All of lore.kernel.org
 help / color / mirror / Atom feed
From: Qian Cai <cai@redhat.com>
To: David Howells <dhowells@redhat.com>,
	Alexander Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2] pipe: Fix memory leaks in create_pipe_files()
Date: Wed, 30 Sep 2020 22:52:55 -0400	[thread overview]
Message-ID: <20201001025255.29560-1-cai@redhat.com> (raw)

Calling pipe2() with O_NOTIFICATION_PIPE could results in memory leaks
in an error path or CONFIG_WATCH_QUEUE=n. Plug them.

unreferenced object 0xc00000141114a0d8 (size 992):
  comm "trinity-c61", pid 1353192, jiffies 4296255779 (age 25989.560s)
  hex dump (first 32 bytes):
    80 11 00 00 e8 03 00 00 00 00 00 00 00 00 00 00  ................
    ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
  backtrace:
    [<00000000abff13d7>] kmem_cache_alloc+0x1b4/0x470
    [<000000009502e5d5>] alloc_inode+0xd0/0x130
    [<00000000ca1c1a21>] new_inode_pseudo+0x1c/0x80
new_inode_pseudo at fs/inode.c:932
    [<000000000c01d1d6>] create_pipe_files+0x48/0x2d0
get_pipe_inode at fs/pipe.c:874
(inlined by) create_pipe_files at fs/pipe.c:914
    [<00000000d13ff4c4>] __do_pipe_flags+0x50/0x120
__do_pipe_flags at fs/pipe.c:965
    [<0000000003941e42>] do_pipe2+0x3c/0x100
do_pipe2 at fs/pipe.c:1013
    [<00000000a006b818>] sys_pipe2+0x1c/0x30
__se_sys_pipe2 at fs/pipe.c:1028
    [<00000000a6925b55>] system_call_exception+0xf8/0x1d0
    [<000000001c6b0740>] system_call_common+0xe8/0x218
unreferenced object 0xc000001f575ce600 (size 512):
  comm "trinity-c61", pid 1353192, jiffies 4296255779 (age 25989.560s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de  .............N..
    ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff  ................
  backtrace:
    [<00000000d74d5e3a>] kmem_cache_alloc_trace+0x1c4/0x2d0
    [<0000000061cbc9cb>] alloc_pipe_info+0x88/0x2c0
kmalloc at include/linux/slab.h:554
(inlined by) kzalloc at include/linux/slab.h:666
(inlined by) alloc_pipe_info at fs/pipe.c:793
    [<00000000efd6129c>] create_pipe_files+0x6c/0x2d0
get_pipe_inode at fs/pipe.c:883
(inlined by) create_pipe_files at fs/pipe.c:914
    [<00000000d13ff4c4>] __do_pipe_flags+0x50/0x120
    [<0000000003941e42>] do_pipe2+0x3c/0x100
    [<00000000a006b818>] sys_pipe2+0x1c/0x30
    [<00000000a6925b55>] system_call_exception+0xf8/0x1d0
    [<000000001c6b0740>] system_call_common+0xe8/0x218
unreferenced object 0xc000000d94f20400 (size 1024):
  comm "trinity-c61", pid 1353192, jiffies 4296255779 (age 25989.560s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000e60ee00f>] __kmalloc+0x1e4/0x330
    [<00000000130e8cc8>] alloc_pipe_info+0x154/0x2c0
kmalloc_array at include/linux/slab.h:594
(inlined by) kcalloc at include/linux/slab.h:605
(inlined by) alloc_pipe_info at fs/pipe.c:810
    [<00000000efd6129c>] create_pipe_files+0x6c/0x2d0
    [<00000000d13ff4c4>] __do_pipe_flags+0x50/0x120
    [<0000000003941e42>] do_pipe2+0x3c/0x100
    [<00000000a006b818>] sys_pipe2+0x1c/0x30
    [<00000000a6925b55>] system_call_exception+0xf8/0x1d0
    [<000000001c6b0740>] system_call_common+0xe8/0x218

Fixes: c73be61cede5 ("pipe: Add general notification queue support")
Signed-off-by: Qian Cai <cai@redhat.com>
---
 fs/pipe.c                   | 11 +++++------
 include/linux/watch_queue.h |  4 ++++
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/fs/pipe.c b/fs/pipe.c
index 60dbee457143..6fbfbb8f32e1 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -913,19 +913,18 @@ int create_pipe_files(struct file **res, int flags)
 {
 	struct inode *inode = get_pipe_inode();
 	struct file *f;
+	int ret;
 
 	if (!inode)
 		return -ENFILE;
 
 	if (flags & O_NOTIFICATION_PIPE) {
-#ifdef CONFIG_WATCH_QUEUE
-		if (watch_queue_init(inode->i_pipe) < 0) {
+		ret = watch_queue_init(inode->i_pipe);
+		if (ret < 0) {
+			free_pipe_info(inode->i_pipe);
 			iput(inode);
-			return -ENOMEM;
+			return ret;
 		}
-#else
-		return -ENOPKG;
-#endif
 	}
 
 	f = alloc_file_pseudo(inode, pipe_mnt, "",
diff --git a/include/linux/watch_queue.h b/include/linux/watch_queue.h
index 5e08db2adc31..20665fbe0552 100644
--- a/include/linux/watch_queue.h
+++ b/include/linux/watch_queue.h
@@ -123,5 +123,9 @@ static inline void remove_watch_list(struct watch_list *wlist, u64 id)
 #define watch_sizeof(STRUCT) (sizeof(STRUCT) << WATCH_INFO_LENGTH__SHIFT)
 
 #endif
+static inline int watch_queue_init(struct pipe_inode_info *pipe)
+{
+	return -ENOPKG;
+}
 
 #endif /* _LINUX_WATCH_QUEUE_H */
-- 
2.28.0


             reply	other threads:[~2020-10-01  2:53 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-01  2:52 Qian Cai [this message]
2020-10-01  3:04 ` [PATCH v2] pipe: Fix memory leaks in create_pipe_files() Eric Biggers
2020-10-01  7:03 ` kernel test robot
2020-10-01  7:03   ` kernel test robot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201001025255.29560-1-cai@redhat.com \
    --to=cai@redhat.com \
    --cc=dhowells@redhat.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.