Re: [PATCH v2 0/3] Refactor __kmem_cache_create() and fix memory leak

[Liu Shixin <liushixin2@huawei.com>]

On 2022/11/2 15:46, Hyeonggon Yoo wrote:
> On Mon, Oct 31, 2022 at 09:47:44PM +0800, Liu Shixin wrote:
>> I found a memory leak of kobj->name in sysfs_slab_add() which is introduced
>> by 80da026a8e5d ("mm/slub: fix slab double-free in case of duplicate sysfs filename").
>> Following the rules stated in the comment for kobject_init_and_add():
> Thank you for reporting this! Indeed it seems tried to fix double free but
> introduced a leak.
>
>>  If this function returns an error, kobject_put() must be called to
>>  properly clean up the memory associated with the object.
>>
>> We should use kobject_put() to free kobject.
> But what to do if a cache is created early and later sysfs_slab_add() failed?
> (Which is unlikely on normal condition)
>
> With this series it introduces use-after-free if sysfs_slab_add() in
> slab_sysfs_init() failed.  Should we just call BUG() or something like that?
Thanks for your discovery, what I missed. I prefer to panic directly, just as create_boot_cache() does.
Of couse, if you want the system to continue booting, I think it's possible to distinguish them
by slab_state.

Looking forward to your advice.
Thanks,
>
>> But we can't simply add kobject_put() since it will free kmem_cache too.
>> If we use kobject_put(), we need to skip other release functions.
>>
>> In this series, We refactor the code to separate sysfs_slab_add() and
>> debugfs_slab_add() from __kmem_cache_create(), and then use kobject_put()
>> to free kobject in sysfs_slab_add(). This can fix the memory leak of
>> kobject->name.
>>
>> v1->v2: Fix build error reported by kernel test robot <lkp@intel.com>.
>>
>> Liu Shixin (3):
>>   mm/slab_common: Move cache_name to create_cache()
>>   mm/slub: Refactor __kmem_cache_create()
>>   mm/slub: Fix memory leak of kobj->name in sysfs_slab_add()
>>
>>  include/linux/slub_def.h | 11 +++++++++
>>  mm/slab_common.c         | 44 ++++++++++++++++++----------------
>>  mm/slub.c                | 52 ++++++++++------------------------------
>>  3 files changed, 48 insertions(+), 59 deletions(-)
>>
>> -- 
>> 2.25.1
>>