Patch-mainline: v6.2-rc1

Git-commit: 69143f60868b3939ddc89289b29db593b647295e

References: git-fixes

From: Xiu Jianfeng <xiujianfeng@huawei.com>

Date: Wed, 23 Nov 2022 23:58:57 +0800

Subject: [PATCH] x86/xen: Fix memory leak in xen_smp_intr_init{_pv}()

These local variables @{resched|pmu|callfunc...}_name saves the new

string allocated by kasprintf(), and when bind_{v}ipi_to_irqhandler()

fails, it goes to the @fail tag, and calls xen_smp_intr_free{_pv}() to

free resource, however the new string is not saved, which cause a memory

leak issue. fix it.

Fixes: 9702785a747a ("i386: move xen")

Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>

Reviewed-by: Juergen Gross <jgross@suse.com>

Link: https://lore.kernel.org/r/20221123155858.11382-2-xiujianfeng@huawei.com

Signed-off-by: Juergen Gross <jgross@suse.com>

---

 arch/x86/xen/smp.c    | 24 ++++++++++++------------

 arch/x86/xen/smp_pv.c | 12 ++++++------

 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c

index c3e1f9a7d43a..4b0d6fff88de 100644

--- a/arch/x86/xen/smp.c

+++ b/arch/x86/xen/smp.c

@@ -32,30 +32,30 @@ static irqreturn_t xen_reschedule_interrupt(int irq, void *dev_id)

 void xen_smp_intr_free(unsigned int cpu)

 {

+	kfree(per_cpu(xen_resched_irq, cpu).name);

+	per_cpu(xen_resched_irq, cpu).name = NULL;

 	if (per_cpu(xen_resched_irq, cpu).irq >= 0) {

 		unbind_from_irqhandler(per_cpu(xen_resched_irq, cpu).irq, NULL);

 		per_cpu(xen_resched_irq, cpu).irq = -1;

-		kfree(per_cpu(xen_resched_irq, cpu).name);

-		per_cpu(xen_resched_irq, cpu).name = NULL;

 	}

+	kfree(per_cpu(xen_callfunc_irq, cpu).name);

+	per_cpu(xen_callfunc_irq, cpu).name = NULL;

 	if (per_cpu(xen_callfunc_irq, cpu).irq >= 0) {

 		unbind_from_irqhandler(per_cpu(xen_callfunc_irq, cpu).irq, NULL);

 		per_cpu(xen_callfunc_irq, cpu).irq = -1;

-		kfree(per_cpu(xen_callfunc_irq, cpu).name);

-		per_cpu(xen_callfunc_irq, cpu).name = NULL;

 	}

+	kfree(per_cpu(xen_debug_irq, cpu).name);

+	per_cpu(xen_debug_irq, cpu).name = NULL;

 	if (per_cpu(xen_debug_irq, cpu).irq >= 0) {

 		unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu).irq, NULL);

 		per_cpu(xen_debug_irq, cpu).irq = -1;

-		kfree(per_cpu(xen_debug_irq, cpu).name);

-		per_cpu(xen_debug_irq, cpu).name = NULL;

 	}

+	kfree(per_cpu(xen_callfuncsingle_irq, cpu).name);

+	per_cpu(xen_callfuncsingle_irq, cpu).name = NULL;

 	if (per_cpu(xen_callfuncsingle_irq, cpu).irq >= 0) {

 		unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu).irq,

 				       NULL);

 		per_cpu(xen_callfuncsingle_irq, cpu).irq = -1;

-		kfree(per_cpu(xen_callfuncsingle_irq, cpu).name);

-		per_cpu(xen_callfuncsingle_irq, cpu).name = NULL;

 	}

 }

@@ -65,6 +65,7 @@ int xen_smp_intr_init(unsigned int cpu)

 	char *resched_name, *callfunc_name, *debug_name;

 	resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu);

+	per_cpu(xen_resched_irq, cpu).name = resched_name;

 	rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR,

 				    cpu,

 				    xen_reschedule_interrupt,

@@ -74,9 +75,9 @@ int xen_smp_intr_init(unsigned int cpu)

 	if (rc < 0)

 		goto fail;

 	per_cpu(xen_resched_irq, cpu).irq = rc;

-	per_cpu(xen_resched_irq, cpu).name = resched_name;

 	callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu);

+	per_cpu(xen_callfunc_irq, cpu).name = callfunc_name;

 	rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR,

 				    cpu,

 				    xen_call_function_interrupt,

@@ -86,10 +87,10 @@ int xen_smp_intr_init(unsigned int cpu)

 	if (rc < 0)

 		goto fail;

 	per_cpu(xen_callfunc_irq, cpu).irq = rc;

-	per_cpu(xen_callfunc_irq, cpu).name = callfunc_name;

 	if (!xen_fifo_events) {

 		debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu);

+		per_cpu(xen_debug_irq, cpu).name = debug_name;

 		rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu,

 					     xen_debug_interrupt,

 					     IRQF_PERCPU | IRQF_NOBALANCING,

@@ -97,10 +98,10 @@ int xen_smp_intr_init(unsigned int cpu)

 		if (rc < 0)

 			goto fail;

 		per_cpu(xen_debug_irq, cpu).irq = rc;

-		per_cpu(xen_debug_irq, cpu).name = debug_name;

 	}

 	callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu);

+	per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name;

 	rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR,

 				    cpu,

 				    xen_call_function_single_interrupt,

@@ -110,7 +111,6 @@ int xen_smp_intr_init(unsigned int cpu)

 	if (rc < 0)

 		goto fail;

 	per_cpu(xen_callfuncsingle_irq, cpu).irq = rc;

-	per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name;

 	return 0;

diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c

index 480be82e9b7b..6175f2c5c822 100644

--- a/arch/x86/xen/smp_pv.c

+++ b/arch/x86/xen/smp_pv.c

@@ -97,18 +97,18 @@ asmlinkage __visible void cpu_bringup_and_idle(void)

 void xen_smp_intr_free_pv(unsigned int cpu)

 {

+	kfree(per_cpu(xen_irq_work, cpu).name);

+	per_cpu(xen_irq_work, cpu).name = NULL;

 	if (per_cpu(xen_irq_work, cpu).irq >= 0) {

 		unbind_from_irqhandler(per_cpu(xen_irq_work, cpu).irq, NULL);

 		per_cpu(xen_irq_work, cpu).irq = -1;

-		kfree(per_cpu(xen_irq_work, cpu).name);

-		per_cpu(xen_irq_work, cpu).name = NULL;

 	}

+	kfree(per_cpu(xen_pmu_irq, cpu).name);

+	per_cpu(xen_pmu_irq, cpu).name = NULL;

 	if (per_cpu(xen_pmu_irq, cpu).irq >= 0) {

 		unbind_from_irqhandler(per_cpu(xen_pmu_irq, cpu).irq, NULL);

 		per_cpu(xen_pmu_irq, cpu).irq = -1;

-		kfree(per_cpu(xen_pmu_irq, cpu).name);

-		per_cpu(xen_pmu_irq, cpu).name = NULL;

 	}

 }

@@ -118,6 +118,7 @@ int xen_smp_intr_init_pv(unsigned int cpu)

 	char *callfunc_name, *pmu_name;

 	callfunc_name = kasprintf(GFP_KERNEL, "irqwork%d", cpu);

+	per_cpu(xen_irq_work, cpu).name = callfunc_name;

 	rc = bind_ipi_to_irqhandler(XEN_IRQ_WORK_VECTOR,

 				    cpu,

 				    xen_irq_work_interrupt,

@@ -127,10 +128,10 @@ int xen_smp_intr_init_pv(unsigned int cpu)

 	if (rc < 0)

 		goto fail;

 	per_cpu(xen_irq_work, cpu).irq = rc;

-	per_cpu(xen_irq_work, cpu).name = callfunc_name;

 	if (is_xen_pmu) {

 		pmu_name = kasprintf(GFP_KERNEL, "pmu%d", cpu);

+		per_cpu(xen_pmu_irq, cpu).name = pmu_name;

 		rc = bind_virq_to_irqhandler(VIRQ_XENPMU, cpu,

 					     xen_pmu_irq_handler,

 					     IRQF_PERCPU|IRQF_NOBALANCING,

@@ -138,7 +139,6 @@ int xen_smp_intr_init_pv(unsigned int cpu)

 		if (rc < 0)

 			goto fail;

 		per_cpu(xen_pmu_irq, cpu).irq = rc;

-		per_cpu(xen_pmu_irq, cpu).name = pmu_name;

 	}

 	return 0;

-- 

2.35.3