lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <657b9cb088175_27db80294d2@iweiny-mobl.notmuch> Date: Thu, 14 Dec 2023 16:24:16 -0800 From: Ira Weiny <ira.weiny@...el.com> To: Dinghao Liu <dinghao.liu@....edu.cn> CC: Dan Williams <dan.j.williams@...el.com>, Vishal Verma <vishal.l.verma@...el.com>, Dave Jiang <dave.jiang@...el.com>, Ira Weiny <ira.weiny@...el.com>, <nvdimm@...ts.linux.dev>, <linux-kernel@...r.kernel.org> Subject: Re: [PATCH] [v2] nvdimm-btt: fix several memleaks Dinghao Liu wrote: > Resources allocated by kcalloc() in btt_freelist_init(), > btt_rtt_init(), and btt_maplocks_init() are not correctly > released in their callers when an error happens. For > example, when an error happens in btt_freelist_init(), its > caller discover_arenas() will directly free arena, which makes > arena->freelist a leaked memory. Fix these memleaks by using > devm_kcalloc() to make the memory auto-freed on driver detach. Thanks for this work! > > Fixes: 5212e11fde4d ("nd_btt: atomic sector updates") > Signed-off-by: Dinghao Liu <dinghao.liu@....edu.cn> > --- > > Changelog: > > v2: -Use devm_kcalloc() to fix the memleaks. > -Fix the potential leaked memory in btt_rtt_init() > and btt_maplocks_init(). > --- > drivers/nvdimm/btt.c | 35 ++++++++++++++++------------------- > 1 file changed, 16 insertions(+), 19 deletions(-) > > diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c > index d5593b0dc700..c55231f42617 100644 > --- a/drivers/nvdimm/btt.c > +++ b/drivers/nvdimm/btt.c > @@ -531,13 +531,13 @@ static int arena_clear_freelist_error(struct arena_info *arena, u32 lane) > return ret; > } > > -static int btt_freelist_init(struct arena_info *arena) > +static int btt_freelist_init(struct device *dev, struct arena_info *arena) Both struct arena_info and struct btt contain references to struct nd_btt which is the device you are passing down this call stack. Just use the device in the arena/btt rather than passing a device structure. That makes the code easier to read and ensures that the device associated with this arena or btt is used. > { > int new, ret; > struct log_entry log_new; > u32 i, map_entry, log_oldmap, log_newmap; > > - arena->freelist = kcalloc(arena->nfree, sizeof(struct free_entry), > + arena->freelist = devm_kcalloc(dev, arena->nfree, sizeof(struct free_entry), ... devm_kcalloc(&arena->nd_btt.dev, ...) > GFP_KERNEL); > if (!arena->freelist) > return -ENOMEM; > @@ -718,20 +718,20 @@ static int log_set_indices(struct arena_info *arena) > return 0; > } > > -static int btt_rtt_init(struct arena_info *arena) > +static int btt_rtt_init(struct device *dev, struct arena_info *arena) > { > - arena->rtt = kcalloc(arena->nfree, sizeof(u32), GFP_KERNEL); > + arena->rtt = devm_kcalloc(dev, arena->nfree, sizeof(u32), GFP_KERNEL); > if (arena->rtt == NULL) > return -ENOMEM; > > return 0; > } > > -static int btt_maplocks_init(struct arena_info *arena) > +static int btt_maplocks_init(struct device *dev, struct arena_info *arena) > { > u32 i; > > - arena->map_locks = kcalloc(arena->nfree, sizeof(struct aligned_lock), > + arena->map_locks = devm_kcalloc(dev, arena->nfree, sizeof(struct aligned_lock), > GFP_KERNEL); > if (!arena->map_locks) > return -ENOMEM; > @@ -805,9 +805,6 @@ static void free_arenas(struct btt *btt) > > list_for_each_entry_safe(arena, next, &btt->arena_list, list) { > list_del(&arena->list); > - kfree(arena->rtt); > - kfree(arena->map_locks); > - kfree(arena->freelist); This does not quite work. free_arenas() is used in the error paths of create_arenas() and discover_arenas(). In those cases devm_kfree() is probably a better way to clean up this. However... > debugfs_remove_recursive(arena->debugfs_dir); > kfree(arena); Why can't arena be allocated with devm_*? We need to change this up a bit more to handle the error path vs regular device shutdown free (automatic devm frees). Ira
Powered by blists - more mailing lists