2019-12-11 17:47:57

by Navid Emamdoost

Subject: [PATCH] mm/gup: Fix memory leak in __gup_benchmark_ioctl

In the implementation of __gup_benchmark_ioctl() the allocated pages
should be released before returning in case of an invalid cmd. Release
pages via kvfree().

Fixes: 714a3a1ebafe ("mm/gup_benchmark.c: add additional pinning methods")
Signed-off-by: Navid Emamdoost <[email protected]>
---
mm/gup_benchmark.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c
index 7dd602d7f8db..b160638f647e 100644
--- a/mm/gup_benchmark.c
+++ b/mm/gup_benchmark.c
@@ -63,6 +63,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
NULL);
break;
default:
+ kvfree(pages);
return -1;
}

--
2.17.1

2019-12-12 23:33:29

by Ira Weiny

Subject: Re: [PATCH] mm/gup: Fix memory leak in __gup_benchmark_ioctl

On Wed, Dec 11, 2019 at 11:46:51AM -0600, Navid Emamdoost wrote:
> In the implementation of __gup_benchmark_ioctl() the allocated pages
> should be released before returning in case of an invalid cmd. Release
> pages via kvfree().
>
> Fixes: 714a3a1ebafe ("mm/gup_benchmark.c: add additional pinning methods")
> Signed-off-by: Navid Emamdoost <[email protected]>
> ---
> mm/gup_benchmark.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c
> index 7dd602d7f8db..b160638f647e 100644
> --- a/mm/gup_benchmark.c
> +++ b/mm/gup_benchmark.c
> @@ -63,6 +63,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> NULL);
> break;
> default:
> + kvfree(pages);

I wonder if adding a ret value and a goto where the free is done would be
better. But may be overkill at this time. So...

Reviewed-by: Ira Weiny <[email protected]>

> return -1;
> }
>
> --
> 2.17.1
>

2019-12-13 21:41:33

by John Hubbard

Subject: Re: [PATCH] mm/gup: Fix memory leak in __gup_benchmark_ioctl

On 12/11/19 9:46 AM, Navid Emamdoost wrote:
> In the implementation of __gup_benchmark_ioctl() the allocated pages
> should be released before returning in case of an invalid cmd. Release
> pages via kvfree().
>
> Fixes: 714a3a1ebafe ("mm/gup_benchmark.c: add additional pinning methods")
> Signed-off-by: Navid Emamdoost <[email protected]>
> ---
> mm/gup_benchmark.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c
> index 7dd602d7f8db..b160638f647e 100644
> --- a/mm/gup_benchmark.c
> +++ b/mm/gup_benchmark.c
> @@ -63,6 +63,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> NULL);
> break;
> default:
> + kvfree(pages);
> return -1;
> }
>

Hi,

The patch is correct, but I would like to second Ira's request for a ret value,
and a "goto done" to use a single place to kvfree, if you don't mind.

Either way, you can add:

Reviewed-by: John Hubbard <[email protected]>

thanks,
--
John Hubbard
NVIDIA

2019-12-13 22:24:35

by Andrew Morton

Subject: Re: [PATCH] mm/gup: Fix memory leak in __gup_benchmark_ioctl

On Fri, 13 Dec 2019 13:40:15 -0800 John Hubbard <[email protected]> wrote:

> On 12/11/19 9:46 AM, Navid Emamdoost wrote:
> > In the implementation of __gup_benchmark_ioctl() the allocated pages
> > should be released before returning in case of an invalid cmd. Release
> > pages via kvfree().
> >
> > Fixes: 714a3a1ebafe ("mm/gup_benchmark.c: add additional pinning methods")
> > Signed-off-by: Navid Emamdoost <[email protected]>
> > ---
> > mm/gup_benchmark.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c
> > index 7dd602d7f8db..b160638f647e 100644
> > --- a/mm/gup_benchmark.c
> > +++ b/mm/gup_benchmark.c
> > @@ -63,6 +63,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> > NULL);
> > break;
> > default:
> > + kvfree(pages);
> > return -1;
> > }
> >
>
> Hi,
>
> The patch is correct, but I would like to second Ira's request for a ret value,
> and a "goto done" to use a single place to kvfree, if you don't mind.
>

Fair enough.

And let's make it return -EINVAL rather than -1, which appears to be
-EPERM.

--- a/mm/gup_benchmark.c~mm-gup-fix-memory-leak-in-__gup_benchmark_ioctl-fix
+++ a/mm/gup_benchmark.c
@@ -26,6 +26,7 @@ static int __gup_benchmark_ioctl(unsigne
unsigned long i, nr_pages, addr, next;
int nr;
struct page **pages;
+ int ret = 0;

if (gup->size > ULONG_MAX)
return -EINVAL;
@@ -64,7 +65,8 @@ static int __gup_benchmark_ioctl(unsigne
break;
default:
kvfree(pages);
- return -1;
+ ret = -EINVAL;
+ goto out;
}

if (nr <= 0)
@@ -86,7 +88,8 @@ static int __gup_benchmark_ioctl(unsigne
gup->put_delta_usec = ktime_us_delta(end_time, start_time);

kvfree(pages);
- return 0;
+out:
+ return ret;
}

static long gup_benchmark_ioctl(struct file *filep, unsigned int cmd,
_

2019-12-13 22:39:19

by Navid Emamdoost

Subject: [PATCH v2] mm/gup: Fix memory leak in __gup_benchmark_ioctl

In the implementation of __gup_benchmark_ioctl() the allocated pages
should be released before returning in case of an invalid cmd. Release
pages via kvfree() by goto done.

Fixes: 714a3a1ebafe ("mm/gup_benchmark.c: add additional pinning methods")
Signed-off-by: Navid Emamdoost <[email protected]>
---
Changes in v2:
-- added goto and ret value instead of return -1.
---
mm/gup_benchmark.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c
index b160638f647e..b773b2568544 100644
--- a/mm/gup_benchmark.c
+++ b/mm/gup_benchmark.c
@@ -24,7 +24,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
{
ktime_t start_time, end_time;
unsigned long i, nr_pages, addr, next;
- int nr;
+ int nr, ret = 0;
struct page **pages;

if (gup->size > ULONG_MAX)
@@ -63,8 +63,8 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
NULL);
break;
default:
- kvfree(pages);
- return -1;
+ ret = -EINVAL;
+ goto done;
}

if (nr <= 0)
@@ -85,8 +85,9 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
end_time = ktime_get();
gup->put_delta_usec = ktime_us_delta(end_time, start_time);

+done:
kvfree(pages);
- return 0;
+ return ret;
}

static long gup_benchmark_ioctl(struct file *filep, unsigned int cmd,
--
2.17.1

2019-12-13 22:41:20

by Navid Emamdoost

Subject: Re: [PATCH] mm/gup: Fix memory leak in __gup_benchmark_ioctl

On Fri, Dec 13, 2019 at 4:23 PM Andrew Morton <[email protected]> wrote:
>
> On Fri, 13 Dec 2019 13:40:15 -0800 John Hubbard <[email protected]> wrote:
>
> > On 12/11/19 9:46 AM, Navid Emamdoost wrote:
> > > In the implementation of __gup_benchmark_ioctl() the allocated pages
> > > should be released before returning in case of an invalid cmd. Release
> > > pages via kvfree().
> > >
> > > Fixes: 714a3a1ebafe ("mm/gup_benchmark.c: add additional pinning methods")
> > > Signed-off-by: Navid Emamdoost <[email protected]>
> > > ---
> > > mm/gup_benchmark.c | 1 +
> > > 1 file changed, 1 insertion(+)
> > >
> > > diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c
> > > index 7dd602d7f8db..b160638f647e 100644
> > > --- a/mm/gup_benchmark.c
> > > +++ b/mm/gup_benchmark.c
> > > @@ -63,6 +63,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> > > NULL);
> > > break;
> > > default:
> > > + kvfree(pages);
> > > return -1;
> > > }
> > >
> >
> > Hi,
> >
> > The patch is correct, but I would like to second Ira's request for a ret value,
> > and a "goto done" to use a single place to kvfree, if you don't mind.
> >
>
> Fair enough.
>
> And let's make it return -EINVAL rather than -1, which appears to be
> -EPERM.

Sure! patch v2 has been sent.
>
> --- a/mm/gup_benchmark.c~mm-gup-fix-memory-leak-in-__gup_benchmark_ioctl-fix
> +++ a/mm/gup_benchmark.c
> @@ -26,6 +26,7 @@ static int __gup_benchmark_ioctl(unsigne
> unsigned long i, nr_pages, addr, next;
> int nr;
> struct page **pages;
> + int ret = 0;
>
> if (gup->size > ULONG_MAX)
> return -EINVAL;
> @@ -64,7 +65,8 @@ static int __gup_benchmark_ioctl(unsigne
> break;
> default:
> kvfree(pages);
> - return -1;
> + ret = -EINVAL;
> + goto out;
> }
>
> if (nr <= 0)
> @@ -86,7 +88,8 @@ static int __gup_benchmark_ioctl(unsigne
> gup->put_delta_usec = ktime_us_delta(end_time, start_time);
>
> kvfree(pages);
> - return 0;
> +out:
> + return ret;
> }
>
> static long gup_benchmark_ioctl(struct file *filep, unsigned int cmd,
> _
>


--
Navid.

2019-12-13 23:14:33

by Ira Weiny

Subject: Re: [PATCH v2] mm/gup: Fix memory leak in __gup_benchmark_ioctl

On Fri, Dec 13, 2019 at 04:37:41PM -0600, Navid Emamdoost wrote:
> In the implementation of __gup_benchmark_ioctl() the allocated pages
> should be released before returning in case of an invalid cmd. Release
> pages via kvfree() by goto done.
>
> Fixes: 714a3a1ebafe ("mm/gup_benchmark.c: add additional pinning methods")
> Signed-off-by: Navid Emamdoost <[email protected]>

Reviewed-by: Ira Weiny <[email protected]>

> ---
> Changes in v2:
> -- added goto and ret value instead of return -1.
> ---
> mm/gup_benchmark.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c
> index b160638f647e..b773b2568544 100644
> --- a/mm/gup_benchmark.c
> +++ b/mm/gup_benchmark.c
> @@ -24,7 +24,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> {
> ktime_t start_time, end_time;
> unsigned long i, nr_pages, addr, next;
> - int nr;
> + int nr, ret = 0;
> struct page **pages;
>
> if (gup->size > ULONG_MAX)
> @@ -63,8 +63,8 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> NULL);
> break;
> default:
> - kvfree(pages);
> - return -1;
> + ret = -EINVAL;
> + goto done;
> }
>
> if (nr <= 0)
> @@ -85,8 +85,9 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> end_time = ktime_get();
> gup->put_delta_usec = ktime_us_delta(end_time, start_time);
>
> +done:
> kvfree(pages);
> - return 0;
> + return ret;
> }
>
> static long gup_benchmark_ioctl(struct file *filep, unsigned int cmd,
> --
> 2.17.1
>
>

2019-12-14 00:45:50

by John Hubbard

Subject: Re: [PATCH v2] mm/gup: Fix memory leak in __gup_benchmark_ioctl

On 12/13/19 2:37 PM, Navid Emamdoost wrote:
> In the implementation of __gup_benchmark_ioctl() the allocated pages
> should be released before returning in case of an invalid cmd. Release
> pages via kvfree() by goto done.
>
> Fixes: 714a3a1ebafe ("mm/gup_benchmark.c: add additional pinning methods")
> Signed-off-by: Navid Emamdoost <[email protected]>
> ---
> Changes in v2:
> -- added goto and ret value instead of return -1.
> ---
> mm/gup_benchmark.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>

Reviewed-by: John Hubbard <[email protected]>

thanks,
--
John Hubbard
NVIDIA

> diff --git a/mm/gup_benchmark.c b/mm/gup_benchmark.c
> index b160638f647e..b773b2568544 100644
> --- a/mm/gup_benchmark.c
> +++ b/mm/gup_benchmark.c
> @@ -24,7 +24,7 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> {
> ktime_t start_time, end_time;
> unsigned long i, nr_pages, addr, next;
> - int nr;
> + int nr, ret = 0;
> struct page **pages;
>
> if (gup->size > ULONG_MAX)
> @@ -63,8 +63,8 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> NULL);
> break;
> default:
> - kvfree(pages);
> - return -1;
> + ret = -EINVAL;
> + goto done;
> }
>
> if (nr <= 0)
> @@ -85,8 +85,9 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> end_time = ktime_get();
> gup->put_delta_usec = ktime_us_delta(end_time, start_time);
>
> +done:
> kvfree(pages);
> - return 0;
> + return ret;
> }
>
> static long gup_benchmark_ioctl(struct file *filep, unsigned int cmd,
>

2019-12-14 18:12:21

by Markus Elfring

Subject: Re: [PATCH v2] mm/gup: Fix memory leak in __gup_benchmark_ioctl

…
> +++ b/mm/gup_benchmark.c
…
> @@ -85,8 +85,9 @@ static int __gup_benchmark_ioctl(unsigned int cmd,
> end_time = ktime_get();
> gup->put_delta_usec = ktime_us_delta(end_time, start_time);
>
> +done:
> kvfree(pages);
> - return 0;
> + return ret;
> }
>
> static long gup_benchmark_ioctl(struct file *filep, unsigned int cmd,

Can the addition of a label like “free_pages” be more appropriate here?

Regards,
Markus