Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210719065914.3801-1-thunder.leizhen@huawei.com>
In-Reply-To: <20210719065914.3801-1-thunder.leizhen@huawei.com>
From:   Lai Jiangshan <jiangshanlai@gmail.com>
Date:   Thu, 22 Jul 2021 09:55:22 +0800
Message-ID: <CAJhGHyDv38=n--13-CWgVpcc1ZPyFu_vYi4bfSuLCGp7iHCCDw@mail.gmail.com>
Subject: Re: [PATCH] workqueue: Fix possible memory leaks in wq_numa_init()
To:     Zhen Lei <thunder.leizhen@huawei.com>
Cc:     Tejun Heo <tj@kernel.org>,
        linux-kernel <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Mon, Jul 19, 2021 at 3:00 PM Zhen Lei <thunder.leizhen@huawei.com> wrote:
>
> In error handling branch "if (WARN_ON(node == NUMA_NO_NODE))", the
> previously allocated memories are not released. Doing this before
> allocating memory eliminates memory leaks.
>
> Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
> ---
>  kernel/workqueue.c | 19 ++++++++++---------
>  1 file changed, 10 insertions(+), 9 deletions(-)
>
> diff --git a/kernel/workqueue.c b/kernel/workqueue.c
> index 50142fc08902..6aa0ba582d15 100644
> --- a/kernel/workqueue.c
> +++ b/kernel/workqueue.c
> @@ -5896,6 +5896,14 @@ static void __init wq_numa_init(void)
>                 return;
>         }
>
> +       for_each_possible_cpu(cpu) {
> +               if (WARN_ON(cpu_to_node(cpu) == NUMA_NO_NODE)) {
> +                       pr_warn("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n", cpu);
> +                       /* happens iff arch is bonkers, let's just proceed */
> +                       return;
> +               }
> +       }
> +
>         wq_update_unbound_numa_attrs_buf = alloc_workqueue_attrs();
>         BUG_ON(!wq_update_unbound_numa_attrs_buf);
>
> @@ -5907,18 +5915,11 @@ static void __init wq_numa_init(void)
>         tbl = kcalloc(nr_node_ids, sizeof(tbl[0]), GFP_KERNEL);
>         BUG_ON(!tbl);
>
> -       for_each_node(node)
> +       for_each_node(node) {
>                 BUG_ON(!zalloc_cpumask_var_node(&tbl[node], GFP_KERNEL,
>                                 node_online(node) ? node : NUMA_NO_NODE));
>
> -       for_each_possible_cpu(cpu) {
> -               node = cpu_to_node(cpu);
> -               if (WARN_ON(node == NUMA_NO_NODE)) {
> -                       pr_warn("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n", cpu);
> -                       /* happens iff arch is bonkers, let's just proceed */
> -                       return;
> -               }
> -               cpumask_set_cpu(cpu, tbl[node]);
> +               cpumask_copy(tbl[node], cpumask_of_node(node));

It is incorrect.  cpumask_of_node(node) is the online cpumask of the node, not
the possible cpumask of the node that we are interested in.

If the NUMA subsystem provided something like cpumask_possible_of_node(node),
we wouldn't need wq_numa_possible_cpumask.

Please keep "cpumask_copy(tbl[node], cpumask_of_node(node));" as before.

>         }
>
>         wq_numa_possible_cpumask = tbl;
> --
> 2.25.1
>