linux-kernel - [PATCH] drm/ttm/tests: Fix memory leak in ttm_bo_kunit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20241018101018.706555-1-ruanjinjie@huawei.com>
Date: Fri, 18 Oct 2024 18:10:18 +0800
From: Jinjie Ruan <ruanjinjie@...wei.com>
To: <christian.koenig@....com>, <ray.huang@....com>,
	<maarten.lankhorst@...ux.intel.com>, <mripard@...nel.org>,
	<tzimmermann@...e.de>, <airlied@...il.com>, <simona@...ll.ch>,
	<karolina.stolarek@...el.com>, <Arunpravin.PaneerSelvam@....com>,
	<thomas.hellstrom@...ux.intel.com>, <asomalap@....com>,
	<ruanjinjie@...wei.com>, <quic_jjohnson@...cinc.com>,
	<dri-devel@...ts.freedesktop.org>, <linux-kernel@...r.kernel.org>
Subject: [PATCH] drm/ttm/tests: Fix memory leak in ttm_bo_kunit_init()

The struct file allocated in drm_gem_object_init() is not freed
by ttm_bo_kunit_init(), which cause the folling memory leak.

	unreferenced object 0xffffff80cb18d500 (size 360):
	  comm "kunit_try_catch", pid 2149, jiffies 4295089512
	  hex dump (first 32 bytes):
	    01 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de  .............N..
	    ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff  ................
	  backtrace (crc ddf6bd5e):
	    [<000000002be7594b>] kmemleak_alloc+0x34/0x40
	    [<000000001b27be1f>] kmem_cache_alloc_noprof+0x254/0x2d8
	    [<00000000405acfaa>] alloc_empty_file+0x68/0x170
	    [<00000000dbe51815>] alloc_file_pseudo+0x108/0x1a0
	    [<00000000949320a0>] __shmem_file_setup+0x1b4/0x25c
	    [<000000009db3a347>] shmem_file_setup+0x30/0x3c
	    [<0000000093e9ae86>] drm_gem_object_init+0x34/0x78
	    [<000000007a24c4bb>] ttm_bo_kunit_init+0x1c0/0x3d8 [ttm_kunit_helpers]
	    [<00000000ab75e6de>] 0xffffffe699023b24
	    [<00000000cfb8042e>] kunit_try_run_case+0x13c/0x3ac
	    [<0000000003bffcc3>] kunit_generic_run_threadfn_adapter+0x80/0xec
	    [<000000003f986493>] kthread+0x2e8/0x374
	    [<00000000ac1ed701>] ret_from_fork+0x10/0x20
	......

Add kunit_action_obj_fput() to fput it automatically.

Cc: stable@...r.kernel.org
Fixes: 9afc1e0aa485 ("drm/ttm/tests: Add tests for ttm_resource and ttm_sys_man")
Signed-off-by: Jinjie Ruan <ruanjinjie@...wei.com>
---
 drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c b/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c
index 9ff216ec58ef..5e1e5fe41bb9 100644
--- a/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c
+++ b/drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c
@@ -2,6 +2,8 @@
 /*
  * Copyright © 2023 Intel Corporation
  */
+#include <linux/file.h>
+
 #include <drm/ttm/ttm_tt.h>
 
 #include "ttm_kunit_helpers.h"
@@ -168,6 +170,14 @@ int ttm_device_kunit_init_bad_evict(struct ttm_test_devices *priv,
 }
 EXPORT_SYMBOL_GPL(ttm_device_kunit_init_bad_evict);
 
+static void kunit_action_obj_fput(void *ptr)
+{
+	struct drm_gem_object *obj = ptr;
+
+	if (obj->filp)
+		fput(obj->filp);
+}
+
 struct ttm_buffer_object *ttm_bo_kunit_init(struct kunit *test,
 					    struct ttm_test_devices *devs,
 					    size_t size,
@@ -188,6 +198,9 @@ struct ttm_buffer_object *ttm_bo_kunit_init(struct kunit *test,
 	err = drm_gem_object_init(devs->drm, &bo->base, size);
 	KUNIT_ASSERT_EQ(test, err, 0);
 
+	err = kunit_add_action_or_reset(test, kunit_action_obj_fput, &bo->base);
+	KUNIT_ASSERT_EQ(test, err, 0);
+
 	bo->bdev = devs->ttm_dev;
 	bo->destroy = dummy_ttm_bo_destroy;
 
-- 
2.34.1