FAILED: patch "[PATCH] PCI: hv: Fix a memory leak in hv_eject_device_work()" failed to apply to 4.14-stable tree

PATCH [email protected] 3 participants 4 messages May 15, 2019 – May 17, 2019

Subsystems (4)

Stable branch PCI PCI native host bridge and endpoint drivers Hyper-V/Azure core and drivers

lore

Share & tools

lore

[email protected]

author maintainer

2019-05-15 08:34 UTC #0 lore raw

The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 05f151a73ec2b23ffbff706e5203e729a995cdc2 Mon Sep 17 00:00:00 2001
From: Dexuan Cui <[email protected]>
Date: Mon, 4 Mar 2019 21:34:48 +0000
Subject: [PATCH] PCI: hv: Fix a memory leak in hv_eject_device_work()

When a device is created in new_pcichild_device(), hpdev->refs is set to 2 (i.e. the initial value of 1 plus the get_pcichild()).

When we hot remove the device from the host, in a Linux VM we first call hv_pci_eject_device(), which increases hpdev->refs by get_pcichild() and then schedules a work of hv_eject_device_work(), so hpdev->refs becomes 3 (let's ignore the paired get/put_pcichild() in other places). But in hv_eject_device_work(), currently we only call put_pcichild() twice, meaning the 'hpdev' struct can't be freed in put_pcichild().

Add one put_pcichild() to fix the memory leak.

The device can also be removed when we run "rmmod pci-hyperv". On this path (hv_pci_remove() -> hv_pci_bus_exit() -> hv_pci_devices_present()), hpdev->refs is 2, and we do correctly call put_pcichild() twice in pci_devices_present_work().

Fixes 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft Hyper-V VMs")

Signed-off-by Dexuan Cui <[email protected]>

[[email protected]: commit log rework]

Signed-off-by Lorenzo Pieralisi <[email protected]>

Reviewed-by Stephen Hemminger <[email protected]>

Reviewed-by Michael Kelley <[email protected]>

Cc [email protected]

drivers/pci/controller/pci-hyperv.c +3 -0

index 95441a35eceb..30f16b882746 100644
@@ -1900,6 +1900,9 @@ static void hv_eject_device_work(struct work_struct *work)
 			 sizeof(*ejct_pkt), (unsigned long)&ctxt.pkt,
 			 VM_PKT_DATA_INBAND, 0);
 
+	/* For the get_pcichild() in hv_pci_eject_device() */
+	put_pcichild(hpdev);
+	/* For the two refs got in new_pcichild_device() */
 	put_pcichild(hpdev);
 	put_pcichild(hpdev);
 	put_hvpcibus(hpdev->hbus);

Dexuan Cui

maintainer

2019-05-15 23:24 UTC #1 lore raw

Quoted 67 lines

From: [email protected] <[email protected]>
Sent: Wednesday, May 15, 2019 1:35 AM
To: Dexuan Cui <[email protected]>; [email protected]; Michael Kelley <[email protected]>; [email protected]
Cc: [email protected]
Subject: FAILED: patch "[PATCH] PCI: hv: Fix a memory leak in hv_eject_device_work()" failed to apply to 4.14-stable tree
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 05f151a73ec2b23ffbff706e5203e729a995cdc2 Mon Sep 17 00:00:00 2001
From: Dexuan Cui <[email protected]>
Date: Mon, 4 Mar 2019 21:34:48 +0000
Subject: [PATCH] PCI: hv: Fix a memory leak in hv_eject_device_work()
When a device is created in new_pcichild_device(), hpdev->refs is set to 2 (i.e. the initial value of 1 plus the get_pcichild()).
When we hot remove the device from the host, in a Linux VM we first call hv_pci_eject_device(), which increases hpdev->refs by get_pcichild() and then schedules a work of hv_eject_device_work(), so hpdev->refs becomes 3 (let's ignore the paired get/put_pcichild() in other places). But in hv_eject_device_work(), currently we only call put_pcichild() twice, meaning the 'hpdev' struct can't be freed in put_pcichild().
Add one put_pcichild() to fix the memory leak.
The device can also be removed when we run "rmmod pci-hyperv". On this path (hv_pci_remove() -> hv_pci_bus_exit() -> hv_pci_devices_present()), hpdev->refs is 2, and we do correctly call put_pcichild() twice in pci_devices_present_work().
Fixes 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft
Hyper-V VMs")
Signed-off-by Dexuan Cui <[email protected]>
[[email protected]: commit log rework]
Signed-off-by Lorenzo Pieralisi <[email protected]>
Reviewed-by Stephen Hemminger <[email protected]>
Reviewed-by Michael Kelley <[email protected]>
Cc [email protected]
drivers/pci/controller/pci-hyperv.c +3 -0
index 95441a35eceb..30f16b882746 100644
@@ -1900,6 +1900,9 @@ static void hv_eject_device_work(struct work_struct
 *work)
 			 sizeof(*ejct_pkt), (unsigned long)&ctxt.pkt,
 			 VM_PKT_DATA_INBAND, 0);
 
+	/* For the get_pcichild() in hv_pci_eject_device() */
+	put_pcichild(hpdev);
+	/* For the two refs got in new_pcichild_device() */
 	put_pcichild(hpdev);
 	put_pcichild(hpdev);

Quoted 1 line

put_hvpcibus(hpdev->hbus);

Hi,
I backported the patch for linux-4.14.y.

Please use the attached patch, which is [PATCH 1/3]

Thanks,
-- Dexuan

From 16cce286be5af8e3d59c9afb74a494493254dcd3 Mon Sep 17 00:00:00 2001
From: Dexuan Cui <[email protected]>
Date: Wed, 15 May 2019 15:42:07 -0700
Subject: [PATCH for v4.14.119 1/3] PCI: hv: Fix a memory leak in
hv_eject_device_work()

This patch is backported for v4.14.119 from the mainline
commit 05f151a73ec2 ("PCI: hv: Fix a memory leak in hv_eject_device_work()")

Signed-off-by Dexuan Cui <[email protected]>

---
 drivers/pci/host/pci-hyperv.c | 1 +
 1 file changed, 1 insertion(+)

drivers/pci/host/pci-hyperv.c +1 -0

index 53d1c08cef4d..292450c7da62 100644
@@ -1941,6 +1941,7 @@ static void hv_eject_device_work(struct work_struct *work)
 			 VM_PKT_DATA_INBAND, 0);
 
 	put_pcichild(hpdev, hv_pcidev_ref_childlist);
+	put_pcichild(hpdev, hv_pcidev_ref_initial);
 	put_pcichild(hpdev, hv_pcidev_ref_pnp);
 	put_hvpcibus(hpdev->hbus);
 }

Signature · 1 line

2.17.1

Sasha Levin

maintainer

2019-05-17 00:41 UTC #2 lore raw

Quoted 4 lines · Dexuan Cui

Hi,
I backported the patch for linux-4.14.y.
Please use the attached patch, which is [PATCH 1/3]

Hi Dexuan,

For future reference, please keep the commit message in the backported patch same as the upstream one, unless you want to add additional information about the backport, in which case just add it to the commit message rather than replacing it.

I've cleaned up the commit message and queued it up for 4.14, thank you.

--
Thanks,
Sasha

Dexuan Cui

maintainer

2019-05-17 00:58 UTC #3 lore raw

Quoted 10 lines

From: Sasha Levin <[email protected]>
Sent: Thursday, May 16, 2019 5:42 PM
Quoted 4 lines · Dexuan Cui
Hi,
I backported the patch for linux-4.14.y.
Please use the attached patch, which is [PATCH 1/3]
Hi Dexuan,

Quoted 8 lines

For future reference, please keep the commit message in the backported patch same as the upstream one, unless you want to add additional information about the backport, in which case just add it to the commit message rather than replacing it.
I've cleaned up the commit message and queued it up for 4.14, thank you.
Sasha

Thanks, Sasha!

I thought only using the concise one-line commit info would be better . :-)

I'll follow the rule in the future.

-- Dexuan