All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Alexander Aring <aahringo@redhat.com>,
	David Teigland <teigland@redhat.com>,
	Sasha Levin <sashal@kernel.org>,
	cluster-devel@redhat.com
Subject: [PATCH AUTOSEL 5.4 25/80] fs: dlm: fix configfs memory leak
Date: Sun, 18 Oct 2020 15:21:36 -0400	[thread overview]
Message-ID: <20201018192231.4054535-25-sashal@kernel.org> (raw)
In-Reply-To: <20201018192231.4054535-1-sashal@kernel.org>

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 3d2825c8c6105b0f36f3ff72760799fa2e71420e ]

This patch fixes the following memory detected by kmemleak and umount
gfs2 filesystem which removed the last lockspace:

unreferenced object 0xffff9264f482f600 (size 192):
  comm "dlm_controld", pid 325, jiffies 4294690276 (age 48.136s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 6e 6f 64 65 73 00 00 00  ........nodes...
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000060481d7>] make_space+0x41/0x130
    [<000000008d905d46>] configfs_mkdir+0x1a2/0x5f0
    [<00000000729502cf>] vfs_mkdir+0x155/0x210
    [<000000000369bcf1>] do_mkdirat+0x6d/0x110
    [<00000000cc478a33>] do_syscall_64+0x33/0x40
    [<00000000ce9ccf01>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

The patch just remembers the "nodes" entry pointer in space as I think
it's created as subdirectory when parent "spaces" is created. In
function drop_space() we will lost the pointer reference to nds because
configfs_remove_default_groups(). However as this subdirectory is always
available when "spaces" exists it will just be freed when "spaces" will be
freed.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/config.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/dlm/config.c b/fs/dlm/config.c
index 3b21082e1b550..3b1012a3c4396 100644
--- a/fs/dlm/config.c
+++ b/fs/dlm/config.c
@@ -216,6 +216,7 @@ struct dlm_space {
 	struct list_head members;
 	struct mutex members_lock;
 	int members_count;
+	struct dlm_nodes *nds;
 };
 
 struct dlm_comms {
@@ -424,6 +425,7 @@ static struct config_group *make_space(struct config_group *g, const char *name)
 	INIT_LIST_HEAD(&sp->members);
 	mutex_init(&sp->members_lock);
 	sp->members_count = 0;
+	sp->nds = nds;
 	return &sp->group;
 
  fail:
@@ -445,6 +447,7 @@ static void drop_space(struct config_group *g, struct config_item *i)
 static void release_space(struct config_item *i)
 {
 	struct dlm_space *sp = config_item_to_space(i);
+	kfree(sp->nds);
 	kfree(sp);
 }
 
-- 
2.25.1


WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: cluster-devel.redhat.com
Subject: [Cluster-devel] [PATCH AUTOSEL 5.4 25/80] fs: dlm: fix configfs memory leak
Date: Sun, 18 Oct 2020 15:21:36 -0400	[thread overview]
Message-ID: <20201018192231.4054535-25-sashal@kernel.org> (raw)
In-Reply-To: <20201018192231.4054535-1-sashal@kernel.org>

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 3d2825c8c6105b0f36f3ff72760799fa2e71420e ]

This patch fixes the following memory detected by kmemleak and umount
gfs2 filesystem which removed the last lockspace:

unreferenced object 0xffff9264f482f600 (size 192):
  comm "dlm_controld", pid 325, jiffies 4294690276 (age 48.136s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 6e 6f 64 65 73 00 00 00  ........nodes...
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000060481d7>] make_space+0x41/0x130
    [<000000008d905d46>] configfs_mkdir+0x1a2/0x5f0
    [<00000000729502cf>] vfs_mkdir+0x155/0x210
    [<000000000369bcf1>] do_mkdirat+0x6d/0x110
    [<00000000cc478a33>] do_syscall_64+0x33/0x40
    [<00000000ce9ccf01>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

The patch just remembers the "nodes" entry pointer in space as I think
it's created as subdirectory when parent "spaces" is created. In
function drop_space() we will lost the pointer reference to nds because
configfs_remove_default_groups(). However as this subdirectory is always
available when "spaces" exists it will just be freed when "spaces" will be
freed.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/config.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/dlm/config.c b/fs/dlm/config.c
index 3b21082e1b550..3b1012a3c4396 100644
--- a/fs/dlm/config.c
+++ b/fs/dlm/config.c
@@ -216,6 +216,7 @@ struct dlm_space {
 	struct list_head members;
 	struct mutex members_lock;
 	int members_count;
+	struct dlm_nodes *nds;
 };
 
 struct dlm_comms {
@@ -424,6 +425,7 @@ static struct config_group *make_space(struct config_group *g, const char *name)
 	INIT_LIST_HEAD(&sp->members);
 	mutex_init(&sp->members_lock);
 	sp->members_count = 0;
+	sp->nds = nds;
 	return &sp->group;
 
  fail:
@@ -445,6 +447,7 @@ static void drop_space(struct config_group *g, struct config_item *i)
 static void release_space(struct config_item *i)
 {
 	struct dlm_space *sp = config_item_to_space(i);
+	kfree(sp->nds);
 	kfree(sp);
 }
 
-- 
2.25.1




  parent reply	other threads:[~2020-10-18 19:45 UTC|newest]

Thread overview: 95+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-18 19:21 [PATCH AUTOSEL 5.4 01/80] md/bitmap: fix memory leak of temporary bitmap Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 02/80] block: ratelimit handle_bad_sector() message Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 03/80] crypto: ccp - fix error handling Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 04/80] x86/asm: Replace __force_order with a memory clobber Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 05/80] x86/mce: Add Skylake quirk for patrol scrub reported errors Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 06/80] media: firewire: fix memory leak Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 07/80] media: ati_remote: sanity check for both endpoints Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 08/80] media: st-delta: Fix reference count leak in delta_run_work Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 09/80] media: sti: Fix reference count leaks Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 10/80] media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync Sasha Levin
2020-10-18 19:21   ` Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 11/80] media: exynos4-is: Fix a reference count leak " Sasha Levin
2020-10-18 19:21   ` Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 12/80] media: exynos4-is: Fix a reference count leak Sasha Levin
2020-10-18 19:21   ` Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 13/80] media: vsp1: Fix runtime PM imbalance on error Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 14/80] media: platform: s3c-camif: " Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 15/80] media: platform: sti: hva: " Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 16/80] media: bdisp: " Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 17/80] media: media/pci: prevent memory leak in bttv_probe Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 18/80] x86/mce: Make mce_rdmsrl() panic on an inaccessible MSR Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 19/80] media: rcar_drif: Fix fwnode reference leak when parsing DT Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 20/80] media: uvcvideo: Ensure all probed info is returned to v4l2 Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 21/80] seccomp: kill process instead of thread for unknown actions Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 22/80] mmc: sdio: Check for CISTPL_VERS_1 buffer size Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 23/80] media: saa7134: avoid a shift overflow Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 24/80] media: venus: fixes for list corruption Sasha Levin
2020-10-18 19:21 ` Sasha Levin [this message]
2020-10-18 19:21   ` [Cluster-devel] [PATCH AUTOSEL 5.4 25/80] fs: dlm: fix configfs memory leak Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 26/80] media: venus: core: Fix runtime PM imbalance in venus_probe Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 27/80] ipv6/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 28/80] ntfs: add check for mft record size in superblock Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 29/80] ip_gre: set dev->hard_header_len and dev->needed_headroom properly Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 30/80] mac80211: handle lack of sband->bitrates in rates Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 31/80] PM: hibernate: remove the bogus call to get_gendisk() in software_resume() Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 32/80] scsi: mvumi: Fix error return in mvumi_io_attach() Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 33/80] scsi: target: core: Add CONTROL field for trace events Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 34/80] mic: vop: copy data to kernel space then write to io memory Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 35/80] misc: vop: add round_up(x,4) for vring_size to avoid kernel panic Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 36/80] usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 37/80] usb: gadget: function: printer: fix use-after-free in __lock_acquire Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 38/80] udf: Limit sparing table size Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 39/80] udf: Avoid accessing uninitialized data on failed inode read Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 40/80] rtw88: increse the size of rx buffer size Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 41/80] USB: cdc-acm: handle broken union descriptors Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 42/80] usb: dwc3: simple: add support for Hikey 970 Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 43/80] can: flexcan: flexcan_chip_stop(): add error handling and propagate error value Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 44/80] ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 45/80] drm/panfrost: add amlogic reset quirk callback Sasha Levin
2020-10-18 19:21   ` Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 46/80] bpf: Limit caller's stack depth 256 for subprogs with tailcalls Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 47/80] misc: rtsx: Fix memory leak in rtsx_pci_probe Sasha Levin
2020-10-18 19:21 ` [PATCH AUTOSEL 5.4 48/80] reiserfs: only call unlock_new_inode() if I_NEW Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 49/80] opp: Prevent memory leak in dev_pm_opp_attach_genpd() Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 50/80] xfs: make sure the rt allocator doesn't run off the end Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 51/80] usb: ohci: Default to per-port over-current protection Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 52/80] Bluetooth: Only mark socket zapped after unlocking Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 53/80] drm/msm/a6xx: fix a potential overflow issue Sasha Levin
2020-10-18 19:22   ` Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 54/80] iomap: fix WARN_ON_ONCE() from unprivileged users Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 55/80] scsi: ibmvfc: Fix error return in ibmvfc_probe() Sasha Levin
2020-10-18 19:22   ` Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 56/80] scsi: qla2xxx: Warn if done() or free() are called on an already freed srb Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 57/80] selftests/bpf: Fix test_sysctl_loop{1, 2} failure due to clang change Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 58/80] brcmsmac: fix memory leak in wlc_phy_attach_lcnphy Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 59/80] rtl8xxxu: prevent potential memory leak Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 60/80] Fix use after free in get_capset_info callback Sasha Levin
2020-10-18 19:22   ` Sasha Levin
2020-10-18 19:22   ` Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 61/80] HID: ite: Add USB id match for Acer One S1003 keyboard dock Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 62/80] scsi: qedf: Return SUCCESS if stale rport is encountered Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 63/80] scsi: qedi: Protect active command list to avoid list corruption Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 64/80] scsi: qedi: Fix list_del corruption while removing active I/O Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 65/80] fbmem: add margin check to fb_check_caps() Sasha Levin
2020-10-18 19:22   ` Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 66/80] tty: ipwireless: fix error handling Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 67/80] drm/amd/display: Fix a list corruption Sasha Levin
2020-10-18 19:22   ` Sasha Levin
2020-10-18 19:22   ` Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 68/80] Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 69/80] ipvs: Fix uninit-value in do_ip_vs_set_ctl() Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 70/80] reiserfs: Fix memory leak in reiserfs_parse_options() Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 71/80] mwifiex: don't call del_timer_sync() on uninitialized timer Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 72/80] ALSA: hda/ca0132 - Add AE-7 microphone selection commands Sasha Levin
2020-10-18 19:22   ` Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 73/80] ALSA: hda/ca0132 - Add new quirk ID for SoundBlaster AE-7 Sasha Levin
2020-10-18 19:22   ` Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 74/80] scsi: smartpqi: Avoid crashing kernel for controller issues Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 75/80] brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 76/80] usb: core: Solve race condition in anchor cleanup functions Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 77/80] scsi: ufs: ufs-qcom: Fix race conditions caused by ufs_qcom_testbus_config() Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 78/80] dmaengine: dw: Add DMA-channels mask cell support Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 79/80] dmaengine: dw: Activate FIFO-mode for memory peripherals only Sasha Levin
2020-10-18 19:22 ` [PATCH AUTOSEL 5.4 80/80] ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() Sasha Levin
2020-10-18 19:22   ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201018192231.4054535-25-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=aahringo@redhat.com \
    --cc=cluster-devel@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=teigland@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.