Re: [PATCH] KVM: x86/xen: Fix memory leak in kvm_xen_write_hypercall_page()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 16/12/2022 00:52, Michal Luczaj wrote:
Release page irrespectively of kvm_vcpu_write_guest() return value.

Signed-off-by: Michal Luczaj <mhal@xxxxxxx>
---
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff888131eff000 (size 4096):
   comm "xen_hcall_leak", pid 949, jiffies 4294753212 (age 11.943s)
   hex dump (first 32 bytes):
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   backtrace:
     [<00000000e2915da4>] __kmalloc_node_track_caller+0x44/0xa0
     [<00000000a9f05df2>] memdup_user+0x26/0x90
     [<000000008e647779>] kvm_xen_write_hypercall_page+0xaa/0x160 [kvm]
     [<00000000e5da0818>] vmx_set_msr+0x8d3/0x1090 [kvm_intel]
     [<000000003f0226a5>] __kvm_set_msr+0x6f/0x1a0 [kvm]
     [<00000000d3dc90c4>] kvm_emulate_wrmsr+0x4b/0x120 [kvm]
     [<00000000093585d7>] vmx_handle_exit+0x1b6/0x710 [kvm_intel]
     [<000000006fa8c15e>] vcpu_run+0xfbf/0x16f0 [kvm]
     [<00000000891f7860>] kvm_arch_vcpu_ioctl_run+0x1d2/0x650 [kvm]
     [<000000001b8d2d97>] kvm_vcpu_ioctl+0x223/0x6d0 [kvm]
     [<00000000e7aa7a58>] __x64_sys_ioctl+0x85/0xc0
     [<00000000c41da0be>] do_syscall_64+0x55/0x80
     [<000000001635e1c8>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

  arch/x86/kvm/xen.c | 12 +++++++-----
  1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c
index f3098c0e386a..61953248bc0c 100644
--- a/arch/x86/kvm/xen.c
+++ b/arch/x86/kvm/xen.c
@@ -879,6 +879,8 @@ int kvm_xen_write_hypercall_page(struct kvm_vcpu *vcpu, u64 data)
  						 instructions, sizeof(instructions)))
  				return 1;
  		}
+
+		return 0;

I'd prefer dropping this hunk...

  	} else {
  		/*
  		 * Note, truncation is a non-issue as 'lm' is guaranteed to be
@@ -889,6 +891,7 @@ int kvm_xen_write_hypercall_page(struct kvm_vcpu *vcpu, u64 data)
  		u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
  				  : kvm->arch.xen_hvm_config.blob_size_32;
  		u8 *page;
+		int ret;
if (page_num >= blob_size)
  			return 1;
@@ -899,12 +902,11 @@ int kvm_xen_write_hypercall_page(struct kvm_vcpu *vcpu, u64 data)
  		if (IS_ERR(page))
  			return PTR_ERR(page);
- if (kvm_vcpu_write_guest(vcpu, page_addr, page, PAGE_SIZE)) {
-			kfree(page);
-			return 1;
-		}
+		ret = kvm_vcpu_write_guest(vcpu, page_addr, page, PAGE_SIZE);
+		kfree(page);
+
+		return !!ret;

... making this

if (ret)
    return 1;

  	}
-	return 0;

... and then leaving this alone too.

  Paul

  }
int kvm_xen_hvm_config(struct kvm *kvm, struct kvm_xen_hvm_config *xhc)




[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux