Drivers: hv: utils: fix memory leak on on_msg() failure
[deliverable/linux.git] / drivers / hv / hv_utils_transport.c
CommitLineData
14b50f80
VK
1/*
2 * Kernel/userspace transport abstraction for Hyper-V util driver.
3 *
4 * Copyright (C) 2015, Vitaly Kuznetsov <vkuznets@redhat.com>
5 *
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License version 2 as published
8 * by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
13 * NON INFRINGEMENT. See the GNU General Public License for more
14 * details.
15 *
16 */
17
18#include <linux/slab.h>
19#include <linux/fs.h>
20#include <linux/poll.h>
21
22#include "hyperv_vmbus.h"
23#include "hv_utils_transport.h"
24
25static DEFINE_SPINLOCK(hvt_list_lock);
26static struct list_head hvt_list = LIST_HEAD_INIT(hvt_list);
27
28static void hvt_reset(struct hvutil_transport *hvt)
29{
30 mutex_lock(&hvt->outmsg_lock);
31 kfree(hvt->outmsg);
32 hvt->outmsg = NULL;
33 hvt->outmsg_len = 0;
34 mutex_unlock(&hvt->outmsg_lock);
35 if (hvt->on_reset)
36 hvt->on_reset();
37}
38
39static ssize_t hvt_op_read(struct file *file, char __user *buf,
40 size_t count, loff_t *ppos)
41{
42 struct hvutil_transport *hvt;
43 int ret;
44
45 hvt = container_of(file->f_op, struct hvutil_transport, fops);
46
47 if (wait_event_interruptible(hvt->outmsg_q, hvt->outmsg_len > 0))
48 return -EINTR;
49
50 mutex_lock(&hvt->outmsg_lock);
51 if (!hvt->outmsg) {
52 ret = -EAGAIN;
53 goto out_unlock;
54 }
55
56 if (count < hvt->outmsg_len) {
57 ret = -EINVAL;
58 goto out_unlock;
59 }
60
61 if (!copy_to_user(buf, hvt->outmsg, hvt->outmsg_len))
62 ret = hvt->outmsg_len;
63 else
64 ret = -EFAULT;
65
66 kfree(hvt->outmsg);
67 hvt->outmsg = NULL;
68 hvt->outmsg_len = 0;
69
70out_unlock:
71 mutex_unlock(&hvt->outmsg_lock);
72 return ret;
73}
74
75static ssize_t hvt_op_write(struct file *file, const char __user *buf,
76 size_t count, loff_t *ppos)
77{
78 struct hvutil_transport *hvt;
79 u8 *inmsg;
1f75338b 80 int ret;
14b50f80
VK
81
82 hvt = container_of(file->f_op, struct hvutil_transport, fops);
83
b0035964
OH
84 inmsg = memdup_user(buf, count);
85 if (IS_ERR(inmsg))
86 return PTR_ERR(inmsg);
87
1f75338b
VK
88 ret = hvt->on_msg(inmsg, count);
89
14b50f80
VK
90 kfree(inmsg);
91
1f75338b 92 return ret ? ret : count;
14b50f80
VK
93}
94
95static unsigned int hvt_op_poll(struct file *file, poll_table *wait)
96{
97 struct hvutil_transport *hvt;
98
99 hvt = container_of(file->f_op, struct hvutil_transport, fops);
100
101 poll_wait(file, &hvt->outmsg_q, wait);
102 if (hvt->outmsg_len > 0)
103 return POLLIN | POLLRDNORM;
104
105 return 0;
106}
107
108static int hvt_op_open(struct inode *inode, struct file *file)
109{
110 struct hvutil_transport *hvt;
111
112 hvt = container_of(file->f_op, struct hvutil_transport, fops);
113
114 /*
115 * Switching to CHARDEV mode. We switch bach to INIT when device
116 * gets released.
117 */
118 if (hvt->mode == HVUTIL_TRANSPORT_INIT)
119 hvt->mode = HVUTIL_TRANSPORT_CHARDEV;
120 else if (hvt->mode == HVUTIL_TRANSPORT_NETLINK) {
121 /*
122 * We're switching from netlink communication to using char
123 * device. Issue the reset first.
124 */
125 hvt_reset(hvt);
126 hvt->mode = HVUTIL_TRANSPORT_CHARDEV;
127 } else
128 return -EBUSY;
129
130 return 0;
131}
132
133static int hvt_op_release(struct inode *inode, struct file *file)
134{
135 struct hvutil_transport *hvt;
136
137 hvt = container_of(file->f_op, struct hvutil_transport, fops);
138
139 hvt->mode = HVUTIL_TRANSPORT_INIT;
140 /*
141 * Cleanup message buffers to avoid spurious messages when the daemon
142 * connects back.
143 */
144 hvt_reset(hvt);
145
146 return 0;
147}
148
149static void hvt_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
150{
151 struct hvutil_transport *hvt, *hvt_found = NULL;
152
153 spin_lock(&hvt_list_lock);
154 list_for_each_entry(hvt, &hvt_list, list) {
155 if (hvt->cn_id.idx == msg->id.idx &&
156 hvt->cn_id.val == msg->id.val) {
157 hvt_found = hvt;
158 break;
159 }
160 }
161 spin_unlock(&hvt_list_lock);
162 if (!hvt_found) {
163 pr_warn("hvt_cn_callback: spurious message received!\n");
164 return;
165 }
166
167 /*
168 * Switching to NETLINK mode. Switching to CHARDEV happens when someone
169 * opens the device.
170 */
171 if (hvt->mode == HVUTIL_TRANSPORT_INIT)
172 hvt->mode = HVUTIL_TRANSPORT_NETLINK;
173
174 if (hvt->mode == HVUTIL_TRANSPORT_NETLINK)
175 hvt_found->on_msg(msg->data, msg->len);
176 else
177 pr_warn("hvt_cn_callback: unexpected netlink message!\n");
178}
179
180int hvutil_transport_send(struct hvutil_transport *hvt, void *msg, int len)
181{
182 struct cn_msg *cn_msg;
183 int ret = 0;
184
185 if (hvt->mode == HVUTIL_TRANSPORT_INIT) {
186 return -EINVAL;
187 } else if (hvt->mode == HVUTIL_TRANSPORT_NETLINK) {
188 cn_msg = kzalloc(sizeof(*cn_msg) + len, GFP_ATOMIC);
9dd6a064 189 if (!cn_msg)
14b50f80
VK
190 return -ENOMEM;
191 cn_msg->id.idx = hvt->cn_id.idx;
192 cn_msg->id.val = hvt->cn_id.val;
193 cn_msg->len = len;
194 memcpy(cn_msg->data, msg, len);
195 ret = cn_netlink_send(cn_msg, 0, 0, GFP_ATOMIC);
196 kfree(cn_msg);
197 return ret;
198 }
199 /* HVUTIL_TRANSPORT_CHARDEV */
200 mutex_lock(&hvt->outmsg_lock);
201 if (hvt->outmsg) {
202 /* Previous message wasn't received */
203 ret = -EFAULT;
204 goto out_unlock;
205 }
206 hvt->outmsg = kzalloc(len, GFP_KERNEL);
cdc0c0c9
OH
207 if (hvt->outmsg) {
208 memcpy(hvt->outmsg, msg, len);
209 hvt->outmsg_len = len;
210 wake_up_interruptible(&hvt->outmsg_q);
211 } else
212 ret = -ENOMEM;
14b50f80
VK
213out_unlock:
214 mutex_unlock(&hvt->outmsg_lock);
215 return ret;
216}
217
218struct hvutil_transport *hvutil_transport_init(const char *name,
219 u32 cn_idx, u32 cn_val,
220 int (*on_msg)(void *, int),
221 void (*on_reset)(void))
222{
223 struct hvutil_transport *hvt;
224
225 hvt = kzalloc(sizeof(*hvt), GFP_KERNEL);
226 if (!hvt)
227 return NULL;
228
229 hvt->cn_id.idx = cn_idx;
230 hvt->cn_id.val = cn_val;
231
232 hvt->mdev.minor = MISC_DYNAMIC_MINOR;
233 hvt->mdev.name = name;
234
235 hvt->fops.owner = THIS_MODULE;
236 hvt->fops.read = hvt_op_read;
237 hvt->fops.write = hvt_op_write;
238 hvt->fops.poll = hvt_op_poll;
239 hvt->fops.open = hvt_op_open;
240 hvt->fops.release = hvt_op_release;
241
242 hvt->mdev.fops = &hvt->fops;
243
244 init_waitqueue_head(&hvt->outmsg_q);
245 mutex_init(&hvt->outmsg_lock);
246
247 spin_lock(&hvt_list_lock);
248 list_add(&hvt->list, &hvt_list);
249 spin_unlock(&hvt_list_lock);
250
251 hvt->on_msg = on_msg;
252 hvt->on_reset = on_reset;
253
254 if (misc_register(&hvt->mdev))
255 goto err_free_hvt;
256
257 /* Use cn_id.idx/cn_id.val to determine if we need to setup netlink */
258 if (hvt->cn_id.idx > 0 && hvt->cn_id.val > 0 &&
259 cn_add_callback(&hvt->cn_id, name, hvt_cn_callback))
260 goto err_free_hvt;
261
262 return hvt;
263
264err_free_hvt:
265 kfree(hvt);
266 return NULL;
267}
268
269void hvutil_transport_destroy(struct hvutil_transport *hvt)
270{
271 spin_lock(&hvt_list_lock);
272 list_del(&hvt->list);
273 spin_unlock(&hvt_list_lock);
274 if (hvt->cn_id.idx > 0 && hvt->cn_id.val > 0)
275 cn_del_callback(&hvt->cn_id);
276 misc_deregister(&hvt->mdev);
277 kfree(hvt->outmsg);
278 kfree(hvt);
279}
This page took 0.058086 seconds and 5 git commands to generate.