2020-06-23 04:17:12

by Carl Huang

Subject: [PATCH] net: qrtr: free flow in __qrtr_node_release

The flow is allocated in qrtr_tx_wait, but not freed when qrtr node
is released. (*slot) becomes NULL after radix_tree_iter_delete is
called in __qrtr_node_release. The fix is to save (*slot) to a
vairable and then free it.

This memory leak is catched when kmemleak is enabled in kernel,
the report looks like below:

unreferenced object 0xffffa0de69e08420 (size 32):
comm "kworker/u16:3", pid 176, jiffies 4294918275 (age 82858.876s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 28 84 e0 69 de a0 ff ff ........(..i....
28 84 e0 69 de a0 ff ff 03 00 00 00 00 00 00 00 (..i............
backtrace:
[<00000000e252af0a>] qrtr_node_enqueue+0x38e/0x400 [qrtr]
[<000000009cea437f>] qrtr_sendmsg+0x1e0/0x2a0 [qrtr]
[<000000008bddbba4>] sock_sendmsg+0x5b/0x60
[<0000000003beb43a>] qmi_send_message.isra.3+0xbe/0x110 [qmi_helpers]
[<000000009c9ae7de>] qmi_send_request+0x1c/0x20 [qmi_helpers]

Signed-off-by: Carl Huang <[email protected]>
---
net/qrtr/qrtr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index 2d8d613..1855857 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -168,6 +168,7 @@ static void __qrtr_node_release(struct kref *kref)
struct radix_tree_iter iter;
unsigned long flags;
void __rcu **slot;
+ struct qrtr_tx_flow *flow;

spin_lock_irqsave(&qrtr_nodes_lock, flags);
if (node->nid != QRTR_EP_NID_AUTO)
@@ -181,8 +182,9 @@ static void __qrtr_node_release(struct kref *kref)

/* Free tx flow counters */
radix_tree_for_each_slot(slot, &node->qrtr_tx_flow, &iter, 0) {
+ flow = *slot;
radix_tree_iter_delete(&node->qrtr_tx_flow, &iter, slot);
- kfree(*slot);
+ kfree(flow);
}
kfree(node);
}
--
2.7.4

2020-06-24 03:27:14

by David Miller

Subject: Re: [PATCH] net: qrtr: free flow in __qrtr_node_release

From: Carl Huang <[email protected]>
Date: Tue, 23 Jun 2020 11:22:03 +0800

> @@ -168,6 +168,7 @@ static void __qrtr_node_release(struct kref *kref)
> struct radix_tree_iter iter;
> unsigned long flags;
> void __rcu **slot;
> + struct qrtr_tx_flow *flow;

Please retain the reverse christmas tree ordering of local variables here.

Thanks.

2020-06-29 19:19:48

by Carl Huang

Subject: Re: [PATCH] net: qrtr: free flow in __qrtr_node_release

On 2020-06-24 11:26, David Miller wrote:
> From: Carl Huang <[email protected]>
> Date: Tue, 23 Jun 2020 11:22:03 +0800
>
>> @@ -168,6 +168,7 @@ static void __qrtr_node_release(struct kref *kref)
>> struct radix_tree_iter iter;
>> unsigned long flags;
>> void __rcu **slot;
>> + struct qrtr_tx_flow *flow;
>
> Please retain the reverse christmas tree ordering of local variables
> here.

OK. Will send V2 for it.

>
> Thanks.