vq = virtio_add_queue(vdev, VHOST_VSOCK_QUEUE_SIZE,
+ vhost_vsock_handle_output);
/* The event queue belongs to QEMU */
vsock->event_vq = virtio_add_queue(vdev, VHOST_VSOCK_QUEUE_SIZE,
@@ -363,6 +365,9 @@ static void vhost_vsock_device_realize(DeviceState *dev, Error **errp)
err_vhost_dev:
vhost_dev_cleanup(&vsock->vhost_dev);
err_virtio:
+ virtio_delete_queue(vsock->recv_vq);
+ virtio_delete_queue(vsock->trans_vq);
+ virtio_delete_queue(vsock->event_vq);
virtio_cleanup(vdev);
close(vhostfd);
return;
@@ -379,6 +384,9 @@ static void vhost_vsock_device_unrealize(DeviceState *dev, Error **errp)
vhost_vsock_set_status(vdev, 0);
vhost_dev_cleanup(&vsock->vhost_dev);
+ virtio_delete_queue(vsock->recv_vq);
+ virtio_delete_queue(vsock->trans_vq);
+ virtio_delete_queue(vsock->event_vq);
virtio_cleanup(vdev);
}
diff --git a/include/hw/virtio/vhost-vsock.h b/include/hw/virtio/vhost-vsock.h
index d509d67c4a..bc5a988ee5 100644
--- a/include/hw/virtio/vhost-vsock.h
+++ b/include/hw/virtio/vhost-vsock.h
@@ -33,6 +33,8 @@ typedef struct {
struct vhost_virtqueue vhost_vqs[2];
struct vhost_dev vhost_dev;
VirtQueue *event_vq;
+ VirtQueue *recv_vq;
+ VirtQueue *trans_vq;
QEMUTimer *post_load_timer;
/*< public >*/
--
2.21.0.windows.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] vhost-vsock: delete vqs in vhost_vsock_unrealize to avoid memleaks
2020-01-15 6:25 [PATCH v2] vhost-vsock: delete vqs in vhost_vsock_unrealize to avoid memleaks pannengyuan
@ 2020-01-15 8:41 ` Stefano Garzarella
2020-01-20 10:41 ` Stefan Hajnoczi
1 sibling, 0 replies; 3+ messages in thread
From: Stefano Garzarella @ 2020-01-15 8:41 UTC (permalink / raw)
To: pannengyuan; +Cc: zhang.zhanghailiang, Euler Robot, qemu-devel, mst
On Wed, Jan 15, 2020 at 02:25:35PM +0800, pannengyuan@huawei.com wrote:
> From: Pan Nengyuan <pannengyuan@huawei.com>
>
> Receive/transmit/event vqs forgot to cleanup in vhost_vsock_unrealize. This
> patch save receive/transmit vq pointer in realize() and cleanup vqs
> through those vq pointers in unrealize(). The leak stack is as follow:
>
> Direct leak of 21504 byte(s) in 3 object(s) allocated from:
> #0 0x7f86a1356970 (/lib64/libasan.so.5+0xef970) ??:?
> #1 0x7f86a09aa49d (/lib64/libglib-2.0.so.0+0x5249d) ??:?
> #2 0x5604852f85ca (./x86_64-softmmu/qemu-system-x86_64+0x2c3e5ca) /mnt/sdb/qemu/hw/virtio/virtio.c:2333
> #3 0x560485356208 (./x86_64-softmmu/qemu-system-x86_64+0x2c9c208) /mnt/sdb/qemu/hw/virtio/vhost-vsock.c:339
> #4 0x560485305a17 (./x86_64-softmmu/qemu-system-x86_64+0x2c4ba17) /mnt/sdb/qemu/hw/virtio/virtio.c:3531
> #5 0x5604858e6b65 (./x86_64-softmmu/qemu-system-x86_64+0x322cb65) /mnt/sdb/qemu/hw/core/qdev.c:865
> #6 0x5604861e6c41 (./x86_64-softmmu/qemu-system-x86_64+0x3b2cc41) /mnt/sdb/qemu/qom/object.c:2102
>
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
> ---
> Changes V2 to V1:
> - delete virtqueues after vhost cleanup to avoid use-after-free
> - aslo delete virtqueues in the error path of realize()
> ---
> hw/virtio/vhost-vsock.c | 12 ++++++++++--
> include/hw/virtio/vhost-vsock.h | 2 ++
> 2 files changed, 12 insertions(+), 2 deletions(-)
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
>
> diff --git a/hw/virtio/vhost-vsock.c b/hw/virtio/vhost-vsock.c
> index f5744363a8..b6cee479bb 100644
> --- a/hw/virtio/vhost-vsock.c
> +++ b/hw/virtio/vhost-vsock.c
> @@ -335,8 +335,10 @@ static void vhost_vsock_device_realize(DeviceState *dev, Error **errp)
> sizeof(struct virtio_vsock_config));
>
> /* Receive and transmit queues belong to vhost */
> - virtio_add_queue(vdev, VHOST_VSOCK_QUEUE_SIZE, vhost_vsock_handle_output);
> - virtio_add_queue(vdev, VHOST_VSOCK_QUEUE_SIZE, vhost_vsock_handle_output);
> + vsock->recv_vq = virtio_add_queue(vdev, VHOST_VSOCK_QUEUE_SIZE,
> + vhost_vsock_handle_output);
> + vsock->trans_vq = virtio_add_queue(vdev, VHOST_VSOCK_QUEUE_SIZE,
> + vhost_vsock_handle_output);
>
> /* The event queue belongs to QEMU */
> vsock->event_vq = virtio_add_queue(vdev, VHOST_VSOCK_QUEUE_SIZE,
> @@ -363,6 +365,9 @@ static void vhost_vsock_device_realize(DeviceState *dev, Error **errp)
> err_vhost_dev:
> vhost_dev_cleanup(&vsock->vhost_dev);
> err_virtio:
> + virtio_delete_queue(vsock->recv_vq);
> + virtio_delete_queue(vsock->trans_vq);
> + virtio_delete_queue(vsock->event_vq);
> virtio_cleanup(vdev);
> close(vhostfd);
> return;
> @@ -379,6 +384,9 @@ static void vhost_vsock_device_unrealize(DeviceState *dev, Error **errp)
> vhost_vsock_set_status(vdev, 0);
>
> vhost_dev_cleanup(&vsock->vhost_dev);
> + virtio_delete_queue(vsock->recv_vq);
> + virtio_delete_queue(vsock->trans_vq);
> + virtio_delete_queue(vsock->event_vq);
> virtio_cleanup(vdev);
> }
>
> diff --git a/include/hw/virtio/vhost-vsock.h b/include/hw/virtio/vhost-vsock.h
> index d509d67c4a..bc5a988ee5 100644
> --- a/include/hw/virtio/vhost-vsock.h
> +++ b/include/hw/virtio/vhost-vsock.h
> @@ -33,6 +33,8 @@ typedef struct {
> struct vhost_virtqueue vhost_vqs[2];
> struct vhost_dev vhost_dev;
> VirtQueue *event_vq;
> + VirtQueue *recv_vq;
> + VirtQueue *trans_vq;
> QEMUTimer *post_load_timer;
>
> /*< public >*/
> --
> 2.21.0.windows.1
>
>
>
--
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] vhost-vsock: delete vqs in vhost_vsock_unrealize to avoid memleaks
2020-01-15 6:25 [PATCH v2] vhost-vsock: delete vqs in vhost_vsock_unrealize to avoid memleaks pannengyuan
2020-01-15 8:41 ` Stefano Garzarella
@ 2020-01-20 10:41 ` Stefan Hajnoczi
1 sibling, 0 replies; 3+ messages in thread
From: Stefan Hajnoczi @ 2020-01-20 10:41 UTC (permalink / raw)
To: pannengyuan; +Cc: zhang.zhanghailiang, Euler Robot, qemu-devel, mst
[-- Attachment #1: Type: text/plain, Size: 1560 bytes --]
On Wed, Jan 15, 2020 at 02:25:35PM +0800, pannengyuan@huawei.com wrote:
> From: Pan Nengyuan <pannengyuan@huawei.com>
>
> Receive/transmit/event vqs forgot to cleanup in vhost_vsock_unrealize. This
> patch save receive/transmit vq pointer in realize() and cleanup vqs
> through those vq pointers in unrealize(). The leak stack is as follow:
>
> Direct leak of 21504 byte(s) in 3 object(s) allocated from:
> #0 0x7f86a1356970 (/lib64/libasan.so.5+0xef970) ??:?
> #1 0x7f86a09aa49d (/lib64/libglib-2.0.so.0+0x5249d) ??:?
> #2 0x5604852f85ca (./x86_64-softmmu/qemu-system-x86_64+0x2c3e5ca) /mnt/sdb/qemu/hw/virtio/virtio.c:2333
> #3 0x560485356208 (./x86_64-softmmu/qemu-system-x86_64+0x2c9c208) /mnt/sdb/qemu/hw/virtio/vhost-vsock.c:339
> #4 0x560485305a17 (./x86_64-softmmu/qemu-system-x86_64+0x2c4ba17) /mnt/sdb/qemu/hw/virtio/virtio.c:3531
> #5 0x5604858e6b65 (./x86_64-softmmu/qemu-system-x86_64+0x322cb65) /mnt/sdb/qemu/hw/core/qdev.c:865
> #6 0x5604861e6c41 (./x86_64-softmmu/qemu-system-x86_64+0x3b2cc41) /mnt/sdb/qemu/qom/object.c:2102
>
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
> ---
> Changes V2 to V1:
> - delete virtqueues after vhost cleanup to avoid use-after-free
> - aslo delete virtqueues in the error path of realize()
> ---
> hw/virtio/vhost-vsock.c | 12 ++++++++++--
> include/hw/virtio/vhost-vsock.h | 2 ++
> 2 files changed, 12 insertions(+), 2 deletions(-)
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-01-20 11:09 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-01-15 6:25 [PATCH v2] vhost-vsock: delete vqs in vhost_vsock_unrealize to avoid memleaks pannengyuan
2020-01-15 8:41 ` Stefano Garzarella
2020-01-20 10:41 ` Stefan Hajnoczi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).