lkml.org 
[lkml]   [2022]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2 0/3] Refactor __kmem_cache_create() and fix memory leak
On Mon, Oct 31, 2022 at 09:47:44PM +0800, Liu Shixin wrote:
> I found a memory leak of kobj->name in sysfs_slab_add() which is introduced
> by 80da026a8e5d ("mm/slub: fix slab double-free in case of duplicate sysfs filename").
> Following the rules stated in the comment for kobject_init_and_add():

Thank you for reporting this! Indeed it seems tried to fix double free but
introduced a leak.

> If this function returns an error, kobject_put() must be called to
> properly clean up the memory associated with the object.
>
> We should use kobject_put() to free kobject.

But what to do if a cache is created early and later sysfs_slab_add() failed?
(Which is unlikely on normal condition)

With this series it introduces use-after-free if sysfs_slab_add() in
slab_sysfs_init() failed. Should we just call BUG() or something like that?

> But we can't simply add kobject_put() since it will free kmem_cache too.
> If we use kobject_put(), we need to skip other release functions.
>
> In this series, We refactor the code to separate sysfs_slab_add() and
> debugfs_slab_add() from __kmem_cache_create(), and then use kobject_put()
> to free kobject in sysfs_slab_add(). This can fix the memory leak of
> kobject->name.
>
> v1->v2: Fix build error reported by kernel test robot <lkp@intel.com>.
>
> Liu Shixin (3):
> mm/slab_common: Move cache_name to create_cache()
> mm/slub: Refactor __kmem_cache_create()
> mm/slub: Fix memory leak of kobj->name in sysfs_slab_add()
>
> include/linux/slub_def.h | 11 +++++++++
> mm/slab_common.c | 44 ++++++++++++++++++----------------
> mm/slub.c | 52 ++++++++++------------------------------
> 3 files changed, 48 insertions(+), 59 deletions(-)
>
> --
> 2.25.1
>

--
Thanks,
Hyeonggon

\
 
 \ /
  Last update: 2022-11-02 08:46    [W:0.079 / U:0.824 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site