linux-kernel - Re: [PATCH 1/3] x86/resctrl: Remove superfluous kernfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201120161351.GC712@zn.tnic>
Date:   Fri, 20 Nov 2020 17:13:51 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Xiaochen Shen <xiaochen.shen@...el.com>
Cc:     tglx@...utronix.de, mingo@...hat.com, hpa@...or.com,
        tony.luck@...el.com, fenghua.yu@...el.com,
        reinette.chatre@...el.com, willemb@...gle.com, x86@...nel.org,
        linux-kernel@...r.kernel.org, pei.p.jia@...el.com
Subject: Re: [PATCH 1/3] x86/resctrl: Remove superfluous kernfs_get() calls
 to prevent refcount leak

On Sat, Oct 31, 2020 at 03:03:58AM +0800, Xiaochen Shen wrote:
> Willem reported growing of kernfs_node_cache entries in slabtop when
> repeatedly creating and removing resctrl subdirectories as well as when
> repeatedly mounting and unmounting resctrl filesystem.
> 
> On resource group (control as well as monitoring) creation via a mkdir
> an extra kernfs_node reference is obtained to ensure that the rdtgroup
> structure remains accessible for the rdtgroup_kn_unlock() calls where it
> is removed on deletion. The kernfs_node reference count is dropped by
> kernfs_put() in rdtgroup_kn_unlock().
> 
> With the above explaining the need for one kernfs_get()/kernfs_put()
> pair in resctrl there are more places where a kernfs_node reference is
> obtained without a corresponding release. The excessive amount of
> reference count on kernfs nodes will never be dropped to 0 and the
> kernfs nodes will never be freed in the call paths of rmdir and umount.
> It leads to reference count leak and kernfs_node_cache memory leak.
> 
> Remove the superfluous kernfs_get() calls and expand the existing
> comments surrounding the remaining kernfs_get()/kernfs_put() pair that
> remains in use.
> 
> Superfluous kernfs_get() calls are removed from two areas:
> 
>   (1) In call paths of mount and mkdir, when kernfs nodes for "info",
>   "mon_groups" and "mon_data" directories and sub-directories are
>   created, the reference count of newly created kernfs node is set to 1.
>   But after kernfs_create_dir() returns, superfluous kernfs_get() are
>   called to take an additional reference.
> 
>   (2) kernfs_get() calls in rmdir call paths.
> 
> Cc: stable@...r.kernel.org
> Fixes: 17eafd076291 ("x86/intel_rdt: Split resource group removal in two")
> Fixes: 4af4a88e0c92 ("x86/intel_rdt/cqm: Add mount,umount support")
> Fixes: f3cbeacaa06e ("x86/intel_rdt/cqm: Add rmdir support")
> Fixes: d89b7379015f ("x86/intel_rdt/cqm: Add mon_data")
> Fixes: c7d9aac61311 ("x86/intel_rdt/cqm: Add mkdir support for RDT monitoring")
> Fixes: 5dc1d5c6bac2 ("x86/intel_rdt: Simplify info and base file lists")
> Fixes: 60cf5e101fd4 ("x86/intel_rdt: Add mkdir to resctrl file system")
> Fixes: 4e978d06dedb ("x86/intel_rdt: Add "info" files to resctrl file system")

Are those 8(!) Fixes tags supposed to list *all* commits which add those
wrong kernfs_get() calls?

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette