From: Yang Yingliang <yangyingliang@huawei.com>
To: Luben Tuikov <luben.tuikov@amd.com>,
Greg KH <gregkh@linuxfoundation.org>
Cc: <linux-kernel@vger.kernel.org>, <qemu-devel@nongnu.org>,
<linux-f2fs-devel@lists.sourceforge.net>,
<linux-erofs@lists.ozlabs.org>, <ocfs2-devel@oss.oracle.com>,
<linux-mtd@lists.infradead.org>, <amd-gfx@lists.freedesktop.org>,
<rafael@kernel.org>, <somlo@cmu.edu>, <mst@redhat.com>,
<jaegeuk@kernel.org>, <chao@kernel.org>,
<hsiangkao@linux.alibaba.com>, <huangjianan@oppo.com>,
<mark@fasheh.com>, <jlbec@evilplan.org>,
<joseph.qi@linux.alibaba.com>, <akpm@linux-foundation.org>,
<alexander.deucher@amd.com>, <richard@nod.at>,
<liushixin2@huawei.com>
Subject: Re: [PATCH 00/11] fix memory leak while kset_register() fails
Date: Fri, 21 Oct 2022 17:23:04 +0800 [thread overview]
Message-ID: <e8e21756-c5b8-9098-8fb6-8e381bbf3dd1@huawei.com> (raw)
In-Reply-To: <19689b9e-16d1-c6c5-4ee8-58885fbf8fb0@amd.com>
On 2022/10/21 16:41, Luben Tuikov wrote:
> On 2022-10-21 04:24, Luben Tuikov wrote:
>> On 2022-10-21 04:18, Greg KH wrote:
>>> On Fri, Oct 21, 2022 at 03:55:18AM -0400, Luben Tuikov wrote:
>>>> On 2022-10-21 01:37, Greg KH wrote:
>>>>> On Fri, Oct 21, 2022 at 01:29:31AM -0400, Luben Tuikov wrote:
>>>>>> On 2022-10-20 22:20, Yang Yingliang wrote:
>>>>>>> The previous discussion link:
>>>>>>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flore.kernel.org%2Flkml%2F0db486eb-6927-927e-3629-958f8f211194%40huawei.com%2FT%2F&data=05%7C01%7Cluben.tuikov%40amd.com%7Cd41da3fd6449492d01f808dab33cdb75%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C638019371236833115%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=C%2Bj1THkHpzVGks5eqB%2Fm%2FPAkMRohR7CYvRnOCqUqdcM%3D&reserved=0
>>>>>> The very first discussion on this was here:
>>>>>>
>>>>>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.spinics.net%2Flists%2Fdri-devel%2Fmsg368077.html&data=05%7C01%7Cluben.tuikov%40amd.com%7Cd41da3fd6449492d01f808dab33cdb75%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C638019371236833115%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=pSR10abmK8nAMvKSezqWC0SPUBL4qEwtCCizyIKW7Dc%3D&reserved=0
>>>>>>
>>>>>> Please use this link, and not the that one up there you which quoted above,
>>>>>> and whose commit description is taken verbatim from the this link.
>>>>>>
>>>>>>> kset_register() is currently used in some places without calling
>>>>>>> kset_put() in error path, because the callers think it should be
>>>>>>> kset internal thing to do, but the driver core can not know what
>>>>>>> caller doing with that memory at times. The memory could be freed
>>>>>>> both in kset_put() and error path of caller, if it is called in
>>>>>>> kset_register().
>>>>>> As I explained in the link above, the reason there's
>>>>>> a memory leak is that one cannot call kset_register() without
>>>>>> the kset->kobj.name being set--kobj_add_internal() returns -EINVAL,
>>>>>> in this case, i.e. kset_register() fails with -EINVAL.
>>>>>>
>>>>>> Thus, the most common usage is something like this:
>>>>>>
>>>>>> kobj_set_name(&kset->kobj, format, ...);
>>>>>> kset->kobj.kset = parent_kset;
>>>>>> kset->kobj.ktype = ktype;
>>>>>> res = kset_register(kset);
>>>>>>
>>>>>> So, what is being leaked, is the memory allocated in kobj_set_name(),
>>>>>> by the common idiom shown above. This needs to be mentioned in
>>>>>> the documentation, at least, in case, in the future this is absolved
>>>>>> in kset_register() redesign, etc.
>>>>> Based on this, can kset_register() just clean up from itself when an
>>>>> error happens? Ideally that would be the case, as the odds of a kset
>>>>> being embedded in a larger structure is probably slim, but we would have
>>>>> to search the tree to make sure.
>>>> Looking at kset_register(), we can add kset_put() in the error path,
>>>> when kobject_add_internal(&kset->kobj) fails.
>>>>
>>>> See the attached patch. It needs to be tested with the same error injection
>>>> as Yang has been doing.
>>>>
>>>> Now, struct kset is being embedded in larger structs--see amdgpu_discovery.c
>>>> starting at line 575. If you're on an AMD system, it gets you the tree
>>>> structure you'll see when you run "tree /sys/class/drm/card0/device/ip_discovery/".
>>>> That shouldn't be a problem though.
>>> Yes, that shouldn't be an issue as the kobject embedded in a kset is
>>> ONLY for that kset itself, the kset structure should not be controling
>>> the lifespan of the object it is embedded in, right?
>> Yes, and it doesn't. It only does a kobject_get(parent) and kobject_put(parent).
>> So that's fine and natural.
>>
>> Yang, do you want to try the patch in my previous email in this thread, since you've
>> got the error injection set up already?
> I spoke too soon. I believe you're onto something, because looking at the idiom:
>
> kobj_set_name(&kset->kobj, format, ...);
> kset->kobj.kset = parent_kset;
> kset->kobj.ktype = ktype;
> res = kset_register(kset);
>
> The ktype defines a release method, which frees the larger struct the kset is embedded in.
> And this would result in double free, for instance in the amdgpu_discovery.c code, if
> kset_put() is called after kset_register() fails, since we kzalloc the larger object
> just before and kfree it on error just after. Ideally, we'd only "revert" the actions
> done by kobj_set_name(), as there's some error recovery on create_dir() in kobject_add_internal().
>
> So, we cannot do this business with the kset_put() on error from kset_register(), after all.
> Not sure how this wasn't caught in Yang's testing--the kernel should've complained.
I have already tried the change that in your posted patch when I was
debugging this issue
before sent these fixes, because it may lead double free in some cases,
and I had mentioned
it in this mail:
https://lore.kernel.org/lkml/0db486eb-6927-927e-3629-958f8f211194@huawei.com/T/#m68eade1993859dfc6c3d14d35f988d35a32ef837
Thanks,
Yang
>
> Regards,
> Luben
>
> .
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
next prev parent reply other threads:[~2022-10-21 9:23 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-21 2:20 [PATCH 00/11] fix memory leak while kset_register() fails Yang Yingliang
2022-10-21 2:20 ` [PATCH 01/11] kset: fix documentation for kset_register() Yang Yingliang
2022-10-21 5:34 ` Luben Tuikov
2022-10-21 8:05 ` Yang Yingliang
2022-10-21 8:16 ` Greg KH
2022-10-21 8:18 ` Luben Tuikov
2022-10-21 2:20 ` [PATCH 02/11] kset: add null pointer check in kset_put() Yang Yingliang
2022-10-21 2:20 ` [PATCH 03/11] bus: fix possible memory leak in bus_register() Yang Yingliang
2022-10-21 2:20 ` [PATCH 04/11] kobject: fix possible memory leak in kset_create_and_add() Yang Yingliang
2022-10-21 2:20 ` [PATCH 05/11] class: fix possible memory leak in __class_register() Yang Yingliang
2022-10-21 2:20 ` [PATCH 06/11] firmware: qemu_fw_cfg: fix possible memory leak in fw_cfg_build_symlink() Yang Yingliang
2022-10-21 2:20 ` [PATCH 07/11] f2fs: fix possible memory leak in f2fs_init_sysfs() Yang Yingliang
2022-10-21 2:20 ` [PATCH 08/11] erofs: fix possible memory leak in erofs_init_sysfs() Yang Yingliang
2022-10-21 2:21 ` [PATCH 09/11] ocfs2: possible memory leak in mlog_sys_init() Yang Yingliang
2022-10-21 2:21 ` [PATCH 10/11] drm/amdgpu/discovery: fix possible memory leak Yang Yingliang
2022-10-21 2:21 ` [PATCH 11/11] ubifs: Fix memory leak in ubifs_sysfs_init() Yang Yingliang
2022-10-21 5:29 ` [PATCH 00/11] fix memory leak while kset_register() fails Luben Tuikov
2022-10-21 5:37 ` Greg KH
2022-10-21 7:55 ` Luben Tuikov
2022-10-21 8:18 ` Greg KH
2022-10-21 8:24 ` Luben Tuikov
2022-10-21 8:41 ` Luben Tuikov
2022-10-21 9:23 ` Yang Yingliang [this message]
2022-10-21 8:24 ` Yang Yingliang
2022-10-21 8:36 ` Greg KH
2022-10-21 8:52 ` Luben Tuikov
2022-10-21 8:59 ` Yang Yingliang
2022-10-21 9:08 ` Luben Tuikov
2022-10-21 9:56 ` Yang Yingliang
2022-10-21 23:45 ` Luben Tuikov
2022-10-21 9:12 ` Yang Yingliang
2022-10-21 23:48 ` Luben Tuikov
2022-10-21 7:25 ` Yang Yingliang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e8e21756-c5b8-9098-8fb6-8e381bbf3dd1@huawei.com \
--to=yangyingliang@huawei.com \
--cc=akpm@linux-foundation.org \
--cc=alexander.deucher@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=chao@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=hsiangkao@linux.alibaba.com \
--cc=huangjianan@oppo.com \
--cc=jaegeuk@kernel.org \
--cc=jlbec@evilplan.org \
--cc=joseph.qi@linux.alibaba.com \
--cc=linux-erofs@lists.ozlabs.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mtd@lists.infradead.org \
--cc=liushixin2@huawei.com \
--cc=luben.tuikov@amd.com \
--cc=mark@fasheh.com \
--cc=mst@redhat.com \
--cc=ocfs2-devel@oss.oracle.com \
--cc=qemu-devel@nongnu.org \
--cc=rafael@kernel.org \
--cc=richard@nod.at \
--cc=somlo@cmu.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).