Received: by 2002:a05:6a10:9e8c:0:0:0:0 with SMTP id y12csp276406pxx; Wed, 28 Oct 2020 04:47:51 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxQl73PGZW4gVDh+B/Xu9woG0dkHf1HCTsSpX5EWcqaRQsCL/Utp4AuU8YeufVPyEEQzUXo X-Received: by 2002:aa7:d790:: with SMTP id s16mr7403789edq.63.1603885670990; Wed, 28 Oct 2020 04:47:50 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1603885670; cv=none; d=google.com; s=arc-20160816; b=bCKpsTXSSU4vV7Ro607xCBedxRPidHeVR0IKV31BGKTyCh6g6igPE6Vv829jqSYXxf Tr53vPROv+P57YPBP/UrIBENWMCtCnm6ZNn9lhPccYKA1Ui8OsI1gXm3EkB+T7FCHXF2 2JL9OghH+YhmZPteFtjP7ur7CcxdaSeEm/DxsKaE3CyEo2nWqb6T/xRpWh76YO0kKb3+ uo6GNKIZFcKDHrf9um9jwEhwgBjFaqsmVSNbs2omccuLcvU4aADwcEuUqqfGO7HdCkol JMJmBYA7iDWY05VmSf/eJXXiumKP6tJmU2udUOYcuQUtV0KcP42t3tcfdbgCFScRjsn9 aqOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=dkaeVDRpFf7aMKS2LrhmqNpKVwugJLJmNGemohspdGE=; b=ZDemqiYAbJlsx8qSaHnJ3HxmqJY6AbOrTC9FWsKl3/Q9GTwViCgwJhZC61zXhGnejJ 9TqXH3PWV9iw+Zus68EGqM/MtcVGdtZPMk6KfeoxoFjafhEcXbsJBb2yq8fphgTg791e YpGF+53cIdItBA6W+ux8/cCFg7tWrkmzGTkpugMK2d/6mWGWxd04e1KE9XzrikOCo/vJ 97mi3S4ItrVK7y1EqrKs+pHaXi+2rWplVCphbfN/zVS6P3rLDtAFkTsOhc/5XuXndRRR Vwb0bJ19NtRvVPORpP46Q3jwvUV5+TTR0tbJIPsjN4zzSB+KlMB+8O0dSRU8xeXfR0S1 OJQw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=JnapbPAA; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id dk22si2709939edb.258.2020.10.28.04.47.28; Wed, 28 Oct 2020 04:47:50 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=JnapbPAA; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1794474AbgJ0PL7 (ORCPT + 99 others); Tue, 27 Oct 2020 11:11:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:39958 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1790981AbgJ0PFd (ORCPT ); Tue, 27 Oct 2020 11:05:33 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DBE7721707; Tue, 27 Oct 2020 15:05:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603811132; bh=pgU48Lf+PiMP7v6usSDcWLCT0cPhAWdBgvnWQMGxPRw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JnapbPAA0eDoHdrO+/pmSwdxLtDUEjTeXyh38+9tVN13dS3s+M+4WcLHgABC1LEBP n/SuJQ9dLuWwQC9XwBgbDVd58OOqmDygoqpws9S/6XEHd5H4gGoLkoatjpPBe2qKzJ B/llDadHeosprXUD/EFEGSWmHr1uk12M1HjtrXHs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, coverity-bot , Kees Cook , "Matthew Wilcox (Oracle)" , Sasha Levin Subject: [PATCH 5.8 344/633] ida: Free allocated bitmap in error path Date: Tue, 27 Oct 2020 14:51:27 +0100 Message-Id: <20201027135538.823685818@linuxfoundation.org> X-Mailer: git-send-email 2.29.1 In-Reply-To: <20201027135522.655719020@linuxfoundation.org> References: <20201027135522.655719020@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Matthew Wilcox (Oracle) [ Upstream commit a219b856a2b993da234108307be772448f22b0ce ] If a bitmap needs to be allocated, and then by the time the thread is scheduled to be run again all the indices which would satisfy the allocation have been allocated then we would leak the allocation. Almost impossible to hit in practice, but a trivial fix. Found by Coverity. Fixes: f32f004cddf8 ("ida: Convert to XArray") Reported-by: coverity-bot Reviewed-by: Kees Cook Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Sasha Levin --- lib/idr.c | 1 + tools/testing/radix-tree/idr-test.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/lib/idr.c b/lib/idr.c index c2cf2c52bbde5..4d2eef0259d2c 100644 --- a/lib/idr.c +++ b/lib/idr.c @@ -470,6 +470,7 @@ int ida_alloc_range(struct ida *ida, unsigned int min, unsigned int max, goto retry; nospc: xas_unlock_irqrestore(&xas, flags); + kfree(alloc); return -ENOSPC; } EXPORT_SYMBOL(ida_alloc_range); diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c index 8995092d541ec..3b796dd5e5772 100644 --- a/tools/testing/radix-tree/idr-test.c +++ b/tools/testing/radix-tree/idr-test.c @@ -523,8 +523,27 @@ static void *ida_random_fn(void *arg) return NULL; } +static void *ida_leak_fn(void *arg) +{ + struct ida *ida = arg; + time_t s = time(NULL); + int i, ret; + + rcu_register_thread(); + + do for (i = 0; i < 1000; i++) { + ret = ida_alloc_range(ida, 128, 128, GFP_KERNEL); + if (ret >= 0) + ida_free(ida, 128); + } while (time(NULL) < s + 2); + + rcu_unregister_thread(); + return NULL; +} + void ida_thread_tests(void) { + DEFINE_IDA(ida); pthread_t threads[20]; int i; @@ -536,6 +555,16 @@ void ida_thread_tests(void) while (i--) pthread_join(threads[i], NULL); + + for (i = 0; i < ARRAY_SIZE(threads); i++) + if (pthread_create(&threads[i], NULL, ida_leak_fn, &ida)) { + perror("creating ida thread"); + exit(1); + } + + while (i--) + pthread_join(threads[i], NULL); + assert(ida_is_empty(&ida)); } void ida_tests(void) -- 2.25.1