[v1] riscv: kvm: fix vector context allocation leak

[PATCH] riscv: kvm: fix vector context allocation leak

Posted by Osama Abdelkader 3 weeks, 2 days ago

When the second kzalloc (host_context.vector.datap) fails in
kvm_riscv_vcpu_alloc_vector_context, the first allocation
(guest_context.vector.datap) is leaked. Free it before returning.

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
---
 arch/riscv/kvm/vcpu_vector.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/kvm/vcpu_vector.c b/arch/riscv/kvm/vcpu_vector.c
index 05f3cc2d8e31..5b6ad82d47be 100644
--- a/arch/riscv/kvm/vcpu_vector.c
+++ b/arch/riscv/kvm/vcpu_vector.c
@@ -80,8 +80,11 @@ int kvm_riscv_vcpu_alloc_vector_context(struct kvm_vcpu *vcpu)
 		return -ENOMEM;
 
 	vcpu->arch.host_context.vector.datap = kzalloc(riscv_v_vsize, GFP_KERNEL);
-	if (!vcpu->arch.host_context.vector.datap)
+	if (!vcpu->arch.host_context.vector.datap) {
+		kfree(vcpu->arch.guest_context.vector.datap);
+		vcpu->arch.guest_context.vector.datap = NULL;
 		return -ENOMEM;
+	}
 
 	return 0;
 }
-- 
2.43.0

Re: [PATCH] riscv: kvm: fix vector context allocation leak

Posted by Markus Elfring 3 weeks ago

> When the second kzalloc (host_context.vector.datap) fails in
> kvm_riscv_vcpu_alloc_vector_context, the first allocation
> (guest_context.vector.datap) is leaked. Free it before returning.

Were any source code analysis tools involved here?


How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.0-rc4#n145

Regards,
Markus

Re: [PATCH] riscv: kvm: fix vector context allocation leak

Posted by Osama Abdelkader 3 weeks ago

On Mon, Mar 16, 2026 at 10:23:27AM +0100, Markus Elfring wrote:
> > When the second kzalloc (host_context.vector.datap) fails in
> > kvm_riscv_vcpu_alloc_vector_context, the first allocation
> > (guest_context.vector.datap) is leaked. Free it before returning.
> 
> Were any source code analysis tools involved here?
> 

No, there were found during manual review.

> 
> How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.0-rc4#n145
>

Done, I just sent v2, thank you.
 
> Regards,
> Markus

Best regards,
Osama

Re: riscv: kvm: fix vector context allocation leak

Posted by Markus Elfring 3 weeks ago

>>> When the second kzalloc (host_context.vector.datap) fails in
>>> kvm_riscv_vcpu_alloc_vector_context, the first allocation
>>> (guest_context.vector.datap) is leaked. Free it before returning.
>> Were any source code analysis tools involved here?
>>
> No, there were found during manual review.

Would be looking for the support of advanced approaches
which would make such a “inspection” more convenient?

Regards,
Markus