linux-kernel - Re: [PATCH] workqueue: Fix possible memory leaks in wq_numa

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 22 Jul 2021 10:05:45 +0800
From:   Lai Jiangshan <jiangshanlai@...il.com>
To:     Zhen Lei <thunder.leizhen@...wei.com>
Cc:     Tejun Heo <tj@...nel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] workqueue: Fix possible memory leaks in wq_numa_init()

Please ignore my previous email which included/copied a wrong line of code.

On Thu, Jul 22, 2021 at 12:23 AM Tejun Heo <tj@...nel.org> wrote:
> Yeah, idk. It's not an actual bug tho. Maybe we should just add a comment.
> Which version do you like the best?

I hope Zhen Lei continues to refine his version.  I think he is still
working on it.

On Mon, Jul 19, 2021 at 3:00 PM Zhen Lei <thunder.leizhen@...wei.com> wrote:
>
> In error handling branch "if (WARN_ON(node == NUMA_NO_NODE))", the
> previously allocated memories are not released. Doing this before
> allocating memory eliminates memory leaks.
>
> Signed-off-by: Zhen Lei <thunder.leizhen@...wei.com>
> ---
>  kernel/workqueue.c | 19 ++++++++++---------
>  1 file changed, 10 insertions(+), 9 deletions(-)
>
> diff --git a/kernel/workqueue.c b/kernel/workqueue.c
> index 50142fc08902..6aa0ba582d15 100644
> --- a/kernel/workqueue.c
> +++ b/kernel/workqueue.c
> @@ -5896,6 +5896,14 @@ static void __init wq_numa_init(void)
>                 return;
>         }
>
> +       for_each_possible_cpu(cpu) {
> +               if (WARN_ON(cpu_to_node(cpu) == NUMA_NO_NODE)) {
> +                       pr_warn("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n", cpu);


> +                       /* happens iff arch is bonkers, let's just proceed */

I don't think this comment is still needed.

> +                       return;
> +               }
> +       }
> +
>         wq_update_unbound_numa_attrs_buf = alloc_workqueue_attrs();
>         BUG_ON(!wq_update_unbound_numa_attrs_buf);
>
> @@ -5907,18 +5915,11 @@ static void __init wq_numa_init(void)
>         tbl = kcalloc(nr_node_ids, sizeof(tbl[0]), GFP_KERNEL);
>         BUG_ON(!tbl);
>
> -       for_each_node(node)
> +       for_each_node(node) {
>                 BUG_ON(!zalloc_cpumask_var_node(&tbl[node], GFP_KERNEL,
>                                 node_online(node) ? node : NUMA_NO_NODE));
>
> -       for_each_possible_cpu(cpu) {
> -               node = cpu_to_node(cpu);
> -               if (WARN_ON(node == NUMA_NO_NODE)) {
> -                       pr_warn("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n", cpu);
> -                       /* happens iff arch is bonkers, let's just proceed */
> -                       return;
> -               }
> -               cpumask_set_cpu(cpu, tbl[node]);
> +               cpumask_copy(tbl[node], cpumask_of_node(node));

It is incorrect.  cpumask_of_node(node) is the online cpumask of the node, not
the possible cpumask of the node that we are interested in.

If the NUMA subsystem provided something like cpumask_possible_of_node(node),
we wouldn't need wq_numa_possible_cpumask.

Please keep "for_each_possible_cpu(cpu)" loop and
"cpumask_set_cpu(cpu, tbl[node]);"

>         }
>
>         wq_numa_possible_cpumask = tbl;
> --
> 2.25.1
>