Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   yaliang.wang@windriver.com
To:     rppt@kernel.org, tsbogend@alpha.franken.de, huangpei@loongson.cn,
        akpm@linux-foundation.org, kumba@gentoo.org, geert@linux-m68k.org,
        anshuman.khandual@arm.com, Yaliang.Wang@windriver.com,
        penberg@kernel.org
Cc:     linux-mips@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] MIPS: pgalloc: fix memory leak caused by pgd_free()
Date:   Thu, 10 Mar 2022 19:31:16 +0800
Message-Id: <20220310113116.2068859-1-yaliang.wang@windriver.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?xaz+Z1lvJ222ekaxPpJp5rWNIhZwMaHs7lVFGRanqceD37ufuGlK9w0ki2+B?=
 =?us-ascii?Q?obNaFwt2uYokR3g4+aGwDCeBXGuQ4CMF7D/ihSGtKG/AjhKagzsEUYvW9kGj?=
 =?us-ascii?Q?3SpQMQTWmor5VOk8mhTy/u6sm1PC+h5BdwEm3bZEKE90sNoBdlFr5trBQiWI?=
 =?us-ascii?Q?WPmwFirMid7eg9gJrH+gtB3P3W7Bw4vZfaesPn48Q6gG1anQbL7GaUFYWf56?=
 =?us-ascii?Q?Z4UKeDxndxj+vKK6QcIdTJTtwFTvvapDi74Ho65G/tUhyl7J9wZOa8LvBvBJ?=
 =?us-ascii?Q?n9V6LVo0yKU+2OcOdoCCRvTqRVR3POLWLTKnyRTC5oPEqFAEr9Fi8+WzPpgO?=
 =?us-ascii?Q?dJKRzOTLT2RMavhWa7ZKEcoaRreiXWPGdgC+irTJEZaWGCMHN73aP9q0egbl?=
 =?us-ascii?Q?43nzJNKCTH1PRoOdPDVoCZ2ypVA1xne1/VcXsnErtLH6MTu+U13Gr0NxxdMz?=
 =?us-ascii?Q?FXySpj1803dbMfsWk2GFjK1+HGZgWNcH+lW4XyGgrZGknWeo7VCgJYsKizav?=
 =?us-ascii?Q?mQNkaEMkKsYzVMrzTFwsgrVkSEbNdLRteVkzMemWvPp9np/yG0hkYEVUl/KS?=
 =?us-ascii?Q?MID8+H/CKRCp87ssgCHWvj+4oiHGSDBOG4LBS0L43nWv90D+nXqbiGCxX5tU?=
 =?us-ascii?Q?S2dXZ0giGbqh4MdPEQsQPTLAOjjJKTr38PYolLGPtAdhZG3M+lZcER05RYCK?=
 =?us-ascii?Q?9rc3sOkWILuwCLQGHUiRWJIsOnJnEFJdFg6XVSf7GTIidGG3fgTeiE7P4SEo?=
 =?us-ascii?Q?g88PwpdB6xsBCRi2nVJu8jx272ldOVLfLqb8kQ/SSFXiVYu8YoedoJeWv/pY?=
 =?us-ascii?Q?mw7CdhlLZqT42HJNvnLFwIOgkV02umwIr1OjSaAQeV1D2Htbfvs/ipN/7G9L?=
 =?us-ascii?Q?LcOcw0NgxJL/IeSn//emXoyH05LGlrD1SIREEa4P3qGDWCws7q21XV6wCK0g?=
 =?us-ascii?Q?asRa/9TDcj1pU80cEywSNL/jvHFve1DosloUJRaHlFbODb2zUSkxUSawwLd1?=
 =?us-ascii?Q?twvjJRt+YLnS+9+n/tGW4+LrEag0O2gG9rPr9iXBdyz8jaFEiMtVc6XsIcsN?=
 =?us-ascii?Q?lTIii4y8ZhJb/DfKz3twnBFoweXfiMpRrxP0VO8ii91cnCEyyLjtWaQcJ+nb?=
 =?us-ascii?Q?bsMH37QI9OxgzHeso8DrJhhIyy78g7+9ZiOFqOq1LLGfixcJbmjMGX7ObcUt?=
 =?us-ascii?Q?igyzzid8P7ar1axXcRc1SzV6/D0Iol8/DvvBOFxte4xwRojdwDTP42YPrn+C?=
 =?us-ascii?Q?FSxwmsowocpuNbFQo3cFIxrnrmyCyFj3MMVLxRr26P90fCUwNmsM2xZTK+4Q?=
 =?us-ascii?Q?Ng2ZsV7FTOBTE4dDiHMMmsqVhvp8HkKlRJEpYMp7nVUEe+coeM4/FEmtNLKj?=
 =?us-ascii?Q?CTy3Tc7SAt0345WuJgyfN+vF5YBqjZkAaXNhhJ2EOl0MEfAvk2JRcWeHKVin?=
 =?us-ascii?Q?+49apPJ5ukuRM+t6CiWtTK1HwzhcgP0/VzD0bF02EY9R2Q3VvQvd0Nz29foQ?=
 =?us-ascii?Q?CCmlK1M/ZpjmFeYG6U+R8FOSCIXhMPPbYv8kj458Bdj7uGIYbmNpHxsMSdCj?=
 =?us-ascii?Q?IUxBKJ+AFtimupFuitbWe35zUvrboCobMaYC6PRyHV5pjndNdLHaF5gzEtrF?=
 =?us-ascii?Q?AfUE1Dmihi8k6Iho8mV0JmfCatYK93aK6QNdim+uqIKEpjI3WLY5iO6P0azb?=
 =?us-ascii?Q?+isgEQ=3D=3D?=
X-OriginatorOrg: windriver.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7454d206-8f12-45ec-4ade-08da028987d1
X-MS-Exchange-CrossTenant-AuthSource: SA0PR11MB4766.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Mar 2022 11:31:34.3149
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ucFXb3blk8uY/iwwTxYk6ROSd/fVpeTFrqaoOxQJB6JK1h55emd5ttt2JU21T0lSldoMVG0QzJBOcs4zui6QdCxVyRJFk6PrBlosQ8DEWQU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR11MB1706
X-Proofpoint-ORIG-GUID: Zjb_UH4to1Lkxlq3Re-r2JQXkVc4p2d2
X-Proofpoint-GUID: Zjb_UH4to1Lkxlq3Re-r2JQXkVc4p2d2
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.816,Hydra:6.0.425,FMLib:17.11.64.514
 definitions=2022-03-10_03,2022-03-09_01,2022-02-23_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501
 spamscore=0 mlxscore=0 phishscore=0 mlxlogscore=790 clxscore=1011
 impostorscore=0 lowpriorityscore=0 adultscore=0 malwarescore=0 bulkscore=0
 suspectscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2202240000 definitions=main-2203100061
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Yaliang Wang <Yaliang.Wang@windriver.com>

pgd page is freed by generic implementation pgd_free() since commit
f9cb654cb550 ("asm-generic: pgalloc: provide generic pgd_free()"),
however, there are scenarios that the system uses more than one page as
the pgd table, in such cases the generic implementation pgd_free() won't
be applicable anymore. For example, when PAGE_SIZE_4KB is enabled and
MIPS_VA_BITS_48 is not enabled in a 64bit system, the macro "PGD_ORDER"
will be set as "1", which will cause allocating two pages as the pgd
table. Well, at the same time, the generic implementation pgd_free()
just free one pgd page, which will result in the memory leak.

The memory leak can be easily detected by executing shell command:
"while true; do ls > /dev/null; grep MemFree /proc/meminfo; done"

Fixes: f9cb654cb550 ("asm-generic: pgalloc: provide generic pgd_free()")
Signed-off-by: Yaliang Wang <Yaliang.Wang@windriver.com>
---
 arch/mips/include/asm/pgalloc.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
index c7925d0e9874..867e9c3db76e 100644
--- a/arch/mips/include/asm/pgalloc.h
+++ b/arch/mips/include/asm/pgalloc.h
@@ -15,6 +15,7 @@
 
 #define __HAVE_ARCH_PMD_ALLOC_ONE
 #define __HAVE_ARCH_PUD_ALLOC_ONE
+#define __HAVE_ARCH_PGD_FREE
 #include <asm-generic/pgalloc.h>
 
 static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd,
@@ -48,6 +49,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
 extern void pgd_init(unsigned long page);
 extern pgd_t *pgd_alloc(struct mm_struct *mm);
 
+static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
+{
+	free_pages((unsigned long)pgd, PGD_ORDER);
+}
+
 #define __pte_free_tlb(tlb,pte,address)			\
 do {							\
 	pgtable_pte_page_dtor(pte);			\
-- 
2.25.1