Date:	Mon, 20 Jul 2015 18:20:39 +0300
From:	Konstantin Khlebnikov <koct9i@...il.com>
To:	Dongxing Zhang <dongxing.zhang@...el.com>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	peter@...leysoftware.com, alan@...ux.intel.com,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Xiaoming Wang <xiaoming.wang@...el.com>
Subject: Re: [PATCH] tty/vt: Fix the memory leak in visual_init

On Wed, Jun 10, 2015 at 10:21 AM, Dongxing Zhang
<dongxing.zhang@...el.com> wrote:
> If vc->vc_uni_pagedir_loc is not NULL, its refcount needs to be
> decreased before vc_uni_pagedir_loc is re-assigned.
>
> unreferenced object 0xffff88002cdd13b0 (size 512):
>   comm "setfont", pid 503, jiffies 4294896503 (age 722.828s)
>   hex dump (first 32 bytes):
>     40 92 61 2b 00 88 ff ff 00 00 00 00 00 00 00 00  @.a+............
>     00 00 00 00 00 00 00 00 a0 ad 61 2b 00 88 ff ff  ..........a+....
>   backtrace:
>     [<ffffffff817b755e>] kmemleak_alloc+0x4e/0xb0
>     [<ffffffff811d4898>] kmem_cache_alloc_trace+0x1c8/0x240
>     [<ffffffff814ae7d3>] con_do_clear_unimap.isra.2+0x83/0xe0
>     [<ffffffff814ae9b2>] con_clear_unimap+0x22/0x40
>     [<ffffffff814a8db8>] vt_ioctl+0xeb8/0x1170
>     [<ffffffff8149b458>] tty_ioctl+0x208/0xca0
>     [<ffffffff81207858>] do_vfs_ioctl+0x2f8/0x510
>     [<ffffffff81207af1>] SyS_ioctl+0x81/0xa0
>     [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75
>     [<ffffffffffffffff>] 0xffffffffffffffff
> unreferenced object 0xffff88002b619240 (size 256):
>   comm "setfont", pid 503, jiffies 4294896503 (age 722.828s)
>   hex dump (first 32 bytes):
>     90 bc 84 d5 00 88 ff ff 58 85 84 d5 00 88 ff ff  ........X.......
>     88 ac 84 d5 00 88 ff ff e0 b1 84 d5 00 88 ff ff  ................
>   backtrace:
>     [<ffffffff817b755e>] kmemleak_alloc+0x4e/0xb0
>     [<ffffffff811d4898>] kmem_cache_alloc_trace+0x1c8/0x240
>     [<ffffffff814ae286>] con_insert_unipair+0x86/0x170
>     [<ffffffff814af107>] con_set_unimap+0x1b7/0x280
>     [<ffffffff814a8d65>] vt_ioctl+0xe65/0x1170
>     [<ffffffff8149b458>] tty_ioctl+0x208/0xca0
>     [<ffffffff81207858>] do_vfs_ioctl+0x2f8/0x510
>     [<ffffffff81207af1>] SyS_ioctl+0x81/0xa0
>     [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75
>     [<ffffffffffffffff>] 0xffffffffffffffff
>
> Signed-off-by: Dongxing Zhang <dongxing.zhang@...el.com>
> Signed-off-by: Xiaoming Wang <xiaoming.wang@...el.com>

Looks like leak happens when kernel does this:
[    5.010152] fb: switching to cirrusdrmfb from EFI VGA

Here:

[    5.010438]  [<ffffffff814bd5f9>] visual_init+0x149/0x150
[    5.010441]  [<ffffffff814bfaa9>] do_bind_con_driver+0x159/0x310
[    5.010443]  [<ffffffff814bffd6>] do_unbind_con_driver+0x1b6/0x210
[    5.010462]  [<ffffffff8143ff3b>] fbcon_event_notify+0x7cb/0x8b0
[    5.010471]  [<ffffffff810a2d85>] notifier_call_chain+0x65/0x90
[    5.010475]  [<ffffffff810a2e3e>] __blocking_notifier_call_chain+0x5e/0x90
[    5.010478]  [<ffffffff810a2e86>] blocking_notifier_call_chain+0x16/0x20
[    5.010480]  [<ffffffff8144309b>] fb_notifier_call_chain+0x1b/0x20
[    5.010483]  [<ffffffff81443f0c>] do_unregister_framebuffer+0x6c/0x130
[    5.010487]  [<ffffffff81444163>]
do_remove_conflicting_framebuffers+0x153/0x180
[    5.010491]  [<ffffffff814444df>] remove_conflicting_framebuffers+0x3f/0x60
[    5.010495]  [<ffffffffa016daa1>] cirrus_pci_probe+0x91/0xd0 [cirrus]
[    5.010509]  [<ffffffff8142382e>] local_pci_probe+0x4e/0xa0
[    5.010512]  [<ffffffff814244b3>] ? pci_match_device+0xe3/0x110
[    5.010515]  [<ffffffff814245f9>] pci_device_probe+0xd9/0x120
[    5.010525]  [<ffffffff81502155>] driver_probe_device+0x155/0x430
[    5.010528]  [<ffffffff815024d1>] __driver_attach+0xa1/0xb0
[    5.010530]  [<ffffffff81502430>] ? driver_probe_device+0x430/0x430
[    5.010533]  [<ffffffff8150023e>] bus_for_each_dev+0x5e/0x90
[    5.010535]  [<ffffffff815019be>] driver_attach+0x1e/0x20
[    5.010536]  [<ffffffff815016ee>] bus_add_driver+0x1be/0x290
[    5.010538]  [<ffffffff81503570>] driver_register+0x60/0xe0
[    5.010540]  [<ffffffff81423ba4>] __pci_register_driver+0x64/0x70
[    5.010541]  [<ffffffffa043f000>] ? 0xffffffffa043f000
[    5.010553]  [<ffffffffa00c8ad0>] drm_pci_init+0xe0/0x110 [drm]
[    5.010556]  [<ffffffffa043f000>] ? 0xffffffffa043f000
[    5.010560]  [<ffffffffa043f03c>] cirrus_init+0x3c/0x1000 [cirrus]
[    5.010572]  [<ffffffff8100212d>] do_one_initcall+0xad/0x1d0
[    5.010588]  [<ffffffff811e04d6>] ? kmem_cache_alloc_trace+0x2b6/0x300
[    5.010601]  [<ffffffff8110a9f4>] do_init_module+0x64/0x220
[    5.010604]  [<ffffffff8110cc4a>] load_module+0x130a/0x1990
[    5.010606]  [<ffffffff811083b0>] ? show_initstate+0x50/0x50
[    5.010608]  [<ffffffff8110d400>] SyS_init_module+0x130/0x180
[    5.010616]  [<ffffffff817b6bee>] entry_SYSCALL_64_fastpath+0x12/0x76


This patch helps. Thanks.

Tested-by: Konstantin Khlebnikov <khlebnikov@...dex-team.ru>

> ---
>  drivers/tty/vt/vt.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index 4a24eb2..334c502 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -738,6 +738,8 @@ static void visual_init(struct vc_data *vc, int num, int init)
>         __module_get(vc->vc_sw->owner);
>         vc->vc_num = num;
>         vc->vc_display_fg = &master_display_fg;
> +       if (vc->vc_uni_pagedir_loc)
> +               con_free_unimap(vc);
>         vc->vc_uni_pagedir_loc = &vc->vc_uni_pagedir;
>         vc->vc_uni_pagedir = NULL;
>         vc->vc_hi_font_mask = 0;
> --
> 1.9.1
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists