Possible memory leak in function (reserve_range) not freeing pointer (regionid)

Possible memory leak in function (reserve_range) not freeing pointer (regionid)

[Ahmed Tamrawi]

Bug Report: https://bugzilla.kernel.org/show_bug.cgi?id=89101
Linux Version [3.17-rc1]
Configuration: Default configuration for x86


Function (reserve_range) in file (drivers/pnp/system.c) allocates
pointer (regionid) on line (32) and passes it to function
(__request_region) through the macros: (request_region) at line (38)
or (request_mem_region) at line (40). However, if the resource (res)
is allocated through (__request_region) function, then the pointer
(res->name) points to the allocated pointer (regionid). Then, there is
no way in function (free_resource) or function (release_resource) to
free the pointer (regionid) or (res->name). Thus, causing a potential
memory leak!

Function (reserve_range) source code reference:
http://lxr.free-electrons.com/source/drivers/pnp/system.c#L25
Function (free_resource) source code
reference:http://lxr.free-electrons.com/source/kernel/resource.c#L172
Function (release_resource) source code
reference:http://lxr.free-electrons.com/source/kernel/resource.c#L322


~Ahmed
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Re: Possible memory leak in function (reserve_range) not freeing pointer (regionid)

[Greg KH]

On Sun, Nov 30, 2014 at 02:00:45PM -0600, Ahmed Tamrawi wrote:
> Bug Report: https://bugzilla.kernel.org/show_bug.cgi?id=89101
> Linux Version [3.17-rc1]

That's a very old kernel version.

> Configuration: Default configuration for x86
> 
> 
> Function (reserve_range) in file (drivers/pnp/system.c) allocates
> pointer (regionid) on line (32) and passes it to function
> (__request_region) through the macros: (request_region) at line (38)
> or (request_mem_region) at line (40). However, if the resource (res)
> is allocated through (__request_region) function, then the pointer
> (res->name) points to the allocated pointer (regionid). Then, there is
> no way in function (free_resource) or function (release_resource) to
> free the pointer (regionid) or (res->name). Thus, causing a potential
> memory leak!

How does this relate to the mailing list you sent this to?

Please send a patch for the issue against Linus's latest kernel tree to
help explain things better.

thanks,

greg k-h
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Re: Possible memory leak in function (reserve_range) not freeing pointer (regionid)

[Ahmed Tamrawi]

On Sun, Nov 30, 2014 at 8:51 PM, Greg KH <gregkh@linuxfoundation.org> wrote:
> On Sun, Nov 30, 2014 at 02:00:45PM -0600, Ahmed Tamrawi wrote:
>> Bug Report: https://bugzilla.kernel.org/show_bug.cgi?id=89101
>> Linux Version [3.17-rc1]
>
> That's a very old kernel version.
It does exist on the latest version (v3.18-rc7)
>
>> Configuration: Default configuration for x86
>>
>>
>> Function (reserve_range) in file (drivers/pnp/system.c) allocates
>> pointer (regionid) on line (32) and passes it to function
>> (__request_region) through the macros: (request_region) at line (38)
>> or (request_mem_region) at line (40). However, if the resource (res)
>> is allocated through (__request_region) function, then the pointer
>> (res->name) points to the allocated pointer (regionid). Then, there is
>> no way in function (free_resource) or function (release_resource) to
>> free the pointer (regionid) or (res->name). Thus, causing a potential
>> memory leak!
>
> How does this relate to the mailing list you sent this to?
The bug occurs in the drivers side code in pnp/system.c. I thought
this is the list to target. I have already posted the bug into
linux-kernel mailing list, does that suffice?
>
> Please send a patch for the issue against Linus's latest kernel tree to
> help explain things better.
I am not sure where the fix should be, but I can try one.
>
> thanks,
>
> greg k-h

Re: Possible memory leak in function (reserve_range) not freeing pointer (regionid)

[Dan Carpenter]

This is a real bug, but it's very minor.  To trigger it, you would have
to modprobe and rmmod many many times in a loop.  If you report these
sorts of minor bugs when the code is new, then most times people fix
them but this one is old I doubt anyone is motivated to fix it.  Fixing
it seems a little complicated to me as well.

I suppose that linux-kernel@vger.kernel.org is the correct mailing list
to report this but the truth is that no one reads that list.

Anyway, it seems that you have written a good bug finding tool.  :)
Congratulations for that!

regards,
dan carpenter
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Re: Possible memory leak in function (reserve_range) not freeing pointer (regionid)

[Ahmed Tamrawi]

The bug was found via the  memory-leak static analysis tool that we
have built on top of C-Atlas framework from EnSoft. You can check it
out (http://www.ensoftcorp.com/atlas/).

Thanks for clarifying things!

~Ahmed

On Wed, Dec 3, 2014 at 2:48 AM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
> This is a real bug, but it's very minor.  To trigger it, you would have
> to modprobe and rmmod many many times in a loop.  If you report these
> sorts of minor bugs when the code is new, then most times people fix
> them but this one is old I doubt anyone is motivated to fix it.  Fixing
> it seems a little complicated to me as well.
>
> I suppose that linux-kernel@vger.kernel.org is the correct mailing list
> to report this but the truth is that no one reads that list.
>
> Anyway, it seems that you have written a good bug finding tool.  :)
> Congratulations for that!
>
> regards,
> dan carpenter

Re: Possible memory leak in function (reserve_range) not freeing pointer (regionid)

[Greg KH]

On Sun, Nov 30, 2014 at 09:49:23PM -0600, Ahmed Tamrawi wrote:
> On Sun, Nov 30, 2014 at 8:51 PM, Greg KH <gregkh@linuxfoundation.org> wrote:
> > On Sun, Nov 30, 2014 at 02:00:45PM -0600, Ahmed Tamrawi wrote:
> >> Bug Report: https://bugzilla.kernel.org/show_bug.cgi?id=89101
> >> Linux Version [3.17-rc1]
> >
> > That's a very old kernel version.
> It does exist on the latest version (v3.18-rc7)

Good to know.

> >> Configuration: Default configuration for x86
> >>
> >>
> >> Function (reserve_range) in file (drivers/pnp/system.c) allocates
> >> pointer (regionid) on line (32) and passes it to function
> >> (__request_region) through the macros: (request_region) at line (38)
> >> or (request_mem_region) at line (40). However, if the resource (res)
> >> is allocated through (__request_region) function, then the pointer
> >> (res->name) points to the allocated pointer (regionid). Then, there is
> >> no way in function (free_resource) or function (release_resource) to
> >> free the pointer (regionid) or (res->name). Thus, causing a potential
> >> memory leak!
> >
> > How does this relate to the mailing list you sent this to?
> The bug occurs in the drivers side code in pnp/system.c. I thought
> this is the list to target. I have already posted the bug into
> linux-kernel mailing list, does that suffice?

Use the tool, scripts/get_maintainer.pl to determine what people and
mailing lists to send issues to for specific files.  Just sending them
to random mailing lists without cc: developers is a sure way to get them
ignored.

thanks,

greg k-h
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Possible memory leak in function (reserve_range) not freeing pointer (regionid)

[Ahmed Tamrawi]

Bug Report: https://bugzilla.kernel.org/show_bug.cgi?id=89101
Linux Version [3.17-rc1]
Configuration: Default configuration for x86


Function (reserve_range) in file (drivers/pnp/system.c) allocates
pointer (regionid) on line (32) and passes it to function
(__request_region) through the macros: (request_region) at line (38)
or (request_mem_region) at line (40). However, if the resource (res)
is allocated through (__request_region) function, then the pointer
(res->name) points to the allocated pointer (regionid). Then, there is
no way in function (free_resource) or function (release_resource) to
free the pointer (regionid) or (res->name). Thus, causing a potential
memory leak!

Function (reserve_range) source code reference:
http://lxr.free-electrons.com/source/drivers/pnp/system.c#L25
Function (free_resource) source code
reference:http://lxr.free-electrons.com/source/kernel/resource.c#L172
Function (release_resource) source code
reference:http://lxr.free-electrons.com/source/kernel/resource.c#L322


~Ahmed