linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] atm: idt77252: fix kmemleak when rmmod idt77252
@ 2023-03-17  3:52 Li Zetao
  2023-03-19  0:28 ` Francois Romieu
  2023-03-20 14:33 ` [PATCH v2] " Li Zetao
  0 siblings, 2 replies; 4+ messages in thread
From: Li Zetao @ 2023-03-17  3:52 UTC (permalink / raw)
  To: 3chas3; +Cc: lizetao1, linux-atm-general, netdev, linux-kernel

There are memory leaks reported by kmemleak:

  unreferenced object 0xffff888106500800 (size 128):
    comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s)
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace:
      [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380
      [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0
      [<000000000e947e2a>] idt77252_init_one+0x2847/0x3c90 [idt77252]
      [<000000006efb048e>] local_pci_probe+0xeb/0x1a0
    ...

  unreferenced object 0xffff888106500b00 (size 128):
    comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s)
    hex dump (first 32 bytes):
      00 20 3d 01 80 88 ff ff 00 20 3d 01 80 88 ff ff  . =...... =.....
      f0 23 3d 01 80 88 ff ff 00 20 3d 01 00 00 00 00  .#=...... =.....
    backtrace:
      [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380
      [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0
      [<00000000f451c5be>] alloc_scq.constprop.0+0x4a/0x400 [idt77252]
      [<00000000e6313849>] idt77252_init_one+0x28cf/0x3c90 [idt77252]

The root cause is traced to the vc_maps which alloced in open_card_oam()
are not freed in close_card_oam(). The vc_maps are used to record
open connections, so when close a vc_map in close_card_oam(), the memory
should be freed. Moreover, the ubr0 is not closed when close a idt77252
device, leading to the memory leak of vc_map and scq_info.

Fix them by adding kfree in close_card_oam() and implementing new
close_card_ubr0() to close ubr0.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Li Zetao <lizetao1@huawei.com>
---
 drivers/atm/idt77252.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index eec0cc2144e0..060f32b0def3 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -2909,6 +2909,7 @@ close_card_oam(struct idt77252_dev *card)
 
 				recycle_rx_pool_skb(card, &vc->rcv.rx_pool);
 			}
+			kfree(vc);
 		}
 	}
 }
@@ -2952,6 +2953,16 @@ open_card_ubr0(struct idt77252_dev *card)
 	return 0;
 }
 
+static void
+close_card_ubr0(struct idt77252_dev *card)
+{
+	struct vc_map *vc;
+
+	vc = card->vcs[0];
+	free_scq(card, vc->scq);
+	kfree(vc);
+}
+
 static int
 idt77252_dev_open(struct idt77252_dev *card)
 {
@@ -3001,6 +3012,7 @@ static void idt77252_dev_close(struct atm_dev *dev)
 	struct idt77252_dev *card = dev->dev_data;
 	u32 conf;
 
+	close_card_ubr0(card);
 	close_card_oam(card);
 
 	conf = SAR_CFG_RXPTH |	/* enable receive path           */
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH] atm: idt77252: fix kmemleak when rmmod idt77252
  2023-03-17  3:52 [PATCH] atm: idt77252: fix kmemleak when rmmod idt77252 Li Zetao
@ 2023-03-19  0:28 ` Francois Romieu
  2023-03-20 14:33 ` [PATCH v2] " Li Zetao
  1 sibling, 0 replies; 4+ messages in thread
From: Francois Romieu @ 2023-03-19  0:28 UTC (permalink / raw)
  To: Li Zetao; +Cc: 3chas3, netdev, linux-kernel

Li Zetao <lizetao1@huawei.com> :
> There are memory leaks reported by kmemleak:
[...]
> diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
> index eec0cc2144e0..060f32b0def3 100644
> --- a/drivers/atm/idt77252.c
> +++ b/drivers/atm/idt77252.c
[...]
> @@ -2952,6 +2953,16 @@ open_card_ubr0(struct idt77252_dev *card)
>  	return 0;
>  }
>  
> +static void
> +close_card_ubr0(struct idt77252_dev *card)
> +{
> +	struct vc_map *vc;
> +
> +	vc = card->vcs[0];

Nit:
+	struct vc_map *vc = card->vcs[0];

I have not found any opportunity for a double free related to the patch.

So, other than the nit above:

Reviewed-by: Francois Romieu <romieu@fr.zoreil.com>

FWIW
- the driver leaks on error in open_card_ubr0.
- some forward declarations (alloc_scq, free_scq, etc.) are useless.
- struct idt77252_dev.next is useless. It was probably cargo-culted from
  some driver while hoping to enumerate devices (not that uncommon the
  early 2000). PCI driver registeering could thus look more idiomatic.
- deinit_card can be called two times in an error path and trigger a BUG_ON
  in atm_dev_deregister.

-- 
Ueimor

^ permalink raw reply	[flat|nested] 4+ messages in thread
* [PATCH v2] atm: idt77252: fix kmemleak when rmmod idt77252
  2023-03-17  3:52 [PATCH] atm: idt77252: fix kmemleak when rmmod idt77252 Li Zetao
  2023-03-19  0:28 ` Francois Romieu
@ 2023-03-20 14:33 ` Li Zetao
  2023-03-22  4:20   ` patchwork-bot+netdevbpf
  1 sibling, 1 reply; 4+ messages in thread
From: Li Zetao @ 2023-03-20 14:33 UTC (permalink / raw)
  To: lizetao1; +Cc: 3chas3, linux-atm-general, linux-kernel, netdev, Francois Romieu

There are memory leaks reported by kmemleak:

  unreferenced object 0xffff888106500800 (size 128):
    comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s)
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace:
      [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380
      [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0
      [<000000000e947e2a>] idt77252_init_one+0x2847/0x3c90 [idt77252]
      [<000000006efb048e>] local_pci_probe+0xeb/0x1a0
    ...

  unreferenced object 0xffff888106500b00 (size 128):
    comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s)
    hex dump (first 32 bytes):
      00 20 3d 01 80 88 ff ff 00 20 3d 01 80 88 ff ff  . =...... =.....
      f0 23 3d 01 80 88 ff ff 00 20 3d 01 00 00 00 00  .#=...... =.....
    backtrace:
      [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380
      [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0
      [<00000000f451c5be>] alloc_scq.constprop.0+0x4a/0x400 [idt77252]
      [<00000000e6313849>] idt77252_init_one+0x28cf/0x3c90 [idt77252]

The root cause is traced to the vc_maps which alloced in open_card_oam()
are not freed in close_card_oam(). The vc_maps are used to record
open connections, so when close a vc_map in close_card_oam(), the memory
should be freed. Moreover, the ubr0 is not closed when close a idt77252
device, leading to the memory leak of vc_map and scq_info.

Fix them by adding kfree in close_card_oam() and implementing new
close_card_ubr0() to close ubr0.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Li Zetao <lizetao1@huawei.com>
Reviewed-by: Francois Romieu <romieu@fr.zoreil.com>
---
v1 was posted at: https://lore.kernel.org/all/20230317035228.2635209-1-lizetao1@huawei.com/
v1 -> v2: assignment when "vc" variable is declared

 drivers/atm/idt77252.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
index eec0cc2144e0..e327a0229dc1 100644
--- a/drivers/atm/idt77252.c
+++ b/drivers/atm/idt77252.c
@@ -2909,6 +2909,7 @@ close_card_oam(struct idt77252_dev *card)
 
 				recycle_rx_pool_skb(card, &vc->rcv.rx_pool);
 			}
+			kfree(vc);
 		}
 	}
 }
@@ -2952,6 +2953,15 @@ open_card_ubr0(struct idt77252_dev *card)
 	return 0;
 }
 
+static void
+close_card_ubr0(struct idt77252_dev *card)
+{
+	struct vc_map *vc = card->vcs[0];
+
+	free_scq(card, vc->scq);
+	kfree(vc);
+}
+
 static int
 idt77252_dev_open(struct idt77252_dev *card)
 {
@@ -3001,6 +3011,7 @@ static void idt77252_dev_close(struct atm_dev *dev)
 	struct idt77252_dev *card = dev->dev_data;
 	u32 conf;
 
+	close_card_ubr0(card);
 	close_card_oam(card);
 
 	conf = SAR_CFG_RXPTH |	/* enable receive path           */
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread
* Re: [PATCH v2] atm: idt77252: fix kmemleak when rmmod idt77252
  2023-03-20 14:33 ` [PATCH v2] " Li Zetao
@ 2023-03-22  4:20   ` patchwork-bot+netdevbpf
  0 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-03-22  4:20 UTC (permalink / raw)
  To: Li Zetao; +Cc: 3chas3, linux-atm-general, linux-kernel, netdev, romieu

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 20 Mar 2023 14:33:18 +0000 you wrote:
> There are memory leaks reported by kmemleak:
> 
>   unreferenced object 0xffff888106500800 (size 128):
>     comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s)
>     hex dump (first 32 bytes):
>       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>       00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     backtrace:
>       [<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380
>       [<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0
>       [<000000000e947e2a>] idt77252_init_one+0x2847/0x3c90 [idt77252]
>       [<000000006efb048e>] local_pci_probe+0xeb/0x1a0
>     ...
> 
> [...]

Here is the summary with links:
  - [v2] atm: idt77252: fix kmemleak when rmmod idt77252
    https://git.kernel.org/netdev/net/c/4fe3c88552a3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-03-22  4:20 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-17  3:52 [PATCH] atm: idt77252: fix kmemleak when rmmod idt77252 Li Zetao
2023-03-19  0:28 ` Francois Romieu
2023-03-20 14:33 ` [PATCH v2] " Li Zetao
2023-03-22  4:20   ` patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).