Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1675600 > unrolled thread

[PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure

Back to article view | Back to linux.kernel

Contents

  [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure Claudio Imbrenda <imbrenda@linux.vnet.ibm.com> - 2017-06-27 14:00 +0200
    Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure Paolo Bonzini <pbonzini@redhat.com> - 2017-06-27 15:10 +0200
      Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure Paolo Bonzini <pbonzini@redhat.com> - 2017-06-27 16:00 +0200
      Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure Al Viro <viro@ZenIV.linux.org.uk> - 2017-06-27 16:00 +0200
    Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure Al Viro <viro@ZenIV.linux.org.uk> - 2017-06-27 15:40 +0200
      Re: [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure Paolo Bonzini <pbonzini@redhat.com> - 2017-06-27 15:50 +0200

#1675600 — [PATCH v1 1/1] KVM: add missing kvm_put_kvm in case of failure

If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
will have a memory leak due to not freeing the kvm object.

A call to kvm_put_kvm was accidentally removed from an error handling in
commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")

This patch simply restores the call to kvm_put_kvm, so that the kvm
object is destroyed before returning an error.

Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
---
 virt/kvm/kvm_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index f0fe9d0..257d2a8 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -3194,6 +3194,7 @@ static int kvm_dev_ioctl_create_vm(unsigned long type)
 	if (kvm_create_vm_debugfs(kvm, r) < 0) {
 		put_unused_fd(r);
 		fput(file);
+		kvm_put_kvm(kvm);
 		return -ENOMEM;
 	}
 
-- 
2.7.4

[toc] | [next] | [standalone]

#1675691

On 27/06/2017 13:57, Claudio Imbrenda wrote:
> If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
> will have a memory leak due to not freeing the kvm object.
> 
> A call to kvm_put_kvm was accidentally removed from an error handling in
> commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> 
> This patch simply restores the call to kvm_put_kvm, so that the kvm
> object is destroyed before returning an error.
> 
> Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
> Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> ---
>  virt/kvm/kvm_main.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index f0fe9d0..257d2a8 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -3194,6 +3194,7 @@ static int kvm_dev_ioctl_create_vm(unsigned long type)
>  	if (kvm_create_vm_debugfs(kvm, r) < 0) {
>  		put_unused_fd(r);
>  		fput(file);
> +		kvm_put_kvm(kvm);
>  		return -ENOMEM;
>  	}
>  
> 

Queued, thanks.

Paolo

[toc] | [prev] | [next] | [standalone]

#1675724

On 27/06/2017 15:50, Al Viro wrote:
>> Queued, thanks.
> It's broken.  Look: once we are past the anon_inode_getfile(), the
> reference we held on kvm is transferred into new struct file.  After
> that point we don't drop kvm - we drop file.  And as long as that
> file is held, it will keep holding what used to be our reference to
> kvm.  Once all references to file are gone, its ->release() will be
> called and that's where kvm reference in it will be dropped.
> 
> IOW, this patch introduces a double-put.

Yup, I've noticed your other reply (hopefully would have noticed during
regression testing).  Thanks Al.

Paolo

[toc] | [prev] | [next] | [standalone]

#1675728

On Tue, Jun 27, 2017 at 03:08:32PM +0200, Paolo Bonzini wrote:

> On 27/06/2017 13:57, Claudio Imbrenda wrote:
> > If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
> > will have a memory leak due to not freeing the kvm object.
> > 
> > A call to kvm_put_kvm was accidentally removed from an error handling in
> > commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> > 
> > This patch simply restores the call to kvm_put_kvm, so that the kvm
> > object is destroyed before returning an error.
> > 
> > Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
> > Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> > ---
> >  virt/kvm/kvm_main.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index f0fe9d0..257d2a8 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -3194,6 +3194,7 @@ static int kvm_dev_ioctl_create_vm(unsigned long type)
> >  	if (kvm_create_vm_debugfs(kvm, r) < 0) {
> >  		put_unused_fd(r);
> >  		fput(file);
> > +		kvm_put_kvm(kvm);
> >  		return -ENOMEM;
> >  	}
> >  
> > 
> 
> Queued, thanks.

It's broken.  Look: once we are past the anon_inode_getfile(), the
reference we held on kvm is transferred into new struct file.  After
that point we don't drop kvm - we drop file.  And as long as that
file is held, it will keep holding what used to be our reference to
kvm.  Once all references to file are gone, its ->release() will be
called and that's where kvm reference in it will be dropped.

IOW, this patch introduces a double-put.

[toc] | [prev] | [next] | [standalone]

#1675709

On Tue, Jun 27, 2017 at 01:57:16PM +0200, Claudio Imbrenda wrote:
> If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
> will have a memory leak due to not freeing the kvm object.
> 
> A call to kvm_put_kvm was accidentally removed from an error handling in
> commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> 
> This patch simply restores the call to kvm_put_kvm, so that the kvm
> object is destroyed before returning an error.
> 
> Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
> Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")

What you are missing is that by that point we have file->f_op already
set, with ->release() being kvm_vm_release().  It will be called by
final fput(), and that's what will do your "missing" kvm_put_kvm().

IOW, NAK - removal was not accidental and you've just introduced
double-put there.

[toc] | [prev] | [next] | [standalone]

#1675713

On 27/06/2017 15:34, Al Viro wrote:
> On Tue, Jun 27, 2017 at 01:57:16PM +0200, Claudio Imbrenda wrote:
>> If I'm not missing anything, in case kvm_create_vm_debugfs fails, we
>> will have a memory leak due to not freeing the kvm object.
>>
>> A call to kvm_put_kvm was accidentally removed from an error handling in
>> commit 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
>>
>> This patch simply restores the call to kvm_put_kvm, so that the kvm
>> object is destroyed before returning an error.
>>
>> Signed-off-by: Claudio Imbrenda <imbrenda@linux.vnet.ibm.com>
>> Fixes: 506cfba9e726 ("KVM: don't use anon_inode_getfd() before possible failures")
> 
> What you are missing is that by that point we have file->f_op already
> set, with ->release() being kvm_vm_release().  It will be called by
> final fput(), and that's what will do your "missing" kvm_put_kvm().
> 
> IOW, NAK - removal was not accidental and you've just introduced
> double-put there.

Better add a comment, I'll reuse your wording.  Thanks.

Paolo

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web