From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932103AbcGOCV4 (ORCPT ); Thu, 14 Jul 2016 22:21:56 -0400 Received: from mga03.intel.com ([134.134.136.65]:5070 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932079AbcGOCVz (ORCPT ); Thu, 14 Jul 2016 22:21:55 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.28,365,1464678000"; d="scan'208";a="1017237922" Date: Fri, 15 Jul 2016 10:22:04 +0800 From: Liu Shuo To: Al Viro Cc: Paolo Bonzini , linux-kernel@vger.kernel.org, kvm@vger.kernel.org, Zhang Yanmin , He Bo , Liu Shuo , Radim =?utf-8?B?S3LEjW3DocWZ?= Subject: Re: [PATCH] KVM: release anon file in failure path of vm creation Message-ID: <20160715022204.GA16729@shuo-desktop.sh.intel.com> References: <1468316323-23835-1-git-send-email-shuo.a.liu@intel.com> <28049c2a-1b49-1909-52ce-105859e14e33@redhat.com> <20160714164647.GD14480@ZenIV.linux.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <20160714164647.GD14480@ZenIV.linux.org.uk> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu 14.Jul'16 at 17:46:47 +0100, Al Viro wrote: >On Tue, Jul 12, 2016 at 12:24:39PM +0200, Paolo Bonzini wrote: > >> On 12/07/2016 11:38, Liu Shuo wrote: >> > The failure of create debugfs of VM will return directly without release >> > the anon file. It will leak memory and file descriptors, even through >> > be not serious. >> > >> > Signed-off-by: Liu Shuo > >This is broken. > >> > @@ -3067,6 +3068,7 @@ static int kvm_dev_ioctl_create_vm(unsigned long type) >> > >> > if (kvm_create_vm_debugfs(kvm, r) < 0) { >> > kvm_put_kvm(kvm); >> > + sys_close(r); > >You have no warranty whatsoever that descriptor table has not been changed >by that point. You should *NEVER* use sys_close() on failure exit paths Could you please elaborate why we're not sure descriptor table's changing at the point? >like that. Moreover, this kvm_put_kvm() becomes a double-put, since >closing the damn file will drop that reference to kvm. You're right. Thanks for the correction on this point. > >> > return -ENOMEM; >> > } >> > >> > >> >> Thanks, applied to kvm/master. > >Please, revert. anon_inode_getfd() should be used only when there's no >possible failures past its call. What you need in this case (due to fucking >ugly API - decriptor number used as part of debugfs pathname) is something >like this (against mainline): > >[kvm] don't use anon_inode_getfd() before possible failures > >Once anon_inode_getfd() has succeeded, it's impossible to undo in a clean >way and no, sys_close() is not usable in such cases. Use anon_inode_getfile() >and get_unused_fd_flags() to get struct file and descriptor and do *not* >install the file into descriptor table until after the last possible failure >exit. > >Signed-off-by: Al Viro Thanks. It's better. >--- >diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c >index 48bd520..7f82c6c 100644 >--- a/virt/kvm/kvm_main.c >+++ b/virt/kvm/kvm_main.c >@@ -3048,6 +3048,7 @@ static int kvm_dev_ioctl_create_vm(unsigned long type) > { > int r; > struct kvm *kvm; >+ struct file *file; > > kvm = kvm_create_vm(type); > if (IS_ERR(kvm)) >@@ -3059,17 +3060,25 @@ static int kvm_dev_ioctl_create_vm(unsigned long type) > return r; > } > #endif >- r = anon_inode_getfd("kvm-vm", &kvm_vm_fops, kvm, O_RDWR | O_CLOEXEC); >+ r = get_unused_fd_flags(O_CLOEXEC); > if (r < 0) { > kvm_put_kvm(kvm); > return r; > } >+ file = anon_inode_getfile("kvm-vm", &kvm_vm_fops, kvm, O_RDWR); >+ if (IS_ERR(file)) { >+ put_unused_fd(r); >+ kvm_put_kvm(kvm); >+ return PTR_ERR(file); >+ } > > if (kvm_create_vm_debugfs(kvm, r) < 0) { >- kvm_put_kvm(kvm); >+ put_unused_fd(r); >+ fput(file); > return -ENOMEM; > } > >+ fd_install(r, file); > return r; > } >