Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754135AbbLJBRK (ORCPT ); Wed, 9 Dec 2015 20:17:10 -0500 Received: from userp1040.oracle.com ([156.151.31.81]:40530 "EHLO userp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754028AbbLJBRI (ORCPT ); Wed, 9 Dec 2015 20:17:08 -0500 From: Bob Liu To: xen-devel@lists.xenproject.org Cc: konrad.wilk@oracle.com, roger.pau@citrix.com, linux-kernel@vger.kernel.org, Bob Liu Subject: [PATCH] xen-blkback: fix two memleaks Date: Thu, 10 Dec 2015 09:16:48 +0800 Message-Id: <1449710208-7806-1-git-send-email-bob.liu@oracle.com> X-Mailer: git-send-email 1.7.10.4 X-Source-IP: aserv0022.oracle.com [141.146.126.234] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3351 Lines: 95 This patch fixs two memleaks in konrad/xen.git/for-jens-4.5. backtrace: [] kmemleak_alloc+0x28/0x50 [] kmem_cache_alloc+0xbb/0x1d0 [] xen_blkbk_probe+0x58/0x230 [] xenbus_dev_probe+0x76/0x130 [] driver_probe_device+0x166/0x2c0 [] __device_attach_driver+0xac/0xb0 [] bus_for_each_drv+0x67/0x90 [] __device_attach+0xc7/0x120 [] device_initial_probe+0x13/0x20 [] bus_probe_device+0x9a/0xb0 [] device_add+0x3b1/0x5c0 [] device_register+0x1e/0x30 [] xenbus_probe_node+0x158/0x170 [] xenbus_dev_changed+0x1af/0x1c0 [] backend_changed+0x1b/0x20 [] xenwatch_thread+0xb6/0x160 unreferenced object 0xffff880007ba8ef8 (size 224): backtrace: [] kmemleak_alloc+0x28/0x50 [] __kmalloc+0xd3/0x1e0 [] frontend_changed+0x2c7/0x580 [] xenbus_otherend_changed+0xa2/0xb0 [] frontend_changed+0x10/0x20 [] xenwatch_thread+0xb6/0x160 [] kthread+0xd7/0xf0 [] ret_from_fork+0x3f/0x70 [] 0xffffffffffffffff unreferenced object 0xffff8800048dcd38 (size 224): The first leak is caused by not put the be->blkif reference got in xen_blkif_alloc(), while the second is not free blkif->rings in the right place. Signed-off-by: Bob Liu --- drivers/block/xen-blkback/xenbus.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c index 44396b8..dabdb18 100644 --- a/drivers/block/xen-blkback/xenbus.c +++ b/drivers/block/xen-blkback/xenbus.c @@ -246,6 +246,9 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) struct pending_req *req, *n; unsigned int j, r; + if (!blkif->rings) + goto out; + for (r = 0; r < blkif->nr_rings; r++) { struct xen_blkif_ring *ring = &blkif->rings[r]; unsigned int i = 0; @@ -299,7 +302,14 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages)); } blkif->nr_ring_pages = 0; + /* + * blkif->rings was allocated in connect_ring, so we should free it in + * disconnect. + */ + kfree(blkif->rings); + blkif->rings = NULL; +out: return 0; } @@ -310,7 +320,6 @@ static void xen_blkif_free(struct xen_blkif *blkif) xen_vbd_free(&blkif->vbd); /* Make sure everything is drained before shutting down */ - kfree(blkif->rings); kmem_cache_free(xen_blkif_cachep, blkif); } @@ -505,6 +514,8 @@ static int xen_blkbk_remove(struct xenbus_device *dev) xen_blkif_put(be->blkif); } + /* Put the reference got in xen_blkif_alloc(). */ + xen_blkif_put(be->blkif); kfree(be->mode); kfree(be); return 0; -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/