[PATCH] ftrace: fix memory leak in ftrace_graph_release()

[PATCH] ftrace: fix memory leak in ftrace_graph_release()

[Luis Henriques]

ftrace_hash is being kfree'ed in ftrace_graph_release(), however the
->buckets field is not.  This results in a memory leak that is easily
captured by kmemleak:

unreferenced object 0xffff880038afe000 (size 8192):
  comm "trace-cmd", pid 238, jiffies 4294916898 (age 9.736s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff815f561e>] kmemleak_alloc+0x4e/0xb0
    [<ffffffff8113964d>] __kmalloc+0x12d/0x1a0
    [<ffffffff810bf6d1>] alloc_ftrace_hash+0x51/0x80
    [<ffffffff810c0523>] __ftrace_graph_open.isra.39.constprop.46+0xa3/0x100
    [<ffffffff810c05e8>] ftrace_graph_open+0x68/0xa0
    [<ffffffff8114003d>] do_dentry_open.isra.1+0x1bd/0x2d0
    [<ffffffff81140df7>] vfs_open+0x47/0x60
    [<ffffffff81150f95>] path_openat+0x2a5/0x1020
    [<ffffffff81152d6a>] do_filp_open+0x8a/0xf0
    [<ffffffff811411df>] do_sys_open+0x12f/0x200
    [<ffffffff811412ce>] SyS_open+0x1e/0x20
    [<ffffffff815fa6e0>] entry_SYSCALL_64_fastpath+0x13/0x94
    [<ffffffffffffffff>] 0xffffffffffffffff

Signed-off-by: Luis Henriques <lhenriques@suse.com>
---
 kernel/trace/ftrace.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 74fdfe9ed3db..07a6ec55e3b4 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5062,8 +5062,8 @@ ftrace_graph_release(struct inode *inode, struct file *file)
 		free_ftrace_hash(old_hash);
 	}
 
- out:
-	kfree(fgd->new_hash);
+out:
+	free_ftrace_hash(fgd->new_hash);
 	kfree(fgd);
 
 	return ret;

Re: [PATCH] ftrace: fix memory leak in ftrace_graph_release()

[Steven Rostedt]

Thanks, I'll apply this to my urgent tree and test it when I get home.

-- Steve

On May 25, 2017 8:20:38 AM PDT, Luis Henriques <lhenriques@suse.com> wrote:
>ftrace_hash is being kfree'ed in ftrace_graph_release(), however the
>->buckets field is not.  This results in a memory leak that is easily
>captured by kmemleak:
>
>unreferenced object 0xffff880038afe000 (size 8192):
>  comm "trace-cmd", pid 238, jiffies 4294916898 (age 9.736s)
>  hex dump (first 32 bytes):
>    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>  backtrace:
>    [<ffffffff815f561e>] kmemleak_alloc+0x4e/0xb0
>    [<ffffffff8113964d>] __kmalloc+0x12d/0x1a0
>    [<ffffffff810bf6d1>] alloc_ftrace_hash+0x51/0x80
>[<ffffffff810c0523>]
>__ftrace_graph_open.isra.39.constprop.46+0xa3/0x100
>    [<ffffffff810c05e8>] ftrace_graph_open+0x68/0xa0
>    [<ffffffff8114003d>] do_dentry_open.isra.1+0x1bd/0x2d0
>    [<ffffffff81140df7>] vfs_open+0x47/0x60
>    [<ffffffff81150f95>] path_openat+0x2a5/0x1020
>    [<ffffffff81152d6a>] do_filp_open+0x8a/0xf0
>    [<ffffffff811411df>] do_sys_open+0x12f/0x200
>    [<ffffffff811412ce>] SyS_open+0x1e/0x20
>    [<ffffffff815fa6e0>] entry_SYSCALL_64_fastpath+0x13/0x94
>    [<ffffffffffffffff>] 0xffffffffffffffff
>
>Signed-off-by: Luis Henriques <lhenriques@suse.com>
>---
> kernel/trace/ftrace.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
>index 74fdfe9ed3db..07a6ec55e3b4 100644
>--- a/kernel/trace/ftrace.c
>+++ b/kernel/trace/ftrace.c
>@@ -5062,8 +5062,8 @@ ftrace_graph_release(struct inode *inode, struct
>file *file)
> 		free_ftrace_hash(old_hash);
> 	}
> 
>- out:
>-	kfree(fgd->new_hash);
>+out:
>+	free_ftrace_hash(fgd->new_hash);
> 	kfree(fgd);
> 
> 	return ret;

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.