Messages in this thread Patch in this message | | | Date | Fri, 21 Oct 2022 03:55:18 -0400 | Subject | Re: [PATCH 00/11] fix memory leak while kset_register() fails | From | Luben Tuikov <> |
| |
On 2022-10-21 01:37, Greg KH wrote: > On Fri, Oct 21, 2022 at 01:29:31AM -0400, Luben Tuikov wrote: >> On 2022-10-20 22:20, Yang Yingliang wrote: >>> The previous discussion link: >>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flore.kernel.org%2Flkml%2F0db486eb-6927-927e-3629-958f8f211194%40huawei.com%2FT%2F&data=05%7C01%7Cluben.tuikov%40amd.com%7C65b33f087ef245a9f23708dab3264840%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C638019274318153227%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=1ZoieEob62iU9kI8fvpp20qGut9EeHKIHtCAT01t%2Bz8%3D&reserved=0 >> >> The very first discussion on this was here: >> >> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.spinics.net%2Flists%2Fdri-devel%2Fmsg368077.html&data=05%7C01%7Cluben.tuikov%40amd.com%7C65b33f087ef245a9f23708dab3264840%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C638019274318153227%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=9joWxGLUxZZMvrfkxCR8KbkoXifsqoMK0vGR%2FyEG62w%3D&reserved=0 >> >> Please use this link, and not the that one up there you which quoted above, >> and whose commit description is taken verbatim from the this link. >> >>> >>> kset_register() is currently used in some places without calling >>> kset_put() in error path, because the callers think it should be >>> kset internal thing to do, but the driver core can not know what >>> caller doing with that memory at times. The memory could be freed >>> both in kset_put() and error path of caller, if it is called in >>> kset_register(). >> >> As I explained in the link above, the reason there's >> a memory leak is that one cannot call kset_register() without >> the kset->kobj.name being set--kobj_add_internal() returns -EINVAL, >> in this case, i.e. kset_register() fails with -EINVAL. >> >> Thus, the most common usage is something like this: >> >> kobj_set_name(&kset->kobj, format, ...); >> kset->kobj.kset = parent_kset; >> kset->kobj.ktype = ktype; >> res = kset_register(kset); >> >> So, what is being leaked, is the memory allocated in kobj_set_name(), >> by the common idiom shown above. This needs to be mentioned in >> the documentation, at least, in case, in the future this is absolved >> in kset_register() redesign, etc. > > Based on this, can kset_register() just clean up from itself when an > error happens? Ideally that would be the case, as the odds of a kset > being embedded in a larger structure is probably slim, but we would have > to search the tree to make sure.
Looking at kset_register(), we can add kset_put() in the error path, when kobject_add_internal(&kset->kobj) fails.
See the attached patch. It needs to be tested with the same error injection as Yang has been doing.
Now, struct kset is being embedded in larger structs--see amdgpu_discovery.c starting at line 575. If you're on an AMD system, it gets you the tree structure you'll see when you run "tree /sys/class/drm/card0/device/ip_discovery/". That shouldn't be a problem though.
Regards, LubenFrom 71e0a22801c0699f67ea40ed96e0a7d7d9e0f318 Mon Sep 17 00:00:00 2001 From: Luben Tuikov <luben.tuikov@amd.com> Date: Fri, 21 Oct 2022 03:34:21 -0400 Subject: [PATCH] kobject: Add kset_put() if kset_register() fails X-check-string-leak: v1.0
If kset_register() fails, we call kset_put() before returning the error. This makes sure that we free memory allocated by kobj_set_name() for the kset, since kset_register() cannot be called unless the kset has a name, usually gotten via kobj_set_name(&kset->kobj, format, ...);
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Rafael J. Wysocki <rafael@kernel.org> Cc: Yang Yingliang <yangyingliang@huawei.com> Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org> Signed-off-by: Luben Tuikov <luben.tuikov@amd.com> --- lib/kobject.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/kobject.c b/lib/kobject.c index a0b2dbfcfa2334..c122b979f2b75e 100644 --- a/lib/kobject.c +++ b/lib/kobject.c @@ -844,8 +844,10 @@ int kset_register(struct kset *k) kset_init(k); err = kobject_add_internal(&k->kobj); - if (err) + if (err) { + kset_put(k); return err; + } kobject_uevent(&k->kobj, KOBJ_ADD); return 0; } -- 2.38.0-rc2
| |