From: Pavel Skripkin <paskripkin@gmail.com>
To: Dan Carpenter <dan.carpenter@oracle.com>,
Yanfei Xu <yanfei.xu@windriver.com>,
Bartosz Golaszewski <bgolaszewski@baylibre.com>
Cc: andrew@lunn.ch, hkallweit1@gmail.com, linux@armlinux.org.uk,
davem@davemloft.net, kuba@kernel.org, p.zabel@pengutronix.de,
syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
Dongliang Mu <mudongliangabcd@gmail.com>
Subject: Re: [PATCH] net: mdiobus: Fix memory leak in __mdiobus_register
Date: Tue, 28 Sep 2021 12:45:18 +0300 [thread overview]
Message-ID: <6f90fa0f-6d3b-0ca7-e894-eb971b3b69fa@gmail.com> (raw)
In-Reply-To: <20210928092657.GI2048@kadam>
On 9/28/21 12:26, Dan Carpenter wrote:
> On Tue, Sep 28, 2021 at 11:55:49AM +0300, Dan Carpenter wrote:
>> I don't have a solution. I have commented before that I hate kobjects
>> for this reason because they lead to unfixable memory leaks during
>> probe. But this leak will only happen with fault injection and so it
>> doesn't affect real life. And even if it did, a leak it preferable to a
>> crash.
>
> The fix for this should have gone in devm_of_mdiobus_register() but it's
> quite tricky.
>
> drivers/net/phy/mdio_devres.c
> 106 int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio,
> 107 struct device_node *np)
> 108 {
> 109 struct mdiobus_devres *dr;
> 110 int ret;
> 111
> 112 if (WARN_ON(!devres_find(dev, devm_mdiobus_free,
> 113 mdiobus_devres_match, mdio)))
> 114 return -EINVAL;
>
> This leaks the bus. Fix this leak by calling mdiobus_release(mdio);
>
> 115
> 116 dr = devres_alloc(devm_mdiobus_unregister, sizeof(*dr), GFP_KERNEL);
> 117 if (!dr)
> 118 return -ENOMEM;
>
> Fix this path by calling mdiobus_release(mdio);
>
> 119
> 120 ret = of_mdiobus_register(mdio, np);
> 121 if (ret) {
>
> Ideally here we can could call device_put(mdio), but that won't work for
> the one error path that occurs before device_initialize(). /* Do not
> continue if the node is disabled */.
>
> Maybe the code could be modified to call device_initialize() on the
> error path? Sort of ugly but it would work.
>
> 122 devres_free(dr);
> 123 return ret;
> 124 }
> 125
> 126 dr->mii = mdio;
> 127 devres_add(dev, dr);
> 128 return 0;
> 129 }
>
> Then audit the callers, and there is only one which references the
> mdio_bus after devm_of_mdiobus_register() fails. It's
> realtek_smi_setup_mdio(). Modify that debug statement.
>
Thank you, Dan, for analysis, and it sounds reasonable to me.
Back to bug reported by syzbot: error happened in other place:
int __mdiobus_register(struct mii_bus *bus, struct module *owner)
{
....
phydev = mdiobus_scan(bus, i); <-- here
if (IS_ERR(phydev) && (PTR_ERR(phydev) != -ENODEV)) {
err = PTR_ERR(phydev);
goto error;
}
....
}
(You can take a look at the log [1] you won't find error message about
mii_bus registration failure. I found this place while debugging locally)
So, Yanfei's patch is completely unrelated to bug reported by syzkaller
and Reported-by tag is also wrong.
Can you, please, take a look at [2]. I think, I found the root case of
the reported bug. Thank you :)
[1] https://syzkaller.appspot.com/text?tag=CrashLog&x=131c754b300000
[2]
https://lore.kernel.org/lkml/20210927112017.19108-1-paskripkin@gmail.com/
With regards,
Pavel Skripkin
next prev parent reply other threads:[~2021-09-28 9:45 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-26 4:53 [PATCH] net: mdiobus: Fix memory leak in __mdiobus_register Yanfei Xu
2021-09-26 15:34 ` Andrew Lunn
2021-09-27 12:30 ` patchwork-bot+netdevbpf
2021-09-28 8:55 ` Dan Carpenter
2021-09-28 9:26 ` Dan Carpenter
2021-09-28 9:45 ` Pavel Skripkin [this message]
2021-09-28 10:39 ` Dan Carpenter
2021-09-28 10:46 ` Pavel Skripkin
2021-09-28 10:55 ` Dan Carpenter
2021-09-28 11:04 ` Pavel Skripkin
2021-09-28 10:59 ` Dan Carpenter
2021-09-28 11:06 ` Pavel Skripkin
2021-09-28 11:09 ` Pavel Skripkin
2021-09-28 11:30 ` Dan Carpenter
2021-09-28 11:45 ` Pavel Skripkin
2021-09-28 12:23 ` Dan Carpenter
2021-09-28 12:58 ` Russell King (Oracle)
2021-09-28 13:52 ` Dan Carpenter
2021-09-28 15:41 ` Russell King (Oracle)
2021-09-28 15:48 ` Dongliang Mu
2021-09-29 2:05 ` Xu, Yanfei
2021-09-28 13:11 ` Russell King (Oracle)
2021-09-29 21:31 ` Denis Efremov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6f90fa0f-6d3b-0ca7-e894-eb971b3b69fa@gmail.com \
--to=paskripkin@gmail.com \
--cc=andrew@lunn.ch \
--cc=bgolaszewski@baylibre.com \
--cc=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=hkallweit1@gmail.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=mudongliangabcd@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=p.zabel@pengutronix.de \
--cc=syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com \
--cc=yanfei.xu@windriver.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).