linux-kernel - Re: [PATCH] blk-mq: fix a memory leak bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 15 Jul 2019 09:25:46 +0800
From:   Ming Lei <tom.leiming@...il.com>
To:     Wenwen Wang <wang6495@....edu>
Cc:     Wenwen Wang <wenwen@...uga.edu>, Jens Axboe <axboe@...nel.dk>,
        "open list:BLOCK LAYER" <linux-block@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] blk-mq: fix a memory leak bug

On Sun, Jul 14, 2019 at 3:04 PM Wenwen Wang <wang6495@....edu> wrote:
>
> From: Wenwen Wang <wenwen@...uga.edu>
>
> In blk_mq_init_allocated_queue(), a kernel buffer is allocated through
> kcalloc_node() to hold hardware dispatch queues in the request queue 'q',
> i.e., 'q->queue_hw_ctx'.  Later on, if the blk-mq device has no scheduler
> set, a scheduler will be initialized through elevator_init_mq(). If this
> initialization fails, blk_mq_init_allocated_queue() needs to be terminated
> with an error code returned to indicate this failure. However, the
> allocated buffer is not freed on this execution path, leading to a memory
> leak bug. Moreover, the required cleanup work is also missed on this path.
>
> To fix the above issues, free the allocated buffer and invoke the cleanup
> functions.
>
> Signed-off-by: Wenwen Wang <wenwen@...uga.edu>
> ---
>  block/blk-mq.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index e5ef40c..04fe077 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -2845,6 +2845,8 @@ static unsigned int nr_hw_queues(struct blk_mq_tag_set *set)
>  struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
>                                                   struct request_queue *q)
>  {
> +       int ret = -ENOMEM;
> +

The above isn't necessary because the function always returns
ERR_PTR(-ENOMEM) in case of failure.

>         /* mark the queue as mq asap */
>         q->mq_ops = set->ops;
>
> @@ -2906,11 +2908,9 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
>         blk_mq_map_swqueue(q);
>
>         if (!(set->flags & BLK_MQ_F_NO_SCHED)) {
> -               int ret;
> -
>                 ret = elevator_init_mq(q);
>                 if (ret)
> -                       return ERR_PTR(ret);
> +                       goto err_hctxs;

The above change itself is fine.

However, elevator_init_mq() shouldn't return failure since none should
work any time.
That said 'none' should be fallback to in case that default
mq-deadline can't be initialized.

thanks,
Ming Lei