2022-04-27 11:12:44

by Zqiang

Subject: [PATCH] rcutorture: Fix kmemleak in rcu_test_debug_objects()

The kmemleak kthread scan to the following:

unreferenced object 0xffff95d941135b50 (size 16):
comm "swapper/0", pid 1, jiffies 4294667610 (age 1367.451s)
hex dump (first 16 bytes):
f0 c6 c2 bd d9 95 ff ff 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000bc81d9b1>] kmem_cache_alloc_trace+0x2f6/0x500
[<00000000d28be229>] rcu_torture_init+0x1235/0x1354
[<0000000032c3acd9>] do_one_initcall+0x51/0x210
[<000000003c117727>] kernel_init_freeable+0x205/0x259
[<000000003961f965>] kernel_init+0x1a/0x120
[<000000001998f890>] ret_from_fork+0x22/0x30

the rhp object is not released after use, so call kfree() to
release it.

Signed-off-by: Zqiang <[email protected]>
---
kernel/rcu/rcutorture.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index 0885a66f9d76..f3f9f97c3c1f 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -3183,6 +3183,7 @@ static void rcu_test_debug_objects(void)
pr_alert("%s: WARN: Duplicate call_rcu() test complete.\n", KBUILD_MODNAME);
destroy_rcu_head_on_stack(&rh1);
destroy_rcu_head_on_stack(&rh2);
+ kfree(rhp);
#else /* #ifdef CONFIG_DEBUG_OBJECTS_RCU_HEAD */
pr_alert("%s: !CONFIG_DEBUG_OBJECTS_RCU_HEAD, not testing duplicate call_rcu()\n", KBUILD_MODNAME);
#endif /* #else #ifdef CONFIG_DEBUG_OBJECTS_RCU_HEAD */
--
2.25.1

2022-04-29 16:26:37

by Paul E. McKenney

Subject: Re: [PATCH] rcutorture: Fix kmemleak in rcu_test_debug_objects()

On Wed, Apr 27, 2022 at 03:15:20PM +0800, Zqiang wrote:
> The kmemleak kthread scan to the following:
>
> unreferenced object 0xffff95d941135b50 (size 16):
> comm "swapper/0", pid 1, jiffies 4294667610 (age 1367.451s)
> hex dump (first 16 bytes):
> f0 c6 c2 bd d9 95 ff ff 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<00000000bc81d9b1>] kmem_cache_alloc_trace+0x2f6/0x500
> [<00000000d28be229>] rcu_torture_init+0x1235/0x1354
> [<0000000032c3acd9>] do_one_initcall+0x51/0x210
> [<000000003c117727>] kernel_init_freeable+0x205/0x259
> [<000000003961f965>] kernel_init+0x1a/0x120
> [<000000001998f890>] ret_from_fork+0x22/0x30
>
> the rhp object is not released after use, so call kfree() to
> release it.
>
> Signed-off-by: Zqiang <[email protected]>

Good catch, thank you!

I queued this for v5.20 with the wordsmithed commit log shown below.

Thanx, Paul

------------------------------------------------------------------------

commit 1a2df31f4026dbc8dc4db17a4c2ed01e67f45c92
Author: Zqiang <[email protected]>
Date: Wed Apr 27 15:15:20 2022 +0800

rcutorture: Fix memory leak in rcu_test_debug_objects()

The kernel memory leak detector located the following:

unreferenced object 0xffff95d941135b50 (size 16):
comm "swapper/0", pid 1, jiffies 4294667610 (age 1367.451s)
hex dump (first 16 bytes):
f0 c6 c2 bd d9 95 ff ff 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000bc81d9b1>] kmem_cache_alloc_trace+0x2f6/0x500
[<00000000d28be229>] rcu_torture_init+0x1235/0x1354
[<0000000032c3acd9>] do_one_initcall+0x51/0x210
[<000000003c117727>] kernel_init_freeable+0x205/0x259
[<000000003961f965>] kernel_init+0x1a/0x120
[<000000001998f890>] ret_from_fork+0x22/0x30

This is caused by the rcu_test_debug_objects() function allocating an
rcu_head structure, then failing to free it. This commit therefore adds
the needed kfree() after the last use of this structure.

Signed-off-by: Zqiang <[email protected]>
Signed-off-by: Paul E. McKenney <[email protected]>

diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c
index bb2e1610d0add..faf6b4c7a7572 100644
--- a/kernel/rcu/rcutorture.c
+++ b/kernel/rcu/rcutorture.c
@@ -3176,6 +3176,7 @@ static void rcu_test_debug_objects(void)
pr_alert("%s: WARN: Duplicate call_rcu() test complete.\n", KBUILD_MODNAME);
destroy_rcu_head_on_stack(&rh1);
destroy_rcu_head_on_stack(&rh2);
+ kfree(rhp);
#else /* #ifdef CONFIG_DEBUG_OBJECTS_RCU_HEAD */
pr_alert("%s: !CONFIG_DEBUG_OBJECTS_RCU_HEAD, not testing duplicate call_rcu()\n", KBUILD_MODNAME);
#endif /* #else #ifdef CONFIG_DEBUG_OBJECTS_RCU_HEAD */