Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/805361/?format=api
{ "id": 805361, "url": "http://patchwork.ozlabs.org/api/1.2/patches/805361/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20170824091138.GE27401@fergus.ozlabs.ibm.com/", "project": { "id": 2, "url": "http://patchwork.ozlabs.org/api/1.2/projects/2/?format=api", "name": "Linux PPC development", "link_name": "linuxppc-dev", "list_id": "linuxppc-dev.lists.ozlabs.org", "list_email": "linuxppc-dev@lists.ozlabs.org", "web_url": "https://github.com/linuxppc/wiki/wiki", "scm_url": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git", "webscm_url": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/", "list_archive_url": "https://lore.kernel.org/linuxppc-dev/", "list_archive_url_format": "https://lore.kernel.org/linuxppc-dev/{}/", "commit_url_format": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/commit/?id={}" }, "msgid": "<20170824091138.GE27401@fergus.ozlabs.ibm.com>", "list_archive_url": "https://lore.kernel.org/linuxppc-dev/20170824091138.GE27401@fergus.ozlabs.ibm.com/", "date": "2017-08-24T09:11:38", "name": "[v2] KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce()", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "085fe5b5994d3e503daeddff31acaba56ff64ce6", "submitter": { "id": 67079, "url": "http://patchwork.ozlabs.org/api/1.2/people/67079/?format=api", "name": "Paul Mackerras", "email": "paulus@ozlabs.org" }, "delegate": { "id": 13, "url": "http://patchwork.ozlabs.org/api/1.2/users/13/?format=api", "username": "paulus", "first_name": "Paul", "last_name": "Mackerras", "email": "paulus@samba.org" }, "mbox": "http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20170824091138.GE27401@fergus.ozlabs.ibm.com/mbox/", "series": [], "comments": "http://patchwork.ozlabs.org/api/patches/805361/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/805361/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org>", "X-Original-To": [ "patchwork-incoming@ozlabs.org", "linuxppc-dev@lists.ozlabs.org" ], "Delivered-To": [ "patchwork-incoming@ozlabs.org", "linuxppc-dev@lists.ozlabs.org" ], "Received": [ "from lists.ozlabs.org (lists.ozlabs.org [103.22.144.68])\n\t(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xdJVY6fHyz9sCZ\n\tfor <patchwork-incoming@ozlabs.org>;\n\tThu, 24 Aug 2017 19:13:09 +1000 (AEST)", "from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3])\n\tby lists.ozlabs.org (Postfix) with ESMTP id 3xdJVY5BHmzDqYw\n\tfor <patchwork-incoming@ozlabs.org>;\n\tThu, 24 Aug 2017 19:13:09 +1000 (AEST)", "from ozlabs.org (bilbo.ozlabs.org [103.22.144.67])\n\t(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby lists.ozlabs.org (Postfix) with ESMTPS id 3xdJSs5zNZzDqn6\n\tfor <linuxppc-dev@lists.ozlabs.org>;\n\tThu, 24 Aug 2017 19:11:41 +1000 (AEST)", "by ozlabs.org (Postfix, from userid 1003)\n\tid 3xdJSs4rbNz9sR9; Thu, 24 Aug 2017 19:11:41 +1000 (AEST)" ], "Authentication-Results": [ "ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tsecure) header.d=ozlabs.org header.i=@ozlabs.org header.b=\"yrHW+Nx+\";\n\tdkim-atps=neutral", "lists.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tsecure) header.d=ozlabs.org header.i=@ozlabs.org header.b=\"yrHW+Nx+\";\n\tdkim-atps=neutral", "lists.ozlabs.org; dkim=pass (2048-bit key;\n\tsecure) header.d=ozlabs.org header.i=@ozlabs.org header.b=\"yrHW+Nx+\"; \n\tdkim-atps=neutral" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/simple; d=ozlabs.org; s=201707; \n\tt=1503565901; bh=HwTtRwOG64Rwn9jwt4c2ty/LklhHQpluotcDBWG5gyA=;\n\th=Date:From:To:Cc:Subject:From;\n\tb=yrHW+Nx+P9Sg5ZwvrCftgnmwTnL4b5i6euZTusWhNRnFjUfe2OnMqDO5c+0hAZhOE\n\tnNIfXbm1WTkqIj6RgqI/hjhfqVKtgdQOPfbmpJQeo74AsU4y9jXHC6RaT3W39zx8FU\n\tUahQhAHoKYnvWqJN2JMU1u3Of6DsYnMcgr+ebSfa/Sqdrp8TVGubP5okpT65gyJF9/\n\tlcSOke8L8HBpJs8wcwhCkeD6d5EGlxA4aWdTVnvavqHEijj/6MUIJQnM5n/qz5qRw6\n\tRRb5qS9/YBClQS8TBeKuTFH6bdOtV9MbbSsVioPRFkmdoljmU+crWhWsSZjoDgvXtD\n\tXRxecdLUd8TrA==", "Date": "Thu, 24 Aug 2017 19:11:38 +1000", "From": "Paul Mackerras <paulus@ozlabs.org>", "To": "kvm-ppc@vger.kernel.org, kvm@vger.kernel.org,\n\tlinuxppc-dev@lists.ozlabs.org", "Subject": "[PATCH v2] KVM: PPC: Book3S: Fix race and leak in\n\tkvm_vm_ioctl_create_spapr_tce()", "Message-ID": "<20170824091138.GE27401@fergus.ozlabs.ibm.com>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=us-ascii", "Content-Disposition": "inline", "User-Agent": "Mutt/1.5.24 (2015-08-30)", "X-BeenThere": "linuxppc-dev@lists.ozlabs.org", "X-Mailman-Version": "2.1.23", "Precedence": "list", "List-Id": "Linux on PowerPC Developers Mail List\n\t<linuxppc-dev.lists.ozlabs.org>", "List-Unsubscribe": "<https://lists.ozlabs.org/options/linuxppc-dev>,\n\t<mailto:linuxppc-dev-request@lists.ozlabs.org?subject=unsubscribe>", "List-Archive": "<http://lists.ozlabs.org/pipermail/linuxppc-dev/>", "List-Post": "<mailto:linuxppc-dev@lists.ozlabs.org>", "List-Help": "<mailto:linuxppc-dev-request@lists.ozlabs.org?subject=help>", "List-Subscribe": "<https://lists.ozlabs.org/listinfo/linuxppc-dev>,\n\t<mailto:linuxppc-dev-request@lists.ozlabs.org?subject=subscribe>", "Cc": "David Gibson <david@gibson.dropbear.id.au>,\n\tnixiaoming <nixiaoming@huawei.com>, David Hildenbrand <david@redhat.com>", "Errors-To": "linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org", "Sender": "\"Linuxppc-dev\"\n\t<linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org>" }, "content": "Nixiaoming pointed out that there is a memory leak in\nkvm_vm_ioctl_create_spapr_tce() if the call to anon_inode_getfd()\nfails; the memory allocated for the kvmppc_spapr_tce_table struct\nis not freed, and nor are the pages allocated for the iommu\ntables. In addition, we have already incremented the process's\ncount of locked memory pages, and this doesn't get restored on\nerror.\n\nDavid Hildenbrand pointed out that there is a race in that the\nfunction checks early on that there is not already an entry in the\nstt->iommu_tables list with the same LIOBN, but an entry with the\nsame LIOBN could get added between then and when the new entry is\nadded to the list.\n\nThis fixes all three problems. To simplify things, we now call\nanon_inode_getfd() before placing the new entry in the list. The\ncheck for an existing entry is done while holding the kvm->lock\nmutex, immediately before adding the new entry to the list.\nFinally, on failure we now call kvmppc_account_memlimit to\ndecrement the process's count of locked memory pages.\n\nReported-by: Nixiaoming <nixiaoming@huawei.com>\nReported-by: David Hildenbrand <david@redhat.com>\nSigned-off-by: Paul Mackerras <paulus@ozlabs.org>\n---\nv2: Don't overwrite stt in loop over kvm->arch.spapr_tce_tables\n\n arch/powerpc/kvm/book3s_64_vio.c | 55 ++++++++++++++++++++++++----------------\n 1 file changed, 33 insertions(+), 22 deletions(-)", "diff": "diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c\nindex a160c14..d463c1c 100644\n--- a/arch/powerpc/kvm/book3s_64_vio.c\n+++ b/arch/powerpc/kvm/book3s_64_vio.c\n@@ -297,29 +297,22 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,\n \tunsigned long npages, size;\n \tint ret = -ENOMEM;\n \tint i;\n+\tint fd = -1;\n \n \tif (!args->size)\n \t\treturn -EINVAL;\n \n-\t/* Check this LIOBN hasn't been previously allocated */\n-\tlist_for_each_entry(stt, &kvm->arch.spapr_tce_tables, list) {\n-\t\tif (stt->liobn == args->liobn)\n-\t\t\treturn -EBUSY;\n-\t}\n-\n \tsize = _ALIGN_UP(args->size, PAGE_SIZE >> 3);\n \tnpages = kvmppc_tce_pages(size);\n \tret = kvmppc_account_memlimit(kvmppc_stt_pages(npages), true);\n-\tif (ret) {\n-\t\tstt = NULL;\n-\t\tgoto fail;\n-\t}\n+\tif (ret)\n+\t\treturn ret;\n \n \tret = -ENOMEM;\n \tstt = kzalloc(sizeof(*stt) + npages * sizeof(struct page *),\n \t\t GFP_KERNEL);\n \tif (!stt)\n-\t\tgoto fail;\n+\t\tgoto fail_acct;\n \n \tstt->liobn = args->liobn;\n \tstt->page_shift = args->page_shift;\n@@ -334,24 +327,42 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,\n \t\t\tgoto fail;\n \t}\n \n-\tkvm_get_kvm(kvm);\n+\tret = fd = anon_inode_getfd(\"kvm-spapr-tce\", &kvm_spapr_tce_fops,\n+\t\t\t\t stt, O_RDWR | O_CLOEXEC);\n+\tif (ret < 0)\n+\t\tgoto fail;\n \n \tmutex_lock(&kvm->lock);\n-\tlist_add_rcu(&stt->list, &kvm->arch.spapr_tce_tables);\n+\n+\t/* Check this LIOBN hasn't been previously allocated */\n+\tret = 0;\n+\tlist_for_each_entry(stt, &kvm->arch.spapr_tce_tables, list) {\n+\t\tif (stt->liobn == args->liobn) {\n+\t\t\tret = -EBUSY;\n+\t\t\tbreak;\n+\t\t}\n+\t}\n+\n+\tif (!ret) {\n+\t\tlist_add_rcu(&stt->list, &kvm->arch.spapr_tce_tables);\n+\t\tkvm_get_kvm(kvm);\n+\t}\n \n \tmutex_unlock(&kvm->lock);\n \n-\treturn anon_inode_getfd(\"kvm-spapr-tce\", &kvm_spapr_tce_fops,\n-\t\t\t\tstt, O_RDWR | O_CLOEXEC);\n+\tif (!ret)\n+\t\treturn fd;\n \n-fail:\n-\tif (stt) {\n-\t\tfor (i = 0; i < npages; i++)\n-\t\t\tif (stt->pages[i])\n-\t\t\t\t__free_page(stt->pages[i]);\n+\tput_unused_fd(fd);\n \n-\t\tkfree(stt);\n-\t}\n+ fail:\n+\tfor (i = 0; i < npages; i++)\n+\t\tif (stt->pages[i])\n+\t\t\t__free_page(stt->pages[i]);\n+\n+\tkfree(stt);\n+ fail_acct:\n+\tkvmppc_account_memlimit(kvmppc_stt_pages(npages), false);\n \treturn ret;\n }\n \n", "prefixes": [ "v2" ] }