2020-01-20 04:50:02

by Kevin Hao

[permalink] [raw]
Subject: [PATCH] irqdomain: Fix a memory leak in irq_domain_push_irq()

Fix a memory leak reported by kmemleak:
unreferenced object 0xffff000bc6f50e80 (size 128):
comm "kworker/23:2", pid 201, jiffies 4294894947 (age 942.132s)
hex dump (first 32 bytes):
00 00 00 00 41 00 00 00 86 c0 03 00 00 00 00 00 ....A...........
00 a0 b2 c6 0b 00 ff ff 40 51 fd 10 00 80 ff ff ........@Q......
backtrace:
[<00000000e62d2240>] kmem_cache_alloc_trace+0x1a4/0x320
[<00000000279143c9>] irq_domain_push_irq+0x7c/0x188
[<00000000d9f4c154>] thunderx_gpio_probe+0x3ac/0x438
[<00000000fd09ec22>] pci_device_probe+0xe4/0x198
[<00000000d43eca75>] really_probe+0xdc/0x320
[<00000000d3ebab09>] driver_probe_device+0x5c/0xf0
[<000000005b3ecaa0>] __device_attach_driver+0x88/0xc0
[<000000004e5915f5>] bus_for_each_drv+0x7c/0xc8
[<0000000079d4db41>] __device_attach+0xe4/0x140
[<00000000883bbda9>] device_initial_probe+0x18/0x20
[<000000003be59ef6>] bus_probe_device+0x98/0xa0
[<0000000039b03d3f>] deferred_probe_work_func+0x74/0xa8
[<00000000870934ce>] process_one_work+0x1c8/0x470
[<00000000e3cce570>] worker_thread+0x1f8/0x428
[<000000005d64975e>] kthread+0xfc/0x128
[<00000000f0eaa764>] ret_from_fork+0x10/0x18

Fixes: 495c38d3001f ("irqdomain: Add irq_domain_{push,pop}_irq() functions")
Cc: [email protected]
Signed-off-by: Kevin Hao <[email protected]>
---
kernel/irq/irqdomain.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index dd822fd8a7d5..480df3659720 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1459,6 +1459,7 @@ int irq_domain_push_irq(struct irq_domain *domain, int virq, void *arg)
if (rv) {
/* Restore the original irq_data. */
*root_irq_data = *child_irq_data;
+ kfree(child_irq_data);
goto error;
}

--
2.14.4


2020-01-20 08:10:24

by Marc Zyngier

[permalink] [raw]
Subject: Re: [PATCH] irqdomain: Fix a memory leak in irq_domain_push_irq()

On Mon, 20 Jan 2020 12:35:47 +0800
Kevin Hao <[email protected]> wrote:

> Fix a memory leak reported by kmemleak:
> unreferenced object 0xffff000bc6f50e80 (size 128):
> comm "kworker/23:2", pid 201, jiffies 4294894947 (age 942.132s)
> hex dump (first 32 bytes):
> 00 00 00 00 41 00 00 00 86 c0 03 00 00 00 00 00 ....A...........
> 00 a0 b2 c6 0b 00 ff ff 40 51 fd 10 00 80 ff ff ........@Q......
> backtrace:
> [<00000000e62d2240>] kmem_cache_alloc_trace+0x1a4/0x320
> [<00000000279143c9>] irq_domain_push_irq+0x7c/0x188
> [<00000000d9f4c154>] thunderx_gpio_probe+0x3ac/0x438
> [<00000000fd09ec22>] pci_device_probe+0xe4/0x198
> [<00000000d43eca75>] really_probe+0xdc/0x320
> [<00000000d3ebab09>] driver_probe_device+0x5c/0xf0
> [<000000005b3ecaa0>] __device_attach_driver+0x88/0xc0
> [<000000004e5915f5>] bus_for_each_drv+0x7c/0xc8
> [<0000000079d4db41>] __device_attach+0xe4/0x140
> [<00000000883bbda9>] device_initial_probe+0x18/0x20
> [<000000003be59ef6>] bus_probe_device+0x98/0xa0
> [<0000000039b03d3f>] deferred_probe_work_func+0x74/0xa8
> [<00000000870934ce>] process_one_work+0x1c8/0x470
> [<00000000e3cce570>] worker_thread+0x1f8/0x428
> [<000000005d64975e>] kthread+0xfc/0x128
> [<00000000f0eaa764>] ret_from_fork+0x10/0x18
>
> Fixes: 495c38d3001f ("irqdomain: Add irq_domain_{push,pop}_irq() functions")
> Cc: [email protected]
> Signed-off-by: Kevin Hao <[email protected]>
> ---
> kernel/irq/irqdomain.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
> index dd822fd8a7d5..480df3659720 100644
> --- a/kernel/irq/irqdomain.c
> +++ b/kernel/irq/irqdomain.c
> @@ -1459,6 +1459,7 @@ int irq_domain_push_irq(struct irq_domain *domain, int virq, void *arg)
> if (rv) {
> /* Restore the original irq_data. */
> *root_irq_data = *child_irq_data;
> + kfree(child_irq_data);
> goto error;
> }
>

Nice catch. I'll queue this for 5.6.

Thanks,

M.
--
Jazz is not dead. It just smells funny...

Subject: [tip: irq/core] irqdomain: Fix a memory leak in irq_domain_push_irq()

The following commit has been merged into the irq/core branch of tip:

Commit-ID: 0f394daef89b38d58c91118a2b08b8a1b316703b
Gitweb: https://git.kernel.org/tip/0f394daef89b38d58c91118a2b08b8a1b316703b
Author: Kevin Hao <[email protected]>
AuthorDate: Mon, 20 Jan 2020 12:35:47 +08:00
Committer: Marc Zyngier <[email protected]>
CommitterDate: Mon, 20 Jan 2020 19:10:05

irqdomain: Fix a memory leak in irq_domain_push_irq()

Fix a memory leak reported by kmemleak:
unreferenced object 0xffff000bc6f50e80 (size 128):
comm "kworker/23:2", pid 201, jiffies 4294894947 (age 942.132s)
hex dump (first 32 bytes):
00 00 00 00 41 00 00 00 86 c0 03 00 00 00 00 00 ....A...........
00 a0 b2 c6 0b 00 ff ff 40 51 fd 10 00 80 ff ff ........@Q......
backtrace:
[<00000000e62d2240>] kmem_cache_alloc_trace+0x1a4/0x320
[<00000000279143c9>] irq_domain_push_irq+0x7c/0x188
[<00000000d9f4c154>] thunderx_gpio_probe+0x3ac/0x438
[<00000000fd09ec22>] pci_device_probe+0xe4/0x198
[<00000000d43eca75>] really_probe+0xdc/0x320
[<00000000d3ebab09>] driver_probe_device+0x5c/0xf0
[<000000005b3ecaa0>] __device_attach_driver+0x88/0xc0
[<000000004e5915f5>] bus_for_each_drv+0x7c/0xc8
[<0000000079d4db41>] __device_attach+0xe4/0x140
[<00000000883bbda9>] device_initial_probe+0x18/0x20
[<000000003be59ef6>] bus_probe_device+0x98/0xa0
[<0000000039b03d3f>] deferred_probe_work_func+0x74/0xa8
[<00000000870934ce>] process_one_work+0x1c8/0x470
[<00000000e3cce570>] worker_thread+0x1f8/0x428
[<000000005d64975e>] kthread+0xfc/0x128
[<00000000f0eaa764>] ret_from_fork+0x10/0x18

Fixes: 495c38d3001f ("irqdomain: Add irq_domain_{push,pop}_irq() functions")
Signed-off-by: Kevin Hao <[email protected]>
Signed-off-by: Marc Zyngier <[email protected]>
Cc: [email protected]
Link: https://lore.kernel.org/r/[email protected]
---
kernel/irq/irqdomain.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index 7a8808c..7527e5e 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -1476,6 +1476,7 @@ int irq_domain_push_irq(struct irq_domain *domain, int virq, void *arg)
if (rv) {
/* Restore the original irq_data. */
*root_irq_data = *child_irq_data;
+ kfree(child_irq_data);
goto error;
}