From: Qian Cai <cai@redhat.com>
To: David Howells <dhowells@redhat.com>,
Alexander Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] pipe: Fix memory leaks in create_pipe_files()
Date: Wed, 30 Sep 2020 20:58:04 -0400 [thread overview]
Message-ID: <20201001005804.25641-1-cai@redhat.com> (raw)
Calling pipe2() with O_NOTIFICATION_PIPE could results in memory leaks
in an error path or CONFIG_WATCH_QUEUE=n. Plug them.
unreferenced object 0xc00000141114a0d8 (size 992):
comm "trinity-c61", pid 1353192, jiffies 4296255779 (age 25989.560s)
hex dump (first 32 bytes):
80 11 00 00 e8 03 00 00 00 00 00 00 00 00 00 00 ................
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
backtrace:
[<00000000abff13d7>] kmem_cache_alloc+0x1b4/0x470
[<000000009502e5d5>] alloc_inode+0xd0/0x130
[<00000000ca1c1a21>] new_inode_pseudo+0x1c/0x80
new_inode_pseudo at fs/inode.c:932
[<000000000c01d1d6>] create_pipe_files+0x48/0x2d0
get_pipe_inode at fs/pipe.c:874
(inlined by) create_pipe_files at fs/pipe.c:914
[<00000000d13ff4c4>] __do_pipe_flags+0x50/0x120
__do_pipe_flags at fs/pipe.c:965
[<0000000003941e42>] do_pipe2+0x3c/0x100
do_pipe2 at fs/pipe.c:1013
[<00000000a006b818>] sys_pipe2+0x1c/0x30
__se_sys_pipe2 at fs/pipe.c:1028
[<00000000a6925b55>] system_call_exception+0xf8/0x1d0
[<000000001c6b0740>] system_call_common+0xe8/0x218
unreferenced object 0xc000001f575ce600 (size 512):
comm "trinity-c61", pid 1353192, jiffies 4296255779 (age 25989.560s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N..
ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ................
backtrace:
[<00000000d74d5e3a>] kmem_cache_alloc_trace+0x1c4/0x2d0
[<0000000061cbc9cb>] alloc_pipe_info+0x88/0x2c0
kmalloc at include/linux/slab.h:554
(inlined by) kzalloc at include/linux/slab.h:666
(inlined by) alloc_pipe_info at fs/pipe.c:793
[<00000000efd6129c>] create_pipe_files+0x6c/0x2d0
get_pipe_inode at fs/pipe.c:883
(inlined by) create_pipe_files at fs/pipe.c:914
[<00000000d13ff4c4>] __do_pipe_flags+0x50/0x120
[<0000000003941e42>] do_pipe2+0x3c/0x100
[<00000000a006b818>] sys_pipe2+0x1c/0x30
[<00000000a6925b55>] system_call_exception+0xf8/0x1d0
[<000000001c6b0740>] system_call_common+0xe8/0x218
unreferenced object 0xc000000d94f20400 (size 1024):
comm "trinity-c61", pid 1353192, jiffies 4296255779 (age 25989.560s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e60ee00f>] __kmalloc+0x1e4/0x330
[<00000000130e8cc8>] alloc_pipe_info+0x154/0x2c0
kmalloc_array at include/linux/slab.h:594
(inlined by) kcalloc at include/linux/slab.h:605
(inlined by) alloc_pipe_info at fs/pipe.c:810
[<00000000efd6129c>] create_pipe_files+0x6c/0x2d0
[<00000000d13ff4c4>] __do_pipe_flags+0x50/0x120
[<0000000003941e42>] do_pipe2+0x3c/0x100
[<00000000a006b818>] sys_pipe2+0x1c/0x30
[<00000000a6925b55>] system_call_exception+0xf8/0x1d0
[<000000001c6b0740>] system_call_common+0xe8/0x218
Fixes: c73be61cede5 ("pipe: Add general notification queue support")
Signed-off-by: Qian Cai <cai@redhat.com>
---
fs/pipe.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/pipe.c b/fs/pipe.c
index 60dbee457143..5184972cd9c0 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -920,10 +920,13 @@ int create_pipe_files(struct file **res, int flags)
if (flags & O_NOTIFICATION_PIPE) {
#ifdef CONFIG_WATCH_QUEUE
if (watch_queue_init(inode->i_pipe) < 0) {
+ free_pipe_info(inode->i_pipe);
iput(inode);
return -ENOMEM;
}
#else
+ free_pipe_info(inode->i_pipe);
+ iput(inode);
return -ENOPKG;
#endif
}
--
2.28.0
next reply other threads:[~2020-10-01 0:58 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-01 0:58 Qian Cai [this message]
2020-10-01 1:35 ` [PATCH] pipe: Fix memory leaks in create_pipe_files() Al Viro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201001005804.25641-1-cai@redhat.com \
--to=cai@redhat.com \
--cc=dhowells@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.