From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93FA7C636D3 for ; Wed, 1 Feb 2023 22:39:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229451AbjBAWjS (ORCPT ); Wed, 1 Feb 2023 17:39:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55218 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231479AbjBAWjQ (ORCPT ); Wed, 1 Feb 2023 17:39:16 -0500 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 338DA28D01 for ; Wed, 1 Feb 2023 14:39:13 -0800 (PST) Received: by mail-yb1-xb49.google.com with SMTP id x8-20020a25e008000000b007cb4f1e3e57so16470345ybg.8 for ; Wed, 01 Feb 2023 14:39:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=VfjIQrCZKH7ipWOhIHgNB+L4oWQlrAmV0rH/utG3vBk=; b=boXv4vPWJe22L/kH6A1SvNazwAqD9IFi3cC/pDgFCVG6zpzlo41Zz/eXFBZFLoEQSi Oa4vyEum/kwwhvwiZMuxExhEaq8tHYCcekaz12DWHJ/GEiW2nEC0FJAgYWDi+WMnPo/a PXEzenOR0uB4PrqyVlhS75mljuT6ttHEaU66Eqo6mqmqSCktQ89bkWZaAoc9stIc8rMy NsakNl5Yia303OTiJMZp1FXiLI0YHRsSKVnvu17WjTWdZ6oETfN19BAXt6Ndtkj3zinY Vx2GvGdu/jKkT3JsVZrHcqZ1YZIJ5mW4wkUUpTcKjAQThNejzfhxUQbMmvMR+t29Yd/L 4GdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=VfjIQrCZKH7ipWOhIHgNB+L4oWQlrAmV0rH/utG3vBk=; b=aMb9CWkbfwRoGUZzWe1Qf9ieU9ydsNfnU6/CvJKmN7Zy7S9G/ayx5YqNETvKReluXy Klf462h7JkXP/VWpRcFgg9tcojI+fOBT5dsULfbT+fsfPBaDpe5A9zMtaebLouv8CvRq PdXR/nbkG650wMwGD/TFdIm1dupzXCeOs4Jp2ztkcHwsLGxhMnNAATVOftguMpU/RvM3 9IZI3aIL+66YvbrZH7Xp+7Nxh7R09mRpGuoDRR0ZqtVROIErVPjL7s5TLHIxAyB7CaUG p6dyvpzavvyRLBCQwmms7JQkGNN60zoelWpAwRMlwHr/iY/aavh7roOyqxmM/DR/jsEA kp+A== X-Gm-Message-State: AO0yUKWTBGnK/qLoqy+0NqLRsNVI5GCNROEWTju2ULjBvgqw24H9o/UQ Td/UVohQWG3CeJz6kkWAkVLhtakMVz4= X-Google-Smtp-Source: AK7set+2ZzcbKOe1O/V52p2ikbekoO/wYDG4nkkpAP/pzpws1LTtmiv96cDgiKnBQBlTCi/ozfjSIvFeL28= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a0d:ea87:0:b0:521:daa4:d68c with SMTP id t129-20020a0dea87000000b00521daa4d68cmr0ywe.5.1675291151988; Wed, 01 Feb 2023 14:39:11 -0800 (PST) Date: Wed, 1 Feb 2023 22:37:35 +0000 In-Reply-To: <20221219171924.67989-1-seanjc@google.com> Mime-Version: 1.0 References: <20221219171924.67989-1-seanjc@google.com> X-Mailer: git-send-email 2.39.1.456.gfc5497dd1b-goog Message-ID: <167528558345.768469.17759293608992301689.b4-ty@google.com> Subject: Re: [PATCH] KVM: Destroy target device if coalesced MMIO unregistration fails From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org, "=?UTF-8?q?=E6=9F=B3=E8=8F=81=E5=B3=B0?=" , Wei Wang , Michal Luczaj Content-Type: text/plain; charset="utf-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 19 Dec 2022 17:19:24 +0000, Sean Christopherson wrote: > Destroy and free the target coalesced MMIO device if unregistering said > device fails. As clearly noted in the code, kvm_io_bus_unregister_dev() > does not destroy the target device. > > BUG: memory leak > unreferenced object 0xffff888112a54880 (size 64): > comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s) > hex dump (first 32 bytes): > 38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g..... > e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g..... > backtrace: > [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline] > [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline] > [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150 > [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323 > [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline] > [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline] > [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696 > [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713 > [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline] > [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline] > [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 > [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290 > [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe > > [...] Applied to kvm-x86 generic, the plan is that Wei will send the bigger cleanup on top. Thanks! [1/1] KVM: Destroy target device if coalesced MMIO unregistration fails https://github.com/kvm-x86/linux/commit/b1cb1fac22ab -- https://github.com/kvm-x86/linux/tree/next https://github.com/kvm-x86/linux/tree/fixes