xen/ioreq: drop the emulator reference when range set allocation fails

[PATCH] xen/ioreq: drop the emulator reference when range set allocation fails

Posted by Edgar E. Iglesias 3 weeks, 2 days ago

ioreq_server_init() takes a reference on the emulating domain before
allocating the server's range sets, but does not release it when that
allocation fails. The leaked reference prevents the emulating domain
from ever being fully destroyed.

Route this failure through the existing put_domain() cleanup.

Fixes: ccb42e0ca661 ("x86/hvm: take a reference on ioreq server emulating domain")
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
---
 xen/common/ioreq.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/common/ioreq.c b/xen/common/ioreq.c
index f5fd30ce12..4b321a5c61 100644
--- a/xen/common/ioreq.c
+++ b/xen/common/ioreq.c
@@ -595,7 +595,7 @@ static int ioreq_server_init(struct ioreq_server *s,
 
     rc = ioreq_server_alloc_rangesets(s, id);
     if ( rc )
-        return rc;
+        goto fail_rangesets;
 
     s->bufioreq_handling = bufioreq_handling;
 
@@ -614,6 +614,7 @@ static int ioreq_server_init(struct ioreq_server *s,
 
     ioreq_server_free_rangesets(s);
 
+ fail_rangesets:
     put_domain(s->emulator);
     return rc;
 }

base-commit: 24bd190cd99447ec634da6cb56590ccf44ad627d
-- 
2.47.3

Re: [PATCH] xen/ioreq: drop the emulator reference when range set allocation fails

Posted by Jan Beulich 3 weeks, 1 day ago

On 29.09.2026 19:08, Edgar E. Iglesias wrote:
> ioreq_server_init() takes a reference on the emulating domain before
> allocating the server's range sets, but does not release it when that
> allocation fails. The leaked reference prevents the emulating domain
> from ever being fully destroyed.
> 
> Route this failure through the existing put_domain() cleanup.
> 
> Fixes: ccb42e0ca661 ("x86/hvm: take a reference on ioreq server emulating domain")
> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>

Reviewed-by: Jan Beulich <jbeulich@suse.com>

Re: [PATCH] xen/ioreq: drop the emulator reference when range set allocation fails

Posted by Mykola Kvach 3 weeks, 2 days ago

Hi Edgar,

Thank you for the patch.

Reviewed-by: Mykola Kvach <mykola_kvach@epam.com>

Best regards,
Mykola

On Tue, Sep 29, 2026 at 8:57 PM Edgar E. Iglesias
<edgar.iglesias@amd.com> wrote:
>
> ioreq_server_init() takes a reference on the emulating domain before
> allocating the server's range sets, but does not release it when that
> allocation fails. The leaked reference prevents the emulating domain
> from ever being fully destroyed.
>
> Route this failure through the existing put_domain() cleanup.
>
> Fixes: ccb42e0ca661 ("x86/hvm: take a reference on ioreq server emulating domain")
> Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
> ---
>  xen/common/ioreq.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/xen/common/ioreq.c b/xen/common/ioreq.c
> index f5fd30ce12..4b321a5c61 100644
> --- a/xen/common/ioreq.c
> +++ b/xen/common/ioreq.c
> @@ -595,7 +595,7 @@ static int ioreq_server_init(struct ioreq_server *s,
>
>      rc = ioreq_server_alloc_rangesets(s, id);
>      if ( rc )
> -        return rc;
> +        goto fail_rangesets;
>
>      s->bufioreq_handling = bufioreq_handling;
>
> @@ -614,6 +614,7 @@ static int ioreq_server_init(struct ioreq_server *s,
>
>      ioreq_server_free_rangesets(s);
>
> + fail_rangesets:
>      put_domain(s->emulator);
>      return rc;
>  }
>
> base-commit: 24bd190cd99447ec634da6cb56590ccf44ad627d
> --
> 2.47.3
>
>