RE: [PATCH really v2] KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce()

On 24.08.2017 11:14, Paul Mackerras wrote:

Nixiaoming pointed out that there is a memory leak in
kvm_vm_ioctl_create_spapr_tce() if the call to anon_inode_getfd()=20
fails; the memory allocated for the kvmppc_spapr_tce_table struct is=20
not freed, and nor are the pages allocated for the iommu tables.  In=20
addition, we have already incremented the process's count of locked=20
memory pages, and this doesn't get restored on error.
=20
David Hildenbrand pointed out that there is a race in that the=20
function checks early on that there is not already an entry in the
stt->iommu_tables list with the same LIOBN, but an entry with the
same LIOBN could get added between then and when the new entry is=20
added to the list.
=20
This fixes all three problems.  To simplify things, we now call
anon_inode_getfd() before placing the new entry in the list.  The=20
check for an existing entry is done while holding the kvm->lock mutex,=20
immediately before adding the new entry to the list.
Finally, on failure we now call kvmppc_account_memlimit to decrement=20
the process's count of locked memory pages.
=20
Reported-by: Nixiaoming <redacted>
Reported-by: David Hildenbrand <redacted>
Signed-off-by: Paul Mackerras <redacted>
---
v2: Don't overwrite stt in loop over spapr_tce_tables
=20

Reviewed-by: nixiaoming  <redacted>