From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED,USER_AGENT_MUTT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00260C04A6B for ; Sun, 12 May 2019 15:07:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CD70520873 for ; Sun, 12 May 2019 15:07:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726742AbfELPH3 (ORCPT ); Sun, 12 May 2019 11:07:29 -0400 Received: from mx1.redhat.com ([209.132.183.28]:41406 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726478AbfELPH3 (ORCPT ); Sun, 12 May 2019 11:07:29 -0400 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 66B913086275; Sun, 12 May 2019 15:07:28 +0000 (UTC) Received: from redhat.com (ovpn-120-196.rdu2.redhat.com [10.10.120.196]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 84A3860C47; Sun, 12 May 2019 15:07:26 +0000 (UTC) Date: Sun, 12 May 2019 11:07:24 -0400 From: Jerome Glisse To: Ralph Campbell Cc: Souptick Joarder , Linux-MM , linux-kernel@vger.kernel.org, John Hubbard , Ira Weiny , Dan Williams , Arnd Bergmann , Balbir Singh , Dan Carpenter , Matthew Wilcox , Andrew Morton Subject: Re: [PATCH 4/5] mm/hmm: hmm_vma_fault() doesn't always call hmm_range_unregister() Message-ID: <20190512150724.GA4238@redhat.com> References: <20190506232942.12623-1-rcampbell@nvidia.com> <20190506232942.12623-5-rcampbell@nvidia.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.11.4 (2019-03-13) X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.49]); Sun, 12 May 2019 15:07:28 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, May 07, 2019 at 11:12:14AM -0700, Ralph Campbell wrote: > > On 5/7/19 6:15 AM, Souptick Joarder wrote: > > On Tue, May 7, 2019 at 5:00 AM wrote: > > > > > > From: Ralph Campbell > > > > > > The helper function hmm_vma_fault() calls hmm_range_register() but is > > > missing a call to hmm_range_unregister() in one of the error paths. > > > This leads to a reference count leak and ultimately a memory leak on > > > struct hmm. > > > > > > Always call hmm_range_unregister() if hmm_range_register() succeeded. > > > > How about * Call hmm_range_unregister() in error path if > > hmm_range_register() succeeded* ? > > Sure, sounds good. > I'll include that in v2. NAK for the patch see below why > > > > > > > Signed-off-by: Ralph Campbell > > > Cc: John Hubbard > > > Cc: Ira Weiny > > > Cc: Dan Williams > > > Cc: Arnd Bergmann > > > Cc: Balbir Singh > > > Cc: Dan Carpenter > > > Cc: Matthew Wilcox > > > Cc: Souptick Joarder > > > Cc: Andrew Morton > > > --- > > > include/linux/hmm.h | 3 ++- > > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > > > diff --git a/include/linux/hmm.h b/include/linux/hmm.h > > > index 35a429621e1e..fa0671d67269 100644 > > > --- a/include/linux/hmm.h > > > +++ b/include/linux/hmm.h > > > @@ -559,6 +559,7 @@ static inline int hmm_vma_fault(struct hmm_range *range, bool block) > > > return (int)ret; > > > > > > if (!hmm_range_wait_until_valid(range, HMM_RANGE_DEFAULT_TIMEOUT)) { > > > + hmm_range_unregister(range); > > > /* > > > * The mmap_sem was taken by driver we release it here and > > > * returns -EAGAIN which correspond to mmap_sem have been > > > @@ -570,13 +571,13 @@ static inline int hmm_vma_fault(struct hmm_range *range, bool block) > > > > > > ret = hmm_range_fault(range, block); > > > if (ret <= 0) { > > > + hmm_range_unregister(range); > > > > what is the reason to moved it up ? > > I moved it up because the normal calling pattern is: > down_read(&mm->mmap_sem) > hmm_vma_fault() > hmm_range_register() > hmm_range_fault() > hmm_range_unregister() > up_read(&mm->mmap_sem) > > I don't think it is a bug to unlock mmap_sem and then unregister, > it is just more consistent nesting. So this is not the usage pattern with HMM usage pattern is: hmm_range_register() hmm_range_fault() hmm_range_unregister() The hmm_vma_fault() is gonne so this patch here break thing. See https://cgit.freedesktop.org/~glisse/linux/log/?h=hmm-5.2-v3