Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <1563087801-7373-1-git-send-email-wang6495@umn.edu> <CACVXFVOXZCtYtt3UuYBa7OYHEwsMkYFznfpL=1q9HkJV8xcx0Q@mail.gmail.com>
In-Reply-To: <CACVXFVOXZCtYtt3UuYBa7OYHEwsMkYFznfpL=1q9HkJV8xcx0Q@mail.gmail.com>
From:   Wenwen Wang <wenwen@cs.uga.edu>
Date:   Sun, 14 Jul 2019 23:57:31 -0500
Message-ID: <CAAa=b7fyp5__wW6No1aLsnB+TO5UZMTWKc2u7r3H0+cDy2aSXw@mail.gmail.com>
Subject: Re: [PATCH] blk-mq: fix a memory leak bug
To:     Ming Lei <tom.leiming@gmail.com>
Cc:     Jens Axboe <axboe@kernel.dk>,
        "open list:BLOCK LAYER" <linux-block@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        Wenwen Wang <wenwen@cs.uga.edu>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Sun, Jul 14, 2019 at 8:26 PM Ming Lei <tom.leiming@gmail.com> wrote:
>
> On Sun, Jul 14, 2019 at 3:04 PM Wenwen Wang <wang6495@umn.edu> wrote:
> >
> > From: Wenwen Wang <wenwen@cs.uga.edu>
> >
> > In blk_mq_init_allocated_queue(), a kernel buffer is allocated through
> > kcalloc_node() to hold hardware dispatch queues in the request queue 'q',
> > i.e., 'q->queue_hw_ctx'.  Later on, if the blk-mq device has no scheduler
> > set, a scheduler will be initialized through elevator_init_mq(). If this
> > initialization fails, blk_mq_init_allocated_queue() needs to be terminated
> > with an error code returned to indicate this failure. However, the
> > allocated buffer is not freed on this execution path, leading to a memory
> > leak bug. Moreover, the required cleanup work is also missed on this path.
> >
> > To fix the above issues, free the allocated buffer and invoke the cleanup
> > functions.
> >
> > Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
> > ---
> >  block/blk-mq.c | 8 ++++----
> >  1 file changed, 4 insertions(+), 4 deletions(-)
> >
> > diff --git a/block/blk-mq.c b/block/blk-mq.c
> > index e5ef40c..04fe077 100644
> > --- a/block/blk-mq.c
> > +++ b/block/blk-mq.c
> > @@ -2845,6 +2845,8 @@ static unsigned int nr_hw_queues(struct blk_mq_tag_set *set)
> >  struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
> >                                                   struct request_queue *q)
> >  {
> > +       int ret = -ENOMEM;
> > +
>
> The above isn't necessary because the function always returns
> ERR_PTR(-ENOMEM) in case of failure.
>
> >         /* mark the queue as mq asap */
> >         q->mq_ops = set->ops;
> >
> > @@ -2906,11 +2908,9 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
> >         blk_mq_map_swqueue(q);
> >
> >         if (!(set->flags & BLK_MQ_F_NO_SCHED)) {
> > -               int ret;
> > -
> >                 ret = elevator_init_mq(q);
> >                 if (ret)
> > -                       return ERR_PTR(ret);
> > +                       goto err_hctxs;
>
> The above change itself is fine.
>
> However, elevator_init_mq() shouldn't return failure since none should
> work any time.
> That said 'none' should be fallback to in case that default
> mq-deadline can't be initialized.

Thanks for your comments! I agree that 'none' is the fallback if
'mq-deadline' cannot be initialized.

But, the error-handling branch after elevator_init_mq() is still
necessary, unless elevator_init_mq() always returns zero, which is not
true.

Thanks!
Wenwen