All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: cluster-devel.redhat.com
Subject: [Cluster-devel] [PATCH AUTOSEL 4.14 18/52] fs: dlm: fix configfs memory leak
Date: Sun, 18 Oct 2020 15:24:55 -0400	[thread overview]
Message-ID: <20201018192530.4055730-18-sashal@kernel.org> (raw)
In-Reply-To: <20201018192530.4055730-1-sashal@kernel.org>

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 3d2825c8c6105b0f36f3ff72760799fa2e71420e ]

This patch fixes the following memory detected by kmemleak and umount
gfs2 filesystem which removed the last lockspace:

unreferenced object 0xffff9264f482f600 (size 192):
  comm "dlm_controld", pid 325, jiffies 4294690276 (age 48.136s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 6e 6f 64 65 73 00 00 00  ........nodes...
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000060481d7>] make_space+0x41/0x130
    [<000000008d905d46>] configfs_mkdir+0x1a2/0x5f0
    [<00000000729502cf>] vfs_mkdir+0x155/0x210
    [<000000000369bcf1>] do_mkdirat+0x6d/0x110
    [<00000000cc478a33>] do_syscall_64+0x33/0x40
    [<00000000ce9ccf01>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

The patch just remembers the "nodes" entry pointer in space as I think
it's created as subdirectory when parent "spaces" is created. In
function drop_space() we will lost the pointer reference to nds because
configfs_remove_default_groups(). However as this subdirectory is always
available when "spaces" exists it will just be freed when "spaces" will be
freed.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/config.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/dlm/config.c b/fs/dlm/config.c
index 7211e826d90df..472f4f835d3e1 100644
--- a/fs/dlm/config.c
+++ b/fs/dlm/config.c
@@ -218,6 +218,7 @@ struct dlm_space {
 	struct list_head members;
 	struct mutex members_lock;
 	int members_count;
+	struct dlm_nodes *nds;
 };
 
 struct dlm_comms {
@@ -426,6 +427,7 @@ static struct config_group *make_space(struct config_group *g, const char *name)
 	INIT_LIST_HEAD(&sp->members);
 	mutex_init(&sp->members_lock);
 	sp->members_count = 0;
+	sp->nds = nds;
 	return &sp->group;
 
  fail:
@@ -447,6 +449,7 @@ static void drop_space(struct config_group *g, struct config_item *i)
 static void release_space(struct config_item *i)
 {
 	struct dlm_space *sp = config_item_to_space(i);
+	kfree(sp->nds);
 	kfree(sp);
 }
 
-- 
2.25.1




WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Alexander Aring <aahringo@redhat.com>,
	David Teigland <teigland@redhat.com>,
	Sasha Levin <sashal@kernel.org>,
	cluster-devel@redhat.com
Subject: [PATCH AUTOSEL 4.14 18/52] fs: dlm: fix configfs memory leak
Date: Sun, 18 Oct 2020 15:24:55 -0400	[thread overview]
Message-ID: <20201018192530.4055730-18-sashal@kernel.org> (raw)
In-Reply-To: <20201018192530.4055730-1-sashal@kernel.org>

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 3d2825c8c6105b0f36f3ff72760799fa2e71420e ]

This patch fixes the following memory detected by kmemleak and umount
gfs2 filesystem which removed the last lockspace:

unreferenced object 0xffff9264f482f600 (size 192):
  comm "dlm_controld", pid 325, jiffies 4294690276 (age 48.136s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 6e 6f 64 65 73 00 00 00  ........nodes...
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000060481d7>] make_space+0x41/0x130
    [<000000008d905d46>] configfs_mkdir+0x1a2/0x5f0
    [<00000000729502cf>] vfs_mkdir+0x155/0x210
    [<000000000369bcf1>] do_mkdirat+0x6d/0x110
    [<00000000cc478a33>] do_syscall_64+0x33/0x40
    [<00000000ce9ccf01>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

The patch just remembers the "nodes" entry pointer in space as I think
it's created as subdirectory when parent "spaces" is created. In
function drop_space() we will lost the pointer reference to nds because
configfs_remove_default_groups(). However as this subdirectory is always
available when "spaces" exists it will just be freed when "spaces" will be
freed.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/dlm/config.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/dlm/config.c b/fs/dlm/config.c
index 7211e826d90df..472f4f835d3e1 100644
--- a/fs/dlm/config.c
+++ b/fs/dlm/config.c
@@ -218,6 +218,7 @@ struct dlm_space {
 	struct list_head members;
 	struct mutex members_lock;
 	int members_count;
+	struct dlm_nodes *nds;
 };
 
 struct dlm_comms {
@@ -426,6 +427,7 @@ static struct config_group *make_space(struct config_group *g, const char *name)
 	INIT_LIST_HEAD(&sp->members);
 	mutex_init(&sp->members_lock);
 	sp->members_count = 0;
+	sp->nds = nds;
 	return &sp->group;
 
  fail:
@@ -447,6 +449,7 @@ static void drop_space(struct config_group *g, struct config_item *i)
 static void release_space(struct config_item *i)
 {
 	struct dlm_space *sp = config_item_to_space(i);
+	kfree(sp->nds);
 	kfree(sp);
 }
 
-- 
2.25.1


  parent reply	other threads:[~2020-10-18 19:24 UTC|newest]

Thread overview: 60+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-18 19:24 [PATCH AUTOSEL 4.14 01/52] crypto: ccp - fix error handling Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 02/52] media: firewire: fix memory leak Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 03/52] media: ati_remote: sanity check for both endpoints Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 04/52] media: st-delta: Fix reference count leak in delta_run_work Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 05/52] media: sti: Fix reference count leaks Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 06/52] media: exynos4-is: Fix several reference count leaks due to pm_runtime_get_sync Sasha Levin
2020-10-18 19:24   ` Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 07/52] media: exynos4-is: Fix a reference count leak " Sasha Levin
2020-10-18 19:24   ` Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 08/52] media: exynos4-is: Fix a reference count leak Sasha Levin
2020-10-18 19:24   ` Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 09/52] media: vsp1: Fix runtime PM imbalance on error Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 10/52] media: platform: s3c-camif: " Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 11/52] media: platform: sti: hva: " Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 12/52] media: bdisp: " Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 13/52] media: media/pci: prevent memory leak in bttv_probe Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 14/52] media: uvcvideo: Ensure all probed info is returned to v4l2 Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 15/52] seccomp: kill process instead of thread for unknown actions Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 16/52] mmc: sdio: Check for CISTPL_VERS_1 buffer size Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 17/52] media: saa7134: avoid a shift overflow Sasha Levin
2020-10-18 19:24 ` Sasha Levin [this message]
2020-10-18 19:24   ` [PATCH AUTOSEL 4.14 18/52] fs: dlm: fix configfs memory leak Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 19/52] media: venus: core: Fix runtime PM imbalance in venus_probe Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 20/52] ipv6/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 21/52] ntfs: add check for mft record size in superblock Sasha Levin
2020-10-18 19:24 ` [PATCH AUTOSEL 4.14 22/52] mac80211: handle lack of sband->bitrates in rates Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 23/52] PM: hibernate: remove the bogus call to get_gendisk() in software_resume() Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 24/52] scsi: mvumi: Fix error return in mvumi_io_attach() Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 25/52] scsi: target: core: Add CONTROL field for trace events Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 26/52] mic: vop: copy data to kernel space then write to io memory Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 27/52] misc: vop: add round_up(x,4) for vring_size to avoid kernel panic Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 28/52] usb: gadget: function: printer: fix use-after-free in __lock_acquire Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 29/52] udf: Limit sparing table size Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 30/52] udf: Avoid accessing uninitialized data on failed inode read Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 31/52] USB: cdc-acm: handle broken union descriptors Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 32/52] can: flexcan: flexcan_chip_stop(): add error handling and propagate error value Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 33/52] ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 34/52] misc: rtsx: Fix memory leak in rtsx_pci_probe Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 35/52] reiserfs: only call unlock_new_inode() if I_NEW Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 36/52] xfs: make sure the rt allocator doesn't run off the end Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 37/52] usb: ohci: Default to per-port over-current protection Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 38/52] Bluetooth: Only mark socket zapped after unlocking Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 39/52] scsi: ibmvfc: Fix error return in ibmvfc_probe() Sasha Levin
2020-10-18 19:25   ` Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 40/52] brcmsmac: fix memory leak in wlc_phy_attach_lcnphy Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 41/52] rtl8xxxu: prevent potential memory leak Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 42/52] Fix use after free in get_capset_info callback Sasha Levin
2020-10-18 19:25   ` Sasha Levin
2020-10-18 19:25   ` Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 43/52] scsi: qedi: Protect active command list to avoid list corruption Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 44/52] scsi: qedi: Fix list_del corruption while removing active I/O Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 45/52] tty: ipwireless: fix error handling Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 46/52] ipvs: Fix uninit-value in do_ip_vs_set_ctl() Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 47/52] reiserfs: Fix memory leak in reiserfs_parse_options() Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 48/52] mwifiex: don't call del_timer_sync() on uninitialized timer Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 49/52] brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 50/52] usb: core: Solve race condition in anchor cleanup functions Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 51/52] scsi: ufs: ufs-qcom: Fix race conditions caused by ufs_qcom_testbus_config() Sasha Levin
2020-10-18 19:25 ` [PATCH AUTOSEL 4.14 52/52] ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() Sasha Levin
2020-10-18 19:25   ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201018192530.4055730-18-sashal@kernel.org \
    --to=sashal@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.