Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sat, 27 Apr 2019 18:13:30 +1000
From:   "Tobin C. Harding" <me@tobin.cc>
To:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        "Rafael J. Wysocki" <rafael@kernel.org>
Cc:     cl@linux.com, tycho@tycho.ws, willy@infradead.org,
        linux-kernel@vger.kernel.org
Subject: memleak around kobject_init_and_add()
Message-ID: <20190427081330.GA26788@eros.localdomain>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.11.4 (2019-03-13)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

(Note at bottom on reasons for 'To' list 'Cc' list)

Hi,

kobject_init_and_add() seems to be routinely misused.  A failed call to this
function requires a call to kobject_put() otherwise we leak memory.

Examples memleaks can be seen in:

	mm/slub.c
	fs/btrfs/sysfs.c
	fs/xfs/xfs_sysfs.h: xfs_sysfs_init()

 Question: Do we fix the misuse or fix the API?

$ git grep kobject_init_and_add | wc -l
117

Either way, we will have to go through all 117 call sites and check them.  I
don't mind fixing them all but I don't want to do it twice because I chose the
wrong option.  Reaching out to those more experienced for a suggestion please.

Fix the API
-----------

Typically init functions do not require cleanup if they fail, this argument
leads to this patch

diff --git a/lib/kobject.c b/lib/kobject.c
index aa89edcd2b63..62328054bbd0 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -453,6 +453,9 @@ int kobject_init_and_add(struct kobject *kobj, struct kobj_type *ktype,
 	retval = kobject_add_varg(kobj, parent, fmt, args);
 	va_end(args);
 
+	if (retval)
+		kobject_put(kobj);
+
 	return retval;
 }
 EXPORT_SYMBOL_GPL(kobject_init_and_add);


Fix all the call sites
----------------------

Go through all 117 call sites and add kobj_put() in the error path.

This example from mm/slub.c

diff --git a/mm/slub.c b/mm/slub.c
index d30ede89f4a6..84a9d6c06c27 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5756,8 +5756,10 @@ static int sysfs_slab_add(struct kmem_cache *s)
 
 	s->kobj.kset = kset;
 	err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", name);
-	if (err)
+	if (err) {
+		kobject_put(&s->kobj);
 		goto out;
+	}
 
 	err = sysfs_create_group(&s->kobj, &slab_attr_group);
 	if (err)


thanks,
Tobin.


This is a Saturday afternoon 'drinking some wine, hacking on the kernel'
email.  Sending it to the lib/kobject.c maintainers for obvious
reasons.  CC'd a few extra people who I thought might be interested to
take the weight of Greg and Rafael :)