Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/805363/?format=api
{ "id": 805363, "url": "http://patchwork.ozlabs.org/api/1.2/patches/805363/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20170824091447.GG27401@fergus.ozlabs.ibm.com/", "project": { "id": 2, "url": "http://patchwork.ozlabs.org/api/1.2/projects/2/?format=api", "name": "Linux PPC development", "link_name": "linuxppc-dev", "list_id": "linuxppc-dev.lists.ozlabs.org", "list_email": "linuxppc-dev@lists.ozlabs.org", "web_url": "https://github.com/linuxppc/wiki/wiki", "scm_url": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git", "webscm_url": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/", "list_archive_url": "https://lore.kernel.org/linuxppc-dev/", "list_archive_url_format": "https://lore.kernel.org/linuxppc-dev/{}/", "commit_url_format": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/commit/?id={}" }, "msgid": "<20170824091447.GG27401@fergus.ozlabs.ibm.com>", "list_archive_url": "https://lore.kernel.org/linuxppc-dev/20170824091447.GG27401@fergus.ozlabs.ibm.com/", "date": "2017-08-24T09:14:47", "name": "[really,v2] KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce()", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": false, "hash": "5d2c79968ec794791ba6d6a77ca968d3e4be765c", "submitter": { "id": 67079, "url": "http://patchwork.ozlabs.org/api/1.2/people/67079/?format=api", "name": "Paul Mackerras", "email": "paulus@ozlabs.org" }, "delegate": { "id": 13, "url": "http://patchwork.ozlabs.org/api/1.2/users/13/?format=api", "username": "paulus", "first_name": "Paul", "last_name": "Mackerras", "email": "paulus@samba.org" }, "mbox": "http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20170824091447.GG27401@fergus.ozlabs.ibm.com/mbox/", "series": [], "comments": "http://patchwork.ozlabs.org/api/patches/805363/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/805363/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org>", "X-Original-To": [ "patchwork-incoming@ozlabs.org", "linuxppc-dev@lists.ozlabs.org" ], "Delivered-To": [ "patchwork-incoming@ozlabs.org", "linuxppc-dev@lists.ozlabs.org" ], "Received": [ "from lists.ozlabs.org (lists.ozlabs.org [103.22.144.68])\n\t(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby ozlabs.org (Postfix) with ESMTPS id 3xdJZX2LzMz9sCZ\n\tfor <patchwork-incoming@ozlabs.org>;\n\tThu, 24 Aug 2017 19:16:36 +1000 (AEST)", "from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3])\n\tby lists.ozlabs.org (Postfix) with ESMTP id 3xdJZX12clzDrJs\n\tfor <patchwork-incoming@ozlabs.org>;\n\tThu, 24 Aug 2017 19:16:36 +1000 (AEST)", "from ozlabs.org (ozlabs.org [IPv6:2401:3900:2:1::2])\n\t(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby lists.ozlabs.org (Postfix) with ESMTPS id 3xdJXW0BHrzDqY8\n\tfor <linuxppc-dev@lists.ozlabs.org>;\n\tThu, 24 Aug 2017 19:14:51 +1000 (AEST)", "by ozlabs.org (Postfix, from userid 1003)\n\tid 3xdJXV4xh9z9sPk; Thu, 24 Aug 2017 19:14:50 +1000 (AEST)" ], "Authentication-Results": [ "ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tsecure) header.d=ozlabs.org header.i=@ozlabs.org header.b=\"g9aEKjMr\";\n\tdkim-atps=neutral", "lists.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (2048-bit key;\n\tsecure) header.d=ozlabs.org header.i=@ozlabs.org header.b=\"g9aEKjMr\";\n\tdkim-atps=neutral", "lists.ozlabs.org; dkim=pass (2048-bit key;\n\tsecure) header.d=ozlabs.org header.i=@ozlabs.org header.b=\"g9aEKjMr\"; \n\tdkim-atps=neutral" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/simple; d=ozlabs.org; s=201707; \n\tt=1503566090; bh=tB9ATbKQefwWcnBKxAiHeuTcErUYsH4rN5bFXSmE2JA=;\n\th=Date:From:To:Cc:Subject:From;\n\tb=g9aEKjMrpw7QWfk37s5nxp7hYxcIs+qV9YhU+jMl8ONWj6AuqLaYBDeo/CKa6/eJ9\n\tIiPPX/YSd2StY/bxB5UkRt/wJIEyGifGbXrV3xSM3OzEKIk9Vu4jgCNPy96Yfo0HlP\n\tjvPnbRKmA97O6w4xrquQUZmykveT1163rBh2e4B4SSDwZhFm6VOohtT3TKE8To2iMH\n\tTjbU9YTGDKICQWTEBcsvyiskc23FRncLm/bAPEziWnua6p5nAvKr8NM0q1iIa6mkD/\n\tIaFhaql9F2b/up/RXh5gmXlw4oesINFBNv/GDzy5SotMwLeEggxl8UQ7Z9Flh9WITG\n\tXz9ptyXGhEYcQ==", "Date": "Thu, 24 Aug 2017 19:14:47 +1000", "From": "Paul Mackerras <paulus@ozlabs.org>", "To": "kvm-ppc@vger.kernel.org, kvm@vger.kernel.org,\n\tlinuxppc-dev@lists.ozlabs.org", "Subject": "[PATCH really v2] KVM: PPC: Book3S: Fix race and leak in\n\tkvm_vm_ioctl_create_spapr_tce()", "Message-ID": "<20170824091447.GG27401@fergus.ozlabs.ibm.com>", "MIME-Version": "1.0", "Content-Type": "text/plain; charset=us-ascii", "Content-Disposition": "inline", "User-Agent": "Mutt/1.5.24 (2015-08-30)", "X-BeenThere": "linuxppc-dev@lists.ozlabs.org", "X-Mailman-Version": "2.1.23", "Precedence": "list", "List-Id": "Linux on PowerPC Developers Mail List\n\t<linuxppc-dev.lists.ozlabs.org>", "List-Unsubscribe": "<https://lists.ozlabs.org/options/linuxppc-dev>,\n\t<mailto:linuxppc-dev-request@lists.ozlabs.org?subject=unsubscribe>", "List-Archive": "<http://lists.ozlabs.org/pipermail/linuxppc-dev/>", "List-Post": "<mailto:linuxppc-dev@lists.ozlabs.org>", "List-Help": "<mailto:linuxppc-dev-request@lists.ozlabs.org?subject=help>", "List-Subscribe": "<https://lists.ozlabs.org/listinfo/linuxppc-dev>,\n\t<mailto:linuxppc-dev-request@lists.ozlabs.org?subject=subscribe>", "Cc": "David Gibson <david@gibson.dropbear.id.au>,\n\tnixiaoming <nixiaoming@huawei.com>, David Hildenbrand <david@redhat.com>", "Errors-To": "linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org", "Sender": "\"Linuxppc-dev\"\n\t<linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org>" }, "content": "Nixiaoming pointed out that there is a memory leak in\nkvm_vm_ioctl_create_spapr_tce() if the call to anon_inode_getfd()\nfails; the memory allocated for the kvmppc_spapr_tce_table struct\nis not freed, and nor are the pages allocated for the iommu\ntables. In addition, we have already incremented the process's\ncount of locked memory pages, and this doesn't get restored on\nerror.\n\nDavid Hildenbrand pointed out that there is a race in that the\nfunction checks early on that there is not already an entry in the\nstt->iommu_tables list with the same LIOBN, but an entry with the\nsame LIOBN could get added between then and when the new entry is\nadded to the list.\n\nThis fixes all three problems. To simplify things, we now call\nanon_inode_getfd() before placing the new entry in the list. The\ncheck for an existing entry is done while holding the kvm->lock\nmutex, immediately before adding the new entry to the list.\nFinally, on failure we now call kvmppc_account_memlimit to\ndecrement the process's count of locked memory pages.\n\nReported-by: Nixiaoming <nixiaoming@huawei.com>\nReported-by: David Hildenbrand <david@redhat.com>\nSigned-off-by: Paul Mackerras <paulus@ozlabs.org>\n---\nv2: Don't overwrite stt in loop over spapr_tce_tables\n\n arch/powerpc/kvm/book3s_64_vio.c | 56 ++++++++++++++++++++++++----------------\n 1 file changed, 34 insertions(+), 22 deletions(-)", "diff": "diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c\nindex a160c14..53766e2 100644\n--- a/arch/powerpc/kvm/book3s_64_vio.c\n+++ b/arch/powerpc/kvm/book3s_64_vio.c\n@@ -294,32 +294,26 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,\n \t\t\t\t struct kvm_create_spapr_tce_64 *args)\n {\n \tstruct kvmppc_spapr_tce_table *stt = NULL;\n+\tstruct kvmppc_spapr_tce_table *siter;\n \tunsigned long npages, size;\n \tint ret = -ENOMEM;\n \tint i;\n+\tint fd = -1;\n \n \tif (!args->size)\n \t\treturn -EINVAL;\n \n-\t/* Check this LIOBN hasn't been previously allocated */\n-\tlist_for_each_entry(stt, &kvm->arch.spapr_tce_tables, list) {\n-\t\tif (stt->liobn == args->liobn)\n-\t\t\treturn -EBUSY;\n-\t}\n-\n \tsize = _ALIGN_UP(args->size, PAGE_SIZE >> 3);\n \tnpages = kvmppc_tce_pages(size);\n \tret = kvmppc_account_memlimit(kvmppc_stt_pages(npages), true);\n-\tif (ret) {\n-\t\tstt = NULL;\n-\t\tgoto fail;\n-\t}\n+\tif (ret)\n+\t\treturn ret;\n \n \tret = -ENOMEM;\n \tstt = kzalloc(sizeof(*stt) + npages * sizeof(struct page *),\n \t\t GFP_KERNEL);\n \tif (!stt)\n-\t\tgoto fail;\n+\t\tgoto fail_acct;\n \n \tstt->liobn = args->liobn;\n \tstt->page_shift = args->page_shift;\n@@ -334,24 +328,42 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm,\n \t\t\tgoto fail;\n \t}\n \n-\tkvm_get_kvm(kvm);\n+\tret = fd = anon_inode_getfd(\"kvm-spapr-tce\", &kvm_spapr_tce_fops,\n+\t\t\t\t stt, O_RDWR | O_CLOEXEC);\n+\tif (ret < 0)\n+\t\tgoto fail;\n \n \tmutex_lock(&kvm->lock);\n-\tlist_add_rcu(&stt->list, &kvm->arch.spapr_tce_tables);\n+\n+\t/* Check this LIOBN hasn't been previously allocated */\n+\tret = 0;\n+\tlist_for_each_entry(siter, &kvm->arch.spapr_tce_tables, list) {\n+\t\tif (siter->liobn == args->liobn) {\n+\t\t\tret = -EBUSY;\n+\t\t\tbreak;\n+\t\t}\n+\t}\n+\n+\tif (!ret) {\n+\t\tlist_add_rcu(&stt->list, &kvm->arch.spapr_tce_tables);\n+\t\tkvm_get_kvm(kvm);\n+\t}\n \n \tmutex_unlock(&kvm->lock);\n \n-\treturn anon_inode_getfd(\"kvm-spapr-tce\", &kvm_spapr_tce_fops,\n-\t\t\t\tstt, O_RDWR | O_CLOEXEC);\n+\tif (!ret)\n+\t\treturn fd;\n \n-fail:\n-\tif (stt) {\n-\t\tfor (i = 0; i < npages; i++)\n-\t\t\tif (stt->pages[i])\n-\t\t\t\t__free_page(stt->pages[i]);\n+\tput_unused_fd(fd);\n \n-\t\tkfree(stt);\n-\t}\n+ fail:\n+\tfor (i = 0; i < npages; i++)\n+\t\tif (stt->pages[i])\n+\t\t\t__free_page(stt->pages[i]);\n+\n+\tkfree(stt);\n+ fail_acct:\n+\tkvmppc_account_memlimit(kvmppc_stt_pages(npages), false);\n \treturn ret;\n }\n \n", "prefixes": [ "really", "v2" ] }