From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4885DD1AD5B for ; Wed, 16 Oct 2024 13:37:55 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D37546B007B; Wed, 16 Oct 2024 09:37:54 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CE61E6B008A; Wed, 16 Oct 2024 09:37:54 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BAEF96B008C; Wed, 16 Oct 2024 09:37:54 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 9A1986B007B for ; Wed, 16 Oct 2024 09:37:54 -0400 (EDT) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 88B7D80116 for ; Wed, 16 Oct 2024 13:37:45 +0000 (UTC) X-FDA: 82679568090.19.E78D6A9 Received: from out-187.mta1.migadu.com (out-187.mta1.migadu.com [95.215.58.187]) by imf14.hostedemail.com (Postfix) with ESMTP id 2D4C4100004 for ; Wed, 16 Oct 2024 13:37:41 +0000 (UTC) Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=HeYSRjAL; spf=pass (imf14.hostedemail.com: domain of muchun.song@linux.dev designates 95.215.58.187 as permitted sender) smtp.mailfrom=muchun.song@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1729085824; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=o+YCI0FG5lB9iVVjcZez+WFS1g8KiaYrOyP2QC4tp1U=; b=T8GcZ/1GTeqQ60iYX0FIoFQtSHN5d+iqgzVIa3pjNf1fhbW2exxgexnB/6K8fdJcvqKPor cGpRzZUjJ805h+ZvY+/DIlMWBD5v8zsVqDxjcE9VtT5VI1UX9MNQcPTJYDBHXvH7XujEmF wC6eFTuZE0784cNj3fdOzv1KnqqFv5s= ARC-Authentication-Results: i=1; imf14.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=HeYSRjAL; spf=pass (imf14.hostedemail.com: domain of muchun.song@linux.dev designates 95.215.58.187 as permitted sender) smtp.mailfrom=muchun.song@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1729085824; a=rsa-sha256; cv=none; b=cl0bnm0rXJfYzv2U7gyEl7viPGq7Vy8Rtp/WUz58DpUNn/yuvd3LIChMuFcxjGau2wgqVm OszLBKFiiBppNLj2sr37g+4KYeyYL9yGWWxariuKmLVAhlP0u0VryUOtGNxODFZsqM2uOI /X/74dyv+eeSA+Cqx8INv2bdnaZar9w= Content-Type: text/plain; charset=utf-8 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1729085869; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=o+YCI0FG5lB9iVVjcZez+WFS1g8KiaYrOyP2QC4tp1U=; b=HeYSRjALVBtGVaDE+xkFIO4yjC3UOmFyNMXKPrldmjVg2aq2/R9O57J91Z0MM0eSwlFFvH 7lQrqE9GNjSQjrrbunLetcD+TJ8U802vNJLIOOBNp4H4oMohSn2OE/Yg6CHBionX0R7rdg sQCQ7yMJdi5dznzZGJB+Gwa1dML5W4k= Content-Transfer-Encoding: quoted-printable X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Muchun Song Mime-Version: 1.0 (1.0) Subject: Re: [PATCH v2] mm: shrinker: avoid memleak in alloc_shrinker_info Date: Wed, 16 Oct 2024 21:37:13 +0800 Message-Id: <14475D72-33E6-4E50-87C8-7044C09C93E3@linux.dev> References: Cc: chenridong , Anshuman Khandual , akpm@linux-foundation.org, david@fromorbit.com, zhengqi.arch@bytedance.com, roman.gushchin@linux.dev, linux-mm@kvack.org, linux-kernel@vger.kernel.org, wangweiyang2@huawei.com In-Reply-To: To: "Kirill A. Shutemov" X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Stat-Signature: j9w7s4k94r6x6beah6mmbrctpkhekfdi X-Rspamd-Queue-Id: 2D4C4100004 X-Rspamd-Server: rspam11 X-HE-Tag: 1729085861-32661 X-HE-Meta: U2FsdGVkX18M7Owgu0mp5yn/eioeNF/9aco8FaVwGKi5PaiucjPAU5bJlO1vpGMlAB+E0cbILfSPLlT9MfwYg0vfj68rhMywKfc2ixbP/3QOCO7syB9TUycXjIAMWPpf9v32T+ebTGJ+r1I9Xui4QMkf0tVuV0kwFJO5fYPsqE6baR+vxEDdwbWZZGR8nVFSM9UVkryEm2/EP6KVR50cFCNuJsOg9cmqeCzQgChB08bUcm90SgHupUaj4DOqpSiOPgFVEtXyzhf3NrBzUN7gQpNFad9yEsENggZTQkTml1OJCt6ZJUr8SyYuCpl97voBV/8km8ZBBUXFjNZaOX2hlXvi6ykxNPReM/KKvYQV7Lp2souO9Y5cMRx75bxIa77LlQUHZ8xL7JmBTwkmGRVzaS15Tg2dLirpc5AFAMIr5CR7LDpU1ahm+amdaJDyO9tGVuUW4vwe8kYrGrdQXrpcsQgKGX4H/GfoPJP/mxIHbGnB8i6QPRiI92Y+2h+4B6HD5tpNUQhBSIDiAtxc4zmGh09X+bC2mme3hQYjoAIQSg4Bnd0Jf2/n2fV6xKYcSTtnYgHsm9AfGK6fNYZtNxzonyfullkt6HCAYC3n5egizx6YvwLhxP4IzEvb8qgngju89L2FPMM4m/KON0friPVx0MS6eXrl9/XqDpsP6tKyipHZRQbwOCuF2QWUJIWw6iEOtt3fHUw/gHD14xNHtfgvMKXgXpsMesOxt2h8S2FXSpYqY80S0XkBRzi8qWMwXw2720ShQrXQdO1GJwfwyuy0sJA3kgbcE5cgJhU5JeECOm/OkxZT/qqlpW2sZ4hqNf77u5SliXmTDRql2/8IlImIn/aLygwbXiWwUd04rjtIE2qNk/s6WvyNuJuqIhMBWZh9P90uIWqSaqjQX12RVj5EnPSOh4fZuoFRSUN+MjSw9jobxBBrdGpyg2kxcrcYVFMFjnSueOCMdwMlEKb/90i ZEqeaXJx cuv0Wsekzx2d2xoeKStOGxRJ7SLGEuLXXdA2oLisCenMzNiPErOpjUFG5mcezKCErUBlfFi1YWZv0IHuRFaxdr1CzydypoXoyeo0Fr+uK0Gj01A4YbktHxA8EzASwe5HZzLe+KS/kUP08xzzpbiWLveHTFY3+PQtp5ZVrQeUZXU2kpwcRo6r7KSEvazGHKLAB8lP59RVpfZsvuGa6WyjolBsZR4mTLt8Sijklbh+PStJQPtjlAByVtR95yA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: > On Oct 16, 2024, at 18:17, Kirill A. Shutemov wrote= : >=20 > =EF=BB=BFOn Wed, Oct 16, 2024 at 10:21:30AM +0800, Muchun Song wrote: >>=20 >>=20 >>>> On Oct 16, 2024, at 09:25, chenridong wrote: >>>=20 >>>=20 >>>=20 >>> On 2024/10/15 14:55, Anshuman Khandual wrote: >>>> On 10/14/24 16:59, Kirill A. Shutemov wrote: >>>>> On Mon, Oct 14, 2024 at 03:23:36AM +0000, Chen Ridong wrote: >>>>>> From: Chen Ridong >>>>>>=20 >>>>>> A memleak was found as bellow: >>>>>>=20 >>>>>> unreferenced object 0xffff8881010d2a80 (size 32): >>>>>> comm "mkdir", pid 1559, jiffies 4294932666 >>>>>> hex dump (first 32 bytes): >>>>>> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ >>>>>> 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 @............... >>>>>> backtrace (crc 2e7ef6fa): >>>>>> [] __kmalloc_node_noprof+0x394/0x470 >>>>>> [] alloc_shrinker_info+0x7b/0x1a0 >>>>>> [] mem_cgroup_css_online+0x11a/0x3b0 >>>>>> [] online_css+0x29/0xa0 >>>>>> [] cgroup_apply_control_enable+0x20d/0x360 >>>>>> [] cgroup_mkdir+0x168/0x5f0 >>>>>> [] kernfs_iop_mkdir+0x5e/0x90 >>>>>> [] vfs_mkdir+0x144/0x220 >>>>>> [] do_mkdirat+0x87/0x130 >>>>>> [] __x64_sys_mkdir+0x49/0x70 >>>>>> [] do_syscall_64+0x68/0x140 >>>>>> [] entry_SYSCALL_64_after_hwframe+0x76/0x7e >>>>>>=20 >>>>>> In the alloc_shrinker_info function, when shrinker_unit_alloc return >>>>>> err, the info won't be freed. Just fix it. >>>>>>=20 >>>>>> Fixes: 307bececcd12 ("mm: shrinker: add a secondary array for shrinke= r_info::{map, nr_deferred}") >>>>>> Signed-off-by: Chen Ridong >>>>>> --- >>>>>> mm/shrinker.c | 1 + >>>>>> 1 file changed, 1 insertion(+) >>>>>>=20 >>>>>> diff --git a/mm/shrinker.c b/mm/shrinker.c >>>>>> index dc5d2a6fcfc4..92270413190d 100644 >>>>>> --- a/mm/shrinker.c >>>>>> +++ b/mm/shrinker.c >>>>>> @@ -97,6 +97,7 @@ int alloc_shrinker_info(struct mem_cgroup *memcg) >>>>>> err: >>>>>> mutex_unlock(&shrinker_mutex); >>>>>> + kvfree(info); >>>>>> free_shrinker_info(memcg); >>>>>> return -ENOMEM; >>>>>> } >>>>>=20 >>>>> NAK. If in the future there going to one more error case after >>>>> rcu_assign_pointer() we will end up with double free. >>>>>=20 >>>>> This should be safer: >>>>>=20 >>>>> diff --git a/mm/shrinker.c b/mm/shrinker.c >>>>> index dc5d2a6fcfc4..763fd556bc7d 100644 >>>>> --- a/mm/shrinker.c >>>>> +++ b/mm/shrinker.c >>>>> @@ -87,8 +87,10 @@ int alloc_shrinker_info(struct mem_cgroup *memcg) >>>>> if (!info) >>>>> goto err; >>>>> info->map_nr_max =3D shrinker_nr_max; >>>>> - if (shrinker_unit_alloc(info, NULL, nid)) >>>>> + if (shrinker_unit_alloc(info, NULL, nid)) { >>>>> + kvfree(info); >>>>> goto err; >>>>> + } >>>>> rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, info); >>>>> } >>>>> mutex_unlock(&shrinker_mutex); >>>> Agreed, this is what I mentioned earlier as well. >>>> ------------------------------------------------------------------ >>>> I guess kvfree() should be called just after shrinker_unit_alloc() >>>> fails but before calling into "goto err" >>>> ------------------------------------------------------------------ >>>=20 >>> After discussion, it seems that v1 is acceptable. >>> Hi, Muchun, do you have any other opinions? >>=20 >> I insist on my opinion, not mixing two different approaches >> to do release resources. >=20 > It makes no sense. >=20 > This kvfree() is specifically to handle the case when 'info' is allocated,= > but not yet assigned to ->shrinker_info. And 'err:' block handles all > other error cases. Putting kvfree() in 'err:' section is double-free > timebomb. Please carefully read my previous reply. I don=E2=80=99t think there is any d= ouble-free. FYI, I pasted my previous suggested fix here. Thanks. --- a/mm/shrinker.c +++ b/mm/shrinker.c @@ -88,13 +88,14 @@ int alloc_shrinker_info(struct mem_cgroup *memcg) goto err; info->map_nr_max =3D shrinker_nr_max; if (shrinker_unit_alloc(info, NULL, nid)) - goto err; + goto free; rcu_assign_pointer(memcg->nodeinfo[nid]->shrinker_info, info)= ; } mutex_unlock(&shrinker_mutex); return ret; - +free: + kvfree(info); err: mutex_unlock(&shrinker_mutex); free_shrinker_info(memcg); >=20 > -- > Kiryl Shutsemau / Kirill A. Shutemov