On 16/12/2022 00:52, Michal Luczaj wrote:
Release page irrespectively of kvm_vcpu_write_guest() return value.
Signed-off-by: Michal Luczaj <mhal@xxxxxxx>
---
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff888131eff000 (size 4096):
comm "xen_hcall_leak", pid 949, jiffies 4294753212 (age 11.943s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e2915da4>] __kmalloc_node_track_caller+0x44/0xa0
[<00000000a9f05df2>] memdup_user+0x26/0x90
[<000000008e647779>] kvm_xen_write_hypercall_page+0xaa/0x160 [kvm]
[<00000000e5da0818>] vmx_set_msr+0x8d3/0x1090 [kvm_intel]
[<000000003f0226a5>] __kvm_set_msr+0x6f/0x1a0 [kvm]
[<00000000d3dc90c4>] kvm_emulate_wrmsr+0x4b/0x120 [kvm]
[<00000000093585d7>] vmx_handle_exit+0x1b6/0x710 [kvm_intel]
[<000000006fa8c15e>] vcpu_run+0xfbf/0x16f0 [kvm]
[<00000000891f7860>] kvm_arch_vcpu_ioctl_run+0x1d2/0x650 [kvm]
[<000000001b8d2d97>] kvm_vcpu_ioctl+0x223/0x6d0 [kvm]
[<00000000e7aa7a58>] __x64_sys_ioctl+0x85/0xc0
[<00000000c41da0be>] do_syscall_64+0x55/0x80
[<000000001635e1c8>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
arch/x86/kvm/xen.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
index f3098c0e386a..61953248bc0c 100644
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -879,6 +879,8 @@ int kvm_xen_write_hypercall_page(struct kvm_vcpu *vcpu, u64 data)
instructions, sizeof(instructions)))
return 1;
}
+
+ return 0;
I'd prefer dropping this hunk...
} else {
/*
* Note, truncation is a non-issue as 'lm' is guaranteed to be
@@ -889,6 +891,7 @@ int kvm_xen_write_hypercall_page(struct kvm_vcpu *vcpu, u64 data)
u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
: kvm->arch.xen_hvm_config.blob_size_32;
u8 *page;
+ int ret;
if (page_num >= blob_size)
return 1;
@@ -899,12 +902,11 @@ int kvm_xen_write_hypercall_page(struct kvm_vcpu *vcpu, u64 data)
if (IS_ERR(page))
return PTR_ERR(page);
- if (kvm_vcpu_write_guest(vcpu, page_addr, page, PAGE_SIZE)) {
- kfree(page);
- return 1;
- }
+ ret = kvm_vcpu_write_guest(vcpu, page_addr, page, PAGE_SIZE);
+ kfree(page);
+
+ return !!ret;
... making this
if (ret)
return 1;
}
- return 0;
... and then leaving this alone too.
Paul
}
int kvm_xen_hvm_config(struct kvm *kvm, struct kvm_xen_hvm_config *xhc)
