linux-kernel - Re: [PATCH v2 1/1] iommu/amd: Fix memory leak in alloc_pci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 25 Apr 2024 11:52:36 +0100
From: Robin Murphy <robin.murphy@....com>
To: "Kun(llfl)" <llfl@...ux.alibaba.com>, Joerg Roedel <joro@...tes.org>,
 Vasant Hegde <vasant.hegde@....com>
Cc: Suravee Suthikulpanit <suravee.suthikulpanit@....com>,
 Will Deacon <will@...nel.org>, iommu@...ts.linux.dev,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 1/1] iommu/amd: Fix memory leak in alloc_pci_segment()

On 25/04/2024 11:17 am, Kun(llfl) wrote:
> Fix the memory leak issue that occurs when resource allocation fails in
> alloc_pci_segment(). The dev_table, alias_table, and rlookup_table were
> introduced individually in three commits. But they all fail to release
> allocated resources when other allocations fail.

As far as I can tell the returned error should end up being handled in 
state_next(), which *will* then clean these up again, at least in the 
!irq_remapping_enabled path. If there's any cleanup missing from the 
other path, then I think it should be fixed there, since it may well 
represent more than just these particular allocations.

Thanks,
Robin.

> Fixes: 04230c119930 ("iommu/amd: Introduce per PCI segment device table")
> Fixes: 99fc4ac3d297 ("iommu/amd: Introduce per PCI segment alias_table"),
> Fixes: eda797a27795 ("iommu/amd: Introduce per PCI segment rlookup table").
> Reported-by: Xuchun Shang <xuchun.shang@...ux.alibaba.com>
> Signed-off-by: Kun(llfl) <llfl@...ux.alibaba.com>
> ---
>   drivers/iommu/amd/init.c | 15 ++++++++++++---
>   1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
> index ac6754a85f35..4ce567f39473 100644
> --- a/drivers/iommu/amd/init.c
> +++ b/drivers/iommu/amd/init.c
> @@ -1642,13 +1642,22 @@ static struct amd_iommu_pci_seg *__init alloc_pci_segment(u16 id,
>   	list_add_tail(&pci_seg->list, &amd_iommu_pci_seg_list);
>   
>   	if (alloc_dev_table(pci_seg))
> -		return NULL;
> +		goto alloc_dev_fail;
>   	if (alloc_alias_table(pci_seg))
> -		return NULL;
> +		goto alloc_alias_fail;
>   	if (alloc_rlookup_table(pci_seg))
> -		return NULL;
> +		goto alloc_rlookup_fail;
>   
>   	return pci_seg;
> +
> +alloc_rlookup_fail:
> +	free_rlookup_table(pci_seg);
> +alloc_alias_fail:
> +	free_alias_table(pci_seg);
> +alloc_dev_fail:
> +	free_dev_table(pci_seg);
> +	kfree(pci_seg);
> +	return NULL;
>   }
>   
>   static struct amd_iommu_pci_seg *__init get_pci_segment(u16 id,