Messages in this thread | | | Date | Wed, 2 Nov 2022 16:46:27 +0900 | From | Hyeonggon Yoo <> | Subject | Re: [PATCH v2 0/3] Refactor __kmem_cache_create() and fix memory leak |
| |
On Mon, Oct 31, 2022 at 09:47:44PM +0800, Liu Shixin wrote: > I found a memory leak of kobj->name in sysfs_slab_add() which is introduced > by 80da026a8e5d ("mm/slub: fix slab double-free in case of duplicate sysfs filename"). > Following the rules stated in the comment for kobject_init_and_add():
Thank you for reporting this! Indeed it seems tried to fix double free but introduced a leak.
> If this function returns an error, kobject_put() must be called to > properly clean up the memory associated with the object. > > We should use kobject_put() to free kobject.
But what to do if a cache is created early and later sysfs_slab_add() failed? (Which is unlikely on normal condition)
With this series it introduces use-after-free if sysfs_slab_add() in slab_sysfs_init() failed. Should we just call BUG() or something like that?
> But we can't simply add kobject_put() since it will free kmem_cache too. > If we use kobject_put(), we need to skip other release functions. > > In this series, We refactor the code to separate sysfs_slab_add() and > debugfs_slab_add() from __kmem_cache_create(), and then use kobject_put() > to free kobject in sysfs_slab_add(). This can fix the memory leak of > kobject->name. > > v1->v2: Fix build error reported by kernel test robot <lkp@intel.com>. > > Liu Shixin (3): > mm/slab_common: Move cache_name to create_cache() > mm/slub: Refactor __kmem_cache_create() > mm/slub: Fix memory leak of kobj->name in sysfs_slab_add() > > include/linux/slub_def.h | 11 +++++++++ > mm/slab_common.c | 44 ++++++++++++++++++---------------- > mm/slub.c | 52 ++++++++++------------------------------ > 3 files changed, 48 insertions(+), 59 deletions(-) > > -- > 2.25.1 >
-- Thanks, Hyeonggon
| |