[PATCH] cxl: Fix struct pid leak when attaching a process through user API

[PATCH] cxl: Fix struct pid leak when attaching a process through user API

[Frederic Barrat]

When the cxl driver creates a context, it stores the pid of the
calling task, and mistakenly increments the reference count of the
struct pid twice, once through get_task_pid(), once through
get_pid(). The reference count is only decremented once on detach. As
a result, a struct pid is leaked and it reduces the number of
processes that can run simultaneously by one.
The fix is to simply remove the call to get_pid().

There is a separate patch for the kernel API, since it goes to
different kernel versions.

Signed-off-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Cc: <stable@vger.kernel.org> # 3.18+
---
 drivers/misc/cxl/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
index 7ccd299..97003ee 100644
--- a/drivers/misc/cxl/file.c
+++ b/drivers/misc/cxl/file.c
@@ -199,7 +199,7 @@ static long afu_ioctl_start_work(struct cxl_context *ctx,
 	 * behalf of another process, so the AFU's mm gets bound to the process
 	 * that performs this ioctl and not the process that opened the file.
 	 */
-	ctx->pid = get_pid(get_task_pid(current, PIDTYPE_PID));
+	ctx->pid = get_task_pid(current, PIDTYPE_PID);
 
 	trace_cxl_attach(ctx, work.work_element_descriptor, work.num_interrupts, amr);
 
-- 
1.9.1

Re: [PATCH] cxl: Fix struct pid leak when attaching a process through user API

[Ian Munsie]

Acked-by: Ian Munsie <imunsie@au1.ibm.com>

Re: [PATCH] cxl: Fix struct pid leak when attaching a process through user API

[Andrew Donnellan]

On 03/11/15 23:13, Frederic Barrat wrote:
> When the cxl driver creates a context, it stores the pid of the
> calling task, and mistakenly increments the reference count of the
> struct pid twice, once through get_task_pid(), once through
> get_pid(). The reference count is only decremented once on detach. As
> a result, a struct pid is leaked and it reduces the number of
> processes that can run simultaneously by one.
> The fix is to simply remove the call to get_pid().
>
> There is a separate patch for the kernel API, since it goes to
> different kernel versions.
>
> Signed-off-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
> Cc: <stable@vger.kernel.org> # 3.18+

Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>

-- 
Andrew Donnellan              Software Engineer, OzLabs
andrew.donnellan@au1.ibm.com  Australia Development Lab, Canberra
+61 2 6201 8874 (work)        IBM Australia Limited

Re: cxl: Fix struct pid leak when attaching a process through user API

[Michael Ellerman]

On Tue, 2015-03-11 at 12:13:52 UTC, Frederic Barrat wrote:
> When the cxl driver creates a context, it stores the pid of the
> calling task, and mistakenly increments the reference count of the
> struct pid twice, once through get_task_pid(), once through
> get_pid(). The reference count is only decremented once on detach. As
> a result, a struct pid is leaked and it reduces the number of
> processes that can run simultaneously by one.
> The fix is to simply remove the call to get_pid().
> 
> There is a separate patch for the kernel API, since it goes to
> different kernel versions.
> 
> Signed-off-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
> Cc: <stable@vger.kernel.org> # 3.18+
> Acked-by: Ian Munsie <imunsie@au1.ibm.com>
> Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>

This no longer applies, since we merged 7b8ad495d592 ("cxl: Fix DSI misses when
the context owning task exits").

Please resend if it's still applicable.

cheers

Re: cxl: Fix struct pid leak when attaching a process through user API

[Frederic Barrat]

Le 26/01/2016 04:11, Michael Ellerman a écrit :
> This no longer applies, since we merged 7b8ad495d592 ("cxl: Fix DSI misses when
> the context owning task exits").

Yes, on 4.5, it has been superseded by 7b8ad495d592.
It may still be worth considering for stable releases though.

   Fred