Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 3 Nov 2022 22:23:52 +0900
From:   Hyeonggon Yoo <42.hyeyoo@gmail.com>
To:     Liu Shixin <liushixin2@huawei.com>
Cc:     Christoph Lameter <cl@linux.com>,
        Pekka Enberg <penberg@kernel.org>,
        David Rientjes <rientjes@google.com>,
        Joonsoo Kim <iamjoonsoo.kim@lge.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Vlastimil Babka <vbabka@suse.cz>,
        Roman Gushchin <roman.gushchin@linux.dev>, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 0/3] Refactor __kmem_cache_create() and fix memory leak
Message-ID: <Y2PA6JBklwwtLlST@hyeyoo>
References: <20221031134747.3049593-1-liushixin2@huawei.com>
 <Y2IgUwTH/dO06Tot@hyeyoo>
 <c03620e3-6159-1c46-c472-c15186f4ccae@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <c03620e3-6159-1c46-c472-c15186f4ccae@huawei.com>
Precedence: bulk

On Wed, Nov 02, 2022 at 04:53:08PM +0800, Liu Shixin wrote:
> On 2022/11/2 15:46, Hyeonggon Yoo wrote:
> > On Mon, Oct 31, 2022 at 09:47:44PM +0800, Liu Shixin wrote:
> >> I found a memory leak of kobj->name in sysfs_slab_add() which is introduced
> >> by 80da026a8e5d ("mm/slub: fix slab double-free in case of duplicate sysfs filename").
> >> Following the rules stated in the comment for kobject_init_and_add():
> > Thank you for reporting this! Indeed it seems tried to fix double free but
> > introduced a leak.
> >
> >>  If this function returns an error, kobject_put() must be called to
> >>  properly clean up the memory associated with the object.
> >>
> >> We should use kobject_put() to free kobject.
> > But what to do if a cache is created early and later sysfs_slab_add() failed?
> > (Which is unlikely on normal condition)
> >
> > With this series it introduces use-after-free if sysfs_slab_add() in
> > slab_sysfs_init() failed.  Should we just call BUG() or something like that?
>
> Thanks for your discovery, what I missed.

You're welcome.

> I prefer to panic directly, just as create_boot_cache() does.

IMHO that should be nothing serious. but let's hear maintainers' opinion.

> Of couse, if you want the system to continue booting, I think it's possible to distinguish them
> by slab_state.

I'm afraid to make it more complex :(

> Looking forward to your advice.
> Thanks,
> >
> >> But we can't simply add kobject_put() since it will free kmem_cache too.
> >> If we use kobject_put(), we need to skip other release functions.
> >>
> >> In this series, We refactor the code to separate sysfs_slab_add() and
> >> debugfs_slab_add() from __kmem_cache_create(), and then use kobject_put()
> >> to free kobject in sysfs_slab_add(). This can fix the memory leak of
> >> kobject->name.
> >>
> >> v1->v2: Fix build error reported by kernel test robot <lkp@intel.com>.
> >>
> >> Liu Shixin (3):
> >>   mm/slab_common: Move cache_name to create_cache()
> >>   mm/slub: Refactor __kmem_cache_create()
> >>   mm/slub: Fix memory leak of kobj->name in sysfs_slab_add()
> >>
> >>  include/linux/slub_def.h | 11 +++++++++
> >>  mm/slab_common.c         | 44 ++++++++++++++++++----------------
> >>  mm/slub.c                | 52 ++++++++++------------------------------
> >>  3 files changed, 48 insertions(+), 59 deletions(-)
> >>
> >> -- 
> >> 2.25.1
> >>
> 

-- 
Thanks,
Hyeonggon