linux-kernel - RE: [PATCH] Drivers: hv: vmbus: Call hv_synic_free() if hv_synic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 6 May 2023 00:29:56 +0000
From:   "Michael Kelley (LINUX)" <mikelley@...rosoft.com>
To:     Dexuan Cui <decui@...rosoft.com>,
        KY Srinivasan <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        "wei.liu@...nel.org" <wei.liu@...nel.org>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...nel.org" <stable@...nel.org>
Subject: RE: [PATCH] Drivers: hv: vmbus: Call hv_synic_free() if
 hv_synic_alloc() fails

From: Dexuan Cui <decui@...rosoft.com> Sent: Thursday, May 4, 2023 3:42 PM
> 
> Commit 572086325ce9 ("Drivers: hv: vmbus: Cleanup synic memory free path")
> says "Any memory allocations that succeeded will be freed when the caller
> cleans up by calling hv_synic_free()", but if the get_zeroed_page() in
> hv_synic_alloc() fails, currently hv_synic_free() is not really called
> in vmbus_bus_init(), consequently there will be a memory lead, e.g.

s/lead/leak/

> hv_context.hv_numa_map is not freed in the error path. Fix this by
> updating the goto lables.

s/lables/labels/

The statement in commit 572086325ce9 was true at the time of that
commit.  But I broke things in commit 4df4cb9e99f8.  Should add a
"Fixes:" tag for 4df4cb9e99f8.

> 
> Cc: stable@...nel.org
> Signed-off-by: Dexuan Cui <decui@...rosoft.com>
> ---
>  drivers/hv/vmbus_drv.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
> index 59eb5fad12e7..c41e6ad0cf64 100644
> --- a/drivers/hv/vmbus_drv.c
> +++ b/drivers/hv/vmbus_drv.c
> @@ -1525,7 +1525,7 @@ static int vmbus_bus_init(void)
>  	ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "hyperv/vmbus:online",
>  				hv_synic_init, hv_synic_cleanup);
>  	if (ret < 0)
> -		goto err_cpuhp;
> +		goto err_alloc;
>  	hyperv_cpuhp_online = ret;
> 
>  	ret = vmbus_connect();
> @@ -1577,9 +1577,8 @@ static int vmbus_bus_init(void)
> 
>  err_connect:
>  	cpuhp_remove_state(hyperv_cpuhp_online);
> -err_cpuhp:
> -	hv_synic_free();
>  err_alloc:
> +	hv_synic_free();
>  	if (vmbus_irq == -1) {
>  		hv_remove_vmbus_handler();
>  	} else {
> --
> 2.25.1

Nits notwithstanding,

Reviewed-by: Michael Kelley <mikelley@...rosoft.com>