* [Bug report] Memory leak in scmi_device_create
@ 2025-03-05 11:59 Alice Ryhl
2025-03-05 17:10 ` Cristian Marussi
0 siblings, 1 reply; 9+ messages in thread
From: Alice Ryhl @ 2025-03-05 11:59 UTC (permalink / raw)
To: Sudeep Holla, Cristian Marussi; +Cc: linux-arm-kernel, arm-scmi, linux-kernel
Dear SYSTEM CONTROL & POWER/MANAGEMENT INTERFACE (SCPI/SCMI) Message
Protocol drivers maintainers,
I flashed a v6.13-rc3 kernel onto a Rock5B board and noticed the
following output in my terminal:
[ 687.694465] kmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
It seems that there is a memory leak for devices created with
scmi_device_create.
This was with a kernel running v6.13-rc3, but as far as I can tell, no
relevant changes have landed since v6.13-rc3. My tree *does* include
commit 295416091e44 ("firmware: arm_scmi: Fix slab-use-after-free in
scmi_bus_notifier()"). I've only seen this kmemleak report once, so it's
not happening consistently.
See below for the full kmemleak report.
Alice
$ sudo cat /sys/kernel/debug/kmemleak
unreferenced object 0xffffff8106c86000 (size 2048):
comm "swapper/0", pid 1, jiffies 4294893094
hex dump (first 32 bytes):
02 00 00 00 10 00 00 00 c0 01 bc 03 81 ff ff ff ................
60 67 ba 03 81 ff ff ff 18 60 c8 06 81 ff ff ff `g.......`......
backtrace (crc feae9680):
[<00000000197aa008>] kmemleak_alloc+0x34/0xa0
[<0000000056fe02c9>] __kmalloc_cache_noprof+0x1e0/0x450
[<00000000a8b3dfe1>] __scmi_device_create+0xb4/0x2b4
[<000000008714917b>] scmi_device_create+0x40/0x194
[<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
[<00000000970bad38>] scmi_probe+0x584/0xa78
[<000000002600d2fd>] platform_probe+0xbc/0xf0
[<00000000f6f556b4>] really_probe+0x1b8/0x520
[<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
[<00000000d613b754>] driver_probe_device+0x6c/0x208
[<00000000187a9170>] __driver_attach+0x168/0x328
[<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
[<00000000984a3176>] driver_attach+0x34/0x44
[<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
[<00000000747fce19>] driver_register+0xc0/0x1a0
[<0000000081cb8754>] __platform_driver_register+0x40/0x50
unreferenced object 0xffffff8103bc01c0 (size 32):
comm "swapper/0", pid 1, jiffies 4294893094
hex dump (first 32 bytes):
5f 5f 73 63 6d 69 5f 74 72 61 6e 73 70 6f 72 74 __scmi_transport
5f 64 65 76 69 63 65 5f 72 78 5f 31 30 00 ff ff _device_rx_10...
backtrace (crc 8dab7ca7):
[<00000000197aa008>] kmemleak_alloc+0x34/0xa0
[<00000000500dbc08>] __kmalloc_node_track_caller_noprof+0x234/0x528
[<000000004990eea4>] kstrdup+0x48/0x80
[<00000000ad4d2923>] kstrdup_const+0x30/0x3c
[<00000000e9d3bdc3>] __scmi_device_create+0xd4/0x2b4
[<000000008714917b>] scmi_device_create+0x40/0x194
[<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
[<00000000970bad38>] scmi_probe+0x584/0xa78
[<000000002600d2fd>] platform_probe+0xbc/0xf0
[<00000000f6f556b4>] really_probe+0x1b8/0x520
[<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
[<00000000d613b754>] driver_probe_device+0x6c/0x208
[<00000000187a9170>] __driver_attach+0x168/0x328
[<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
[<00000000984a3176>] driver_attach+0x34/0x44
[<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
unreferenced object 0xffffff8103ba6760 (size 16):
comm "swapper/0", pid 1, jiffies 4294893094
hex dump (first 16 bytes):
73 63 6d 69 5f 64 65 76 2e 32 00 03 81 ff ff ff scmi_dev.2......
backtrace (crc ccc21b9a):
[<00000000197aa008>] kmemleak_alloc+0x34/0xa0
[<00000000500dbc08>] __kmalloc_node_track_caller_noprof+0x234/0x528
[<00000000cdc440a0>] kvasprintf+0x90/0x11c
[<00000000500fc732>] kvasprintf_const+0x98/0x138
[<0000000030e28143>] kobject_set_name_vargs+0x68/0x104
[<00000000f15f6ece>] dev_set_name+0x6c/0x98
[<00000000c1f76eb4>] __scmi_device_create+0x17c/0x2b4
[<000000008714917b>] scmi_device_create+0x40/0x194
[<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
[<00000000970bad38>] scmi_probe+0x584/0xa78
[<000000002600d2fd>] platform_probe+0xbc/0xf0
[<00000000f6f556b4>] really_probe+0x1b8/0x520
[<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
[<00000000d613b754>] driver_probe_device+0x6c/0x208
[<00000000187a9170>] __driver_attach+0x168/0x328
[<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
unreferenced object 0xffffff810637c800 (size 512):
comm "swapper/0", pid 1, jiffies 4294893094
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff 00 1e ee 83 c0 ff ff ff ................
backtrace (crc 732b3ae6):
[<00000000197aa008>] kmemleak_alloc+0x34/0xa0
[<0000000056fe02c9>] __kmalloc_cache_noprof+0x1e0/0x450
[<0000000026a3cb30>] device_add+0x54/0x570
[<00000000e515c343>] device_register+0x20/0x30
[<0000000042008204>] __scmi_device_create+0x184/0x2b4
[<000000008714917b>] scmi_device_create+0x40/0x194
[<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
[<00000000970bad38>] scmi_probe+0x584/0xa78
[<000000002600d2fd>] platform_probe+0xbc/0xf0
[<00000000f6f556b4>] really_probe+0x1b8/0x520
[<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
[<00000000d613b754>] driver_probe_device+0x6c/0x208
[<00000000187a9170>] __driver_attach+0x168/0x328
[<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
[<00000000984a3176>] driver_attach+0x34/0x44
[<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Bug report] Memory leak in scmi_device_create
2025-03-05 11:59 [Bug report] Memory leak in scmi_device_create Alice Ryhl
@ 2025-03-05 17:10 ` Cristian Marussi
2025-03-06 11:09 ` Alice Ryhl
0 siblings, 1 reply; 9+ messages in thread
From: Cristian Marussi @ 2025-03-05 17:10 UTC (permalink / raw)
To: Alice Ryhl
Cc: Sudeep Holla, Cristian Marussi, linux-arm-kernel, arm-scmi,
linux-kernel
On Wed, Mar 05, 2025 at 11:59:58AM +0000, Alice Ryhl wrote:
> Dear SYSTEM CONTROL & POWER/MANAGEMENT INTERFACE (SCPI/SCMI) Message
> Protocol drivers maintainers,
>
> I flashed a v6.13-rc3 kernel onto a Rock5B board and noticed the
> following output in my terminal:
>
> [ 687.694465] kmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
>
> It seems that there is a memory leak for devices created with
> scmi_device_create.
>
`
Hi Alice,
thanks for this report.
> This was with a kernel running v6.13-rc3, but as far as I can tell, no
> relevant changes have landed since v6.13-rc3. My tree *does* include
> commit 295416091e44 ("firmware: arm_scmi: Fix slab-use-after-free in
> scmi_bus_notifier()"). I've only seen this kmemleak report once, so it's
> not happening consistently.
>
> See below for the full kmemleak report.
>
> Alice
>
> $ sudo cat /sys/kernel/debug/kmemleak
> unreferenced object 0xffffff8106c86000 (size 2048):
> comm "swapper/0", pid 1, jiffies 4294893094
> hex dump (first 32 bytes):
> 02 00 00 00 10 00 00 00 c0 01 bc 03 81 ff ff ff ................
> 60 67 ba 03 81 ff ff ff 18 60 c8 06 81 ff ff ff `g.......`......
> backtrace (crc feae9680):
> [<00000000197aa008>] kmemleak_alloc+0x34/0xa0
> [<0000000056fe02c9>] __kmalloc_cache_noprof+0x1e0/0x450
> [<00000000a8b3dfe1>] __scmi_device_create+0xb4/0x2b4
> [<000000008714917b>] scmi_device_create+0x40/0x194
> [<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
> [<00000000970bad38>] scmi_probe+0x584/0xa78
> [<000000002600d2fd>] platform_probe+0xbc/0xf0
> [<00000000f6f556b4>] really_probe+0x1b8/0x520
> [<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
> [<00000000d613b754>] driver_probe_device+0x6c/0x208
> [<00000000187a9170>] __driver_attach+0x168/0x328
> [<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
> [<00000000984a3176>] driver_attach+0x34/0x44
> [<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
> [<00000000747fce19>] driver_register+0xc0/0x1a0
> [<0000000081cb8754>] __platform_driver_register+0x40/0x50
> unreferenced object 0xffffff8103bc01c0 (size 32):
I could not reproduce on my setup, even though I run a system with
all the existent SCMI protocols (and related drivers) enabled (and
so a lot of device creations) and a downstream test driver that causes
even more SCMI devices to be created/destroyed at load/unload.
Coming down the path from scmi_chan_setup(), it seems something around
transport devices creation, but it is not obvious to me where the leak
could hide....
...any particular setup on your side ? ...using LKMs, loading/unloading,
any usage pattern that could help me reproduce ?
Thanks,
Cristian
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Bug report] Memory leak in scmi_device_create
2025-03-05 17:10 ` Cristian Marussi
@ 2025-03-06 11:09 ` Alice Ryhl
2025-03-06 12:50 ` Cristian Marussi
2025-03-06 14:36 ` Catalin Marinas
0 siblings, 2 replies; 9+ messages in thread
From: Alice Ryhl @ 2025-03-06 11:09 UTC (permalink / raw)
To: Cristian Marussi; +Cc: Sudeep Holla, linux-arm-kernel, arm-scmi, linux-kernel
On Wed, Mar 05, 2025 at 05:10:16PM +0000, Cristian Marussi wrote:
> On Wed, Mar 05, 2025 at 11:59:58AM +0000, Alice Ryhl wrote:
> > Dear SYSTEM CONTROL & POWER/MANAGEMENT INTERFACE (SCPI/SCMI) Message
> > Protocol drivers maintainers,
> >
> > I flashed a v6.13-rc3 kernel onto a Rock5B board and noticed the
> > following output in my terminal:
> >
> > [ 687.694465] kmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
> >
> > It seems that there is a memory leak for devices created with
> > scmi_device_create.
> >
> `
> Hi Alice,
>
> thanks for this report.
>
> > This was with a kernel running v6.13-rc3, but as far as I can tell, no
> > relevant changes have landed since v6.13-rc3. My tree *does* include
> > commit 295416091e44 ("firmware: arm_scmi: Fix slab-use-after-free in
> > scmi_bus_notifier()"). I've only seen this kmemleak report once, so it's
> > not happening consistently.
> >
> > See below for the full kmemleak report.
> >
> > Alice
> >
> > $ sudo cat /sys/kernel/debug/kmemleak
> > unreferenced object 0xffffff8106c86000 (size 2048):
> > comm "swapper/0", pid 1, jiffies 4294893094
> > hex dump (first 32 bytes):
> > 02 00 00 00 10 00 00 00 c0 01 bc 03 81 ff ff ff ................
> > 60 67 ba 03 81 ff ff ff 18 60 c8 06 81 ff ff ff `g.......`......
> > backtrace (crc feae9680):
> > [<00000000197aa008>] kmemleak_alloc+0x34/0xa0
> > [<0000000056fe02c9>] __kmalloc_cache_noprof+0x1e0/0x450
> > [<00000000a8b3dfe1>] __scmi_device_create+0xb4/0x2b4
> > [<000000008714917b>] scmi_device_create+0x40/0x194
> > [<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
> > [<00000000970bad38>] scmi_probe+0x584/0xa78
> > [<000000002600d2fd>] platform_probe+0xbc/0xf0
> > [<00000000f6f556b4>] really_probe+0x1b8/0x520
> > [<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
> > [<00000000d613b754>] driver_probe_device+0x6c/0x208
> > [<00000000187a9170>] __driver_attach+0x168/0x328
> > [<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
> > [<00000000984a3176>] driver_attach+0x34/0x44
> > [<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
> > [<00000000747fce19>] driver_register+0xc0/0x1a0
> > [<0000000081cb8754>] __platform_driver_register+0x40/0x50
> > unreferenced object 0xffffff8103bc01c0 (size 32):
>
> I could not reproduce on my setup, even though I run a system with
> all the existent SCMI protocols (and related drivers) enabled (and
> so a lot of device creations) and a downstream test driver that causes
> even more SCMI devices to be created/destroyed at load/unload.
>
> Coming down the path from scmi_chan_setup(), it seems something around
> transport devices creation, but it is not obvious to me where the leak
> could hide....
>
> ...any particular setup on your side ? ...using LKMs, loading/unloading,
> any usage pattern that could help me reproduce ?
I looked into this a bit more, and actually it does happen consistently.
It's just that kmemleak doesn't report it until 10 minutes after
booting, so I did not notice it.
As for my setup, well, I boot the kernel over pxe and the rootfs is
mounted over NFSv4. The memory leak happens even if I don't do anything
at all - I just boot and wait. The device is a Radxa Rock5B.
Not sure what other information there is to give.
I tried again with v6.14-rc5, and I still got the leak:
user@rk3588-ci:~$ sudo cat /sys/kernel/debug/kmemleak
unreferenced object 0xffffff81068c0000 (size 2048):
comm "swapper/0", pid 1, jiffies 4294893128
hex dump (first 32 bytes):
02 00 00 00 10 00 00 00 40 a3 7a 03 81 ff ff ff ........@.z.....
60 c8 79 03 81 ff ff ff 18 00 8c 06 81 ff ff ff `.y.............
backtrace (crc 60df30fb):
kmemleak_alloc+0x34/0xa0
__kmalloc_cache_noprof+0x1e0/0x450
__scmi_device_create+0xb4/0x2b4
scmi_device_create+0x40/0x194
scmi_chan_setup+0x144/0x3b8
scmi_probe+0x51c/0x9fc
platform_probe+0xbc/0xf0
really_probe+0x1b8/0x520
__driver_probe_device+0xe0/0x1d8
driver_probe_device+0x6c/0x208
__driver_attach+0x168/0x328
bus_for_each_dev+0x14c/0x178
driver_attach+0x34/0x44
bus_add_driver+0x1bc/0x358
driver_register+0xc0/0x1a0
__platform_driver_register+0x40/0x50
unreferenced object 0xffffff81037aa340 (size 32):
comm "swapper/0", pid 1, jiffies 4294893128
hex dump (first 32 bytes):
5f 5f 73 63 6d 69 5f 74 72 61 6e 73 70 6f 72 74 __scmi_transport
5f 64 65 76 69 63 65 5f 72 78 5f 31 30 00 ff ff _device_rx_10...
backtrace (crc 8dab7ca7):
kmemleak_alloc+0x34/0xa0
__kmalloc_node_track_caller_noprof+0x234/0x528
kstrdup+0x48/0x80
kstrdup_const+0x30/0x3c
__scmi_device_create+0xd4/0x2b4
scmi_device_create+0x40/0x194
scmi_chan_setup+0x144/0x3b8
scmi_probe+0x51c/0x9fc
platform_probe+0xbc/0xf0
really_probe+0x1b8/0x520
__driver_probe_device+0xe0/0x1d8
driver_probe_device+0x6c/0x208
__driver_attach+0x168/0x328
bus_for_each_dev+0x14c/0x178
driver_attach+0x34/0x44
bus_add_driver+0x1bc/0x358
unreferenced object 0xffffff810379c860 (size 16):
comm "swapper/0", pid 1, jiffies 4294893128
hex dump (first 16 bytes):
73 63 6d 69 5f 64 65 76 2e 32 00 03 81 ff ff ff scmi_dev.2......
backtrace (crc ccc21b9a):
kmemleak_alloc+0x34/0xa0
__kmalloc_node_track_caller_noprof+0x234/0x528
kvasprintf+0x90/0x11c
kvasprintf_const+0x98/0x138
kobject_set_name_vargs+0x68/0x104
dev_set_name+0x6c/0x98
__scmi_device_create+0x17c/0x2b4
scmi_device_create+0x40/0x194
scmi_chan_setup+0x144/0x3b8
scmi_probe+0x51c/0x9fc
platform_probe+0xbc/0xf0
really_probe+0x1b8/0x520
__driver_probe_device+0xe0/0x1d8
driver_probe_device+0x6c/0x208
__driver_attach+0x168/0x328
bus_for_each_dev+0x14c/0x178
unreferenced object 0xffffff8105be7400 (size 512):
comm "swapper/0", pid 1, jiffies 4294893128
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff c0 b4 f0 83 c0 ff ff ff ................
backtrace (crc 7b92a969):
kmemleak_alloc+0x34/0xa0
__kmalloc_cache_noprof+0x1e0/0x450
device_add+0x54/0x570
device_register+0x20/0x30
__scmi_device_create+0x184/0x2b4
scmi_device_create+0x40/0x194
scmi_chan_setup+0x144/0x3b8
scmi_probe+0x51c/0x9fc
platform_probe+0xbc/0xf0
really_probe+0x1b8/0x520
__driver_probe_device+0xe0/0x1d8
driver_probe_device+0x6c/0x208
__driver_attach+0x168/0x328
bus_for_each_dev+0x14c/0x178
driver_attach+0x34/0x44
bus_add_driver+0x1bc/0x358
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Bug report] Memory leak in scmi_device_create
2025-03-06 11:09 ` Alice Ryhl
@ 2025-03-06 12:50 ` Cristian Marussi
2025-03-06 13:25 ` Alice Ryhl
2025-03-06 14:36 ` Catalin Marinas
1 sibling, 1 reply; 9+ messages in thread
From: Cristian Marussi @ 2025-03-06 12:50 UTC (permalink / raw)
To: Alice Ryhl
Cc: Cristian Marussi, Sudeep Holla, linux-arm-kernel, arm-scmi,
linux-kernel
On Thu, Mar 06, 2025 at 11:09:33AM +0000, Alice Ryhl wrote:
> On Wed, Mar 05, 2025 at 05:10:16PM +0000, Cristian Marussi wrote:
> > On Wed, Mar 05, 2025 at 11:59:58AM +0000, Alice Ryhl wrote:
> > > Dear SYSTEM CONTROL & POWER/MANAGEMENT INTERFACE (SCPI/SCMI) Message
> > > Protocol drivers maintainers,
> > >
> > > I flashed a v6.13-rc3 kernel onto a Rock5B board and noticed the
> > > following output in my terminal:
> > >
> > > [ 687.694465] kmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
> > >
> > > It seems that there is a memory leak for devices created with
> > > scmi_device_create.
> > >
> > `
> > Hi Alice,
> >
> > thanks for this report.
> >
> > > This was with a kernel running v6.13-rc3, but as far as I can tell, no
> > > relevant changes have landed since v6.13-rc3. My tree *does* include
> > > commit 295416091e44 ("firmware: arm_scmi: Fix slab-use-after-free in
> > > scmi_bus_notifier()"). I've only seen this kmemleak report once, so it's
> > > not happening consistently.
> > >
> > > See below for the full kmemleak report.
> > >
> > > Alice
> > >
> > > $ sudo cat /sys/kernel/debug/kmemleak
> > > unreferenced object 0xffffff8106c86000 (size 2048):
> > > comm "swapper/0", pid 1, jiffies 4294893094
> > > hex dump (first 32 bytes):
> > > 02 00 00 00 10 00 00 00 c0 01 bc 03 81 ff ff ff ................
> > > 60 67 ba 03 81 ff ff ff 18 60 c8 06 81 ff ff ff `g.......`......
> > > backtrace (crc feae9680):
> > > [<00000000197aa008>] kmemleak_alloc+0x34/0xa0
> > > [<0000000056fe02c9>] __kmalloc_cache_noprof+0x1e0/0x450
> > > [<00000000a8b3dfe1>] __scmi_device_create+0xb4/0x2b4
> > > [<000000008714917b>] scmi_device_create+0x40/0x194
> > > [<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
> > > [<00000000970bad38>] scmi_probe+0x584/0xa78
> > > [<000000002600d2fd>] platform_probe+0xbc/0xf0
> > > [<00000000f6f556b4>] really_probe+0x1b8/0x520
> > > [<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
> > > [<00000000d613b754>] driver_probe_device+0x6c/0x208
> > > [<00000000187a9170>] __driver_attach+0x168/0x328
> > > [<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
> > > [<00000000984a3176>] driver_attach+0x34/0x44
> > > [<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
> > > [<00000000747fce19>] driver_register+0xc0/0x1a0
> > > [<0000000081cb8754>] __platform_driver_register+0x40/0x50
> > > unreferenced object 0xffffff8103bc01c0 (size 32):
> >
> > I could not reproduce on my setup, even though I run a system with
> > all the existent SCMI protocols (and related drivers) enabled (and
> > so a lot of device creations) and a downstream test driver that causes
> > even more SCMI devices to be created/destroyed at load/unload.
> >
> > Coming down the path from scmi_chan_setup(), it seems something around
> > transport devices creation, but it is not obvious to me where the leak
> > could hide....
> >
> > ...any particular setup on your side ? ...using LKMs, loading/unloading,
> > any usage pattern that could help me reproduce ?
>
> I looked into this a bit more, and actually it does happen consistently.
> It's just that kmemleak doesn't report it until 10 minutes after
> booting, so I did not notice it.
>
> As for my setup, well, I boot the kernel over pxe and the rootfs is
> mounted over NFSv4. The memory leak happens even if I don't do anything
> at all - I just boot and wait. The device is a Radxa Rock5B.
>
> Not sure what other information there is to give.
>
My question as stated above was mainly to understand if the SCMI stack
was built-in or compiled as loadable modules (lsmod|grep -i scmi)...
...I am just to try to pin down a possible 'more-vulnerable' configuration..
..I could not see any report even triggering a kmemleak scan on v6.14-rc5
BUT I only tested with a fully built-in SCMI stack indeed as of now...so
the question.
> I tried again with v6.14-rc5, and I still got the leak:
Ok...thanks I will investigate with different configs.
Thanks,
Cristian
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Bug report] Memory leak in scmi_device_create
2025-03-06 12:50 ` Cristian Marussi
@ 2025-03-06 13:25 ` Alice Ryhl
0 siblings, 0 replies; 9+ messages in thread
From: Alice Ryhl @ 2025-03-06 13:25 UTC (permalink / raw)
To: Cristian Marussi; +Cc: Sudeep Holla, linux-arm-kernel, arm-scmi, linux-kernel
On Thu, Mar 06, 2025 at 12:50:17PM +0000, Cristian Marussi wrote:
> On Thu, Mar 06, 2025 at 11:09:33AM +0000, Alice Ryhl wrote:
> > On Wed, Mar 05, 2025 at 05:10:16PM +0000, Cristian Marussi wrote:
> > > On Wed, Mar 05, 2025 at 11:59:58AM +0000, Alice Ryhl wrote:
> > > > Dear SYSTEM CONTROL & POWER/MANAGEMENT INTERFACE (SCPI/SCMI) Message
> > > > Protocol drivers maintainers,
> > > >
> > > > I flashed a v6.13-rc3 kernel onto a Rock5B board and noticed the
> > > > following output in my terminal:
> > > >
> > > > [ 687.694465] kmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
> > > >
> > > > It seems that there is a memory leak for devices created with
> > > > scmi_device_create.
> > > >
> > > `
> > > Hi Alice,
> > >
> > > thanks for this report.
> > >
> > > > This was with a kernel running v6.13-rc3, but as far as I can tell, no
> > > > relevant changes have landed since v6.13-rc3. My tree *does* include
> > > > commit 295416091e44 ("firmware: arm_scmi: Fix slab-use-after-free in
> > > > scmi_bus_notifier()"). I've only seen this kmemleak report once, so it's
> > > > not happening consistently.
> > > >
> > > > See below for the full kmemleak report.
> > > >
> > > > Alice
> > > >
> > > > $ sudo cat /sys/kernel/debug/kmemleak
> > > > unreferenced object 0xffffff8106c86000 (size 2048):
> > > > comm "swapper/0", pid 1, jiffies 4294893094
> > > > hex dump (first 32 bytes):
> > > > 02 00 00 00 10 00 00 00 c0 01 bc 03 81 ff ff ff ................
> > > > 60 67 ba 03 81 ff ff ff 18 60 c8 06 81 ff ff ff `g.......`......
> > > > backtrace (crc feae9680):
> > > > [<00000000197aa008>] kmemleak_alloc+0x34/0xa0
> > > > [<0000000056fe02c9>] __kmalloc_cache_noprof+0x1e0/0x450
> > > > [<00000000a8b3dfe1>] __scmi_device_create+0xb4/0x2b4
> > > > [<000000008714917b>] scmi_device_create+0x40/0x194
> > > > [<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
> > > > [<00000000970bad38>] scmi_probe+0x584/0xa78
> > > > [<000000002600d2fd>] platform_probe+0xbc/0xf0
> > > > [<00000000f6f556b4>] really_probe+0x1b8/0x520
> > > > [<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
> > > > [<00000000d613b754>] driver_probe_device+0x6c/0x208
> > > > [<00000000187a9170>] __driver_attach+0x168/0x328
> > > > [<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
> > > > [<00000000984a3176>] driver_attach+0x34/0x44
> > > > [<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
> > > > [<00000000747fce19>] driver_register+0xc0/0x1a0
> > > > [<0000000081cb8754>] __platform_driver_register+0x40/0x50
> > > > unreferenced object 0xffffff8103bc01c0 (size 32):
> > >
> > > I could not reproduce on my setup, even though I run a system with
> > > all the existent SCMI protocols (and related drivers) enabled (and
> > > so a lot of device creations) and a downstream test driver that causes
> > > even more SCMI devices to be created/destroyed at load/unload.
> > >
> > > Coming down the path from scmi_chan_setup(), it seems something around
> > > transport devices creation, but it is not obvious to me where the leak
> > > could hide....
> > >
> > > ...any particular setup on your side ? ...using LKMs, loading/unloading,
> > > any usage pattern that could help me reproduce ?
> >
> > I looked into this a bit more, and actually it does happen consistently.
> > It's just that kmemleak doesn't report it until 10 minutes after
> > booting, so I did not notice it.
> >
> > As for my setup, well, I boot the kernel over pxe and the rootfs is
> > mounted over NFSv4. The memory leak happens even if I don't do anything
> > at all - I just boot and wait. The device is a Radxa Rock5B.
> >
> > Not sure what other information there is to give.
> >
>
> My question as stated above was mainly to understand if the SCMI stack
> was built-in or compiled as loadable modules (lsmod|grep -i scmi)...
> ...I am just to try to pin down a possible 'more-vulnerable' configuration..
> ..I could not see any report even triggering a kmemleak scan on v6.14-rc5
> BUT I only tested with a fully built-in SCMI stack indeed as of now...so
> the question.
>
> > I tried again with v6.14-rc5, and I still got the leak:
>
> Ok...thanks I will investigate with different configs.
Here is the config I used:
https://gist.github.com/Darksonn/ecd31a0512f43f7e74a30ab83ff2196f
Alice
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Bug report] Memory leak in scmi_device_create
2025-03-06 11:09 ` Alice Ryhl
2025-03-06 12:50 ` Cristian Marussi
@ 2025-03-06 14:36 ` Catalin Marinas
2025-03-06 15:47 ` Cristian Marussi
1 sibling, 1 reply; 9+ messages in thread
From: Catalin Marinas @ 2025-03-06 14:36 UTC (permalink / raw)
To: Alice Ryhl
Cc: Cristian Marussi, Sudeep Holla, linux-arm-kernel, arm-scmi,
linux-kernel
On Thu, Mar 06, 2025 at 11:09:33AM +0000, Alice Ryhl wrote:
> On Wed, Mar 05, 2025 at 05:10:16PM +0000, Cristian Marussi wrote:
> > On Wed, Mar 05, 2025 at 11:59:58AM +0000, Alice Ryhl wrote:
> > > This was with a kernel running v6.13-rc3, but as far as I can tell, no
> > > relevant changes have landed since v6.13-rc3. My tree *does* include
> > > commit 295416091e44 ("firmware: arm_scmi: Fix slab-use-after-free in
> > > scmi_bus_notifier()"). I've only seen this kmemleak report once, so it's
> > > not happening consistently.
> > >
> > > See below for the full kmemleak report.
> > >
> > > Alice
> > >
> > > $ sudo cat /sys/kernel/debug/kmemleak
> > > unreferenced object 0xffffff8106c86000 (size 2048):
> > > comm "swapper/0", pid 1, jiffies 4294893094
> > > hex dump (first 32 bytes):
> > > 02 00 00 00 10 00 00 00 c0 01 bc 03 81 ff ff ff ................
> > > 60 67 ba 03 81 ff ff ff 18 60 c8 06 81 ff ff ff `g.......`......
> > > backtrace (crc feae9680):
> > > [<00000000197aa008>] kmemleak_alloc+0x34/0xa0
> > > [<0000000056fe02c9>] __kmalloc_cache_noprof+0x1e0/0x450
> > > [<00000000a8b3dfe1>] __scmi_device_create+0xb4/0x2b4
> > > [<000000008714917b>] scmi_device_create+0x40/0x194
> > > [<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
> > > [<00000000970bad38>] scmi_probe+0x584/0xa78
> > > [<000000002600d2fd>] platform_probe+0xbc/0xf0
> > > [<00000000f6f556b4>] really_probe+0x1b8/0x520
> > > [<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
> > > [<00000000d613b754>] driver_probe_device+0x6c/0x208
> > > [<00000000187a9170>] __driver_attach+0x168/0x328
> > > [<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
> > > [<00000000984a3176>] driver_attach+0x34/0x44
> > > [<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
> > > [<00000000747fce19>] driver_register+0xc0/0x1a0
> > > [<0000000081cb8754>] __platform_driver_register+0x40/0x50
> > > unreferenced object 0xffffff8103bc01c0 (size 32):
> >
> > I could not reproduce on my setup, even though I run a system with
> > all the existent SCMI protocols (and related drivers) enabled (and
> > so a lot of device creations) and a downstream test driver that causes
> > even more SCMI devices to be created/destroyed at load/unload.
> >
> > Coming down the path from scmi_chan_setup(), it seems something around
> > transport devices creation, but it is not obvious to me where the leak
> > could hide....
> >
> > ...any particular setup on your side ? ...using LKMs, loading/unloading,
> > any usage pattern that could help me reproduce ?
>
> I looked into this a bit more, and actually it does happen consistently.
> It's just that kmemleak doesn't report it until 10 minutes after
> booting, so I did not notice it.
You can force the scanning with:
echo scan > /sys/kernel/debug/kmemleak
Just do it a couple of times after boot, no need to wait 10 min for the
default background scanning.
> user@rk3588-ci:~$ sudo cat /sys/kernel/debug/kmemleak
> unreferenced object 0xffffff81068c0000 (size 2048):
> comm "swapper/0", pid 1, jiffies 4294893128
> hex dump (first 32 bytes):
> 02 00 00 00 10 00 00 00 40 a3 7a 03 81 ff ff ff ........@.z.....
> 60 c8 79 03 81 ff ff ff 18 00 8c 06 81 ff ff ff `.y.............
> backtrace (crc 60df30fb):
> kmemleak_alloc+0x34/0xa0
> __kmalloc_cache_noprof+0x1e0/0x450
> __scmi_device_create+0xb4/0x2b4
Is this the kzalloc() for sizeof(*scmi_dev)? It's surprisingly large, I
thought it would go for the kmalloc-1k slab as struct device is below
this side, at least for my builds. Anyway...
> scmi_device_create+0x40/0x194
> scmi_chan_setup+0x144/0x3b8
> scmi_probe+0x51c/0x9fc
> platform_probe+0xbc/0xf0
> really_probe+0x1b8/0x520
> __driver_probe_device+0xe0/0x1d8
> driver_probe_device+0x6c/0x208
> __driver_attach+0x168/0x328
> bus_for_each_dev+0x14c/0x178
> driver_attach+0x34/0x44
> bus_add_driver+0x1bc/0x358
> driver_register+0xc0/0x1a0
> __platform_driver_register+0x40/0x50
> unreferenced object 0xffffff81037aa340 (size 32):
> comm "swapper/0", pid 1, jiffies 4294893128
> hex dump (first 32 bytes):
> 5f 5f 73 63 6d 69 5f 74 72 61 6e 73 70 6f 72 74 __scmi_transport
> 5f 64 65 76 69 63 65 5f 72 78 5f 31 30 00 ff ff _device_rx_10...
> backtrace (crc 8dab7ca7):
> kmemleak_alloc+0x34/0xa0
> __kmalloc_node_track_caller_noprof+0x234/0x528
> kstrdup+0x48/0x80
> kstrdup_const+0x30/0x3c
These are referenced from the main structure above, so they'd be
reported as leaks as well.
This loop in scmi_device_create() looks strange:
list_for_each_entry(rdev, phead, node) {
struct scmi_device *sdev;
sdev = __scmi_device_create(np, parent,
rdev->id_table->protocol_id,
rdev->id_table->name);
/* Report errors and carry on... */
if (sdev)
scmi_dev = sdev;
else
pr_err("(%s) Failed to create device for protocol 0x%x (%s)\n",
of_node_full_name(parent->of_node),
rdev->id_table->protocol_id,
rdev->id_table->name);
}
We can override scmi_dev a few times in the loop and lose the previous
sdev allocations. Is this intended?
--
Catalin
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Bug report] Memory leak in scmi_device_create
2025-03-06 14:36 ` Catalin Marinas
@ 2025-03-06 15:47 ` Cristian Marussi
2025-03-06 16:18 ` Catalin Marinas
0 siblings, 1 reply; 9+ messages in thread
From: Cristian Marussi @ 2025-03-06 15:47 UTC (permalink / raw)
To: Catalin Marinas
Cc: Alice Ryhl, Cristian Marussi, Sudeep Holla, linux-arm-kernel,
arm-scmi, linux-kernel
On Thu, Mar 06, 2025 at 02:36:16PM +0000, Catalin Marinas wrote:
> On Thu, Mar 06, 2025 at 11:09:33AM +0000, Alice Ryhl wrote:
> > On Wed, Mar 05, 2025 at 05:10:16PM +0000, Cristian Marussi wrote:
> > > On Wed, Mar 05, 2025 at 11:59:58AM +0000, Alice Ryhl wrote:
> > > > This was with a kernel running v6.13-rc3, but as far as I can tell, no
> > > > relevant changes have landed since v6.13-rc3. My tree *does* include
> > > > commit 295416091e44 ("firmware: arm_scmi: Fix slab-use-after-free in
> > > > scmi_bus_notifier()"). I've only seen this kmemleak report once, so it's
> > > > not happening consistently.
> > > >
> > > > See below for the full kmemleak report.
> > > >
> > > > Alice
> > > >
> > > > $ sudo cat /sys/kernel/debug/kmemleak
> > > > unreferenced object 0xffffff8106c86000 (size 2048):
> > > > comm "swapper/0", pid 1, jiffies 4294893094
> > > > hex dump (first 32 bytes):
> > > > 02 00 00 00 10 00 00 00 c0 01 bc 03 81 ff ff ff ................
> > > > 60 67 ba 03 81 ff ff ff 18 60 c8 06 81 ff ff ff `g.......`......
> > > > backtrace (crc feae9680):
> > > > [<00000000197aa008>] kmemleak_alloc+0x34/0xa0
> > > > [<0000000056fe02c9>] __kmalloc_cache_noprof+0x1e0/0x450
> > > > [<00000000a8b3dfe1>] __scmi_device_create+0xb4/0x2b4
> > > > [<000000008714917b>] scmi_device_create+0x40/0x194
> > > > [<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
> > > > [<00000000970bad38>] scmi_probe+0x584/0xa78
> > > > [<000000002600d2fd>] platform_probe+0xbc/0xf0
> > > > [<00000000f6f556b4>] really_probe+0x1b8/0x520
> > > > [<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
> > > > [<00000000d613b754>] driver_probe_device+0x6c/0x208
> > > > [<00000000187a9170>] __driver_attach+0x168/0x328
> > > > [<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
> > > > [<00000000984a3176>] driver_attach+0x34/0x44
> > > > [<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
> > > > [<00000000747fce19>] driver_register+0xc0/0x1a0
> > > > [<0000000081cb8754>] __platform_driver_register+0x40/0x50
> > > > unreferenced object 0xffffff8103bc01c0 (size 32):
> > >
> > > I could not reproduce on my setup, even though I run a system with
> > > all the existent SCMI protocols (and related drivers) enabled (and
> > > so a lot of device creations) and a downstream test driver that causes
> > > even more SCMI devices to be created/destroyed at load/unload.
> > >
> > > Coming down the path from scmi_chan_setup(), it seems something around
> > > transport devices creation, but it is not obvious to me where the leak
> > > could hide....
> > >
> > > ...any particular setup on your side ? ...using LKMs, loading/unloading,
> > > any usage pattern that could help me reproduce ?
> >
> > I looked into this a bit more, and actually it does happen consistently.
> > It's just that kmemleak doesn't report it until 10 minutes after
> > booting, so I did not notice it.
>
> You can force the scanning with:
>
> echo scan > /sys/kernel/debug/kmemleak
>
> Just do it a couple of times after boot, no need to wait 10 min for the
> default background scanning.
>
> > user@rk3588-ci:~$ sudo cat /sys/kernel/debug/kmemleak
> > unreferenced object 0xffffff81068c0000 (size 2048):
> > comm "swapper/0", pid 1, jiffies 4294893128
> > hex dump (first 32 bytes):
> > 02 00 00 00 10 00 00 00 40 a3 7a 03 81 ff ff ff ........@.z.....
> > 60 c8 79 03 81 ff ff ff 18 00 8c 06 81 ff ff ff `.y.............
> > backtrace (crc 60df30fb):
> > kmemleak_alloc+0x34/0xa0
> > __kmalloc_cache_noprof+0x1e0/0x450
> > __scmi_device_create+0xb4/0x2b4
>
> Is this the kzalloc() for sizeof(*scmi_dev)? It's surprisingly large, I
> thought it would go for the kmalloc-1k slab as struct device is below
> this side, at least for my builds. Anyway...
>
> > scmi_device_create+0x40/0x194
> > scmi_chan_setup+0x144/0x3b8
> > scmi_probe+0x51c/0x9fc
> > platform_probe+0xbc/0xf0
> > really_probe+0x1b8/0x520
> > __driver_probe_device+0xe0/0x1d8
> > driver_probe_device+0x6c/0x208
> > __driver_attach+0x168/0x328
> > bus_for_each_dev+0x14c/0x178
> > driver_attach+0x34/0x44
> > bus_add_driver+0x1bc/0x358
> > driver_register+0xc0/0x1a0
> > __platform_driver_register+0x40/0x50
> > unreferenced object 0xffffff81037aa340 (size 32):
> > comm "swapper/0", pid 1, jiffies 4294893128
> > hex dump (first 32 bytes):
> > 5f 5f 73 63 6d 69 5f 74 72 61 6e 73 70 6f 72 74 __scmi_transport
> > 5f 64 65 76 69 63 65 5f 72 78 5f 31 30 00 ff ff _device_rx_10...
> > backtrace (crc 8dab7ca7):
> > kmemleak_alloc+0x34/0xa0
> > __kmalloc_node_track_caller_noprof+0x234/0x528
> > kstrdup+0x48/0x80
> > kstrdup_const+0x30/0x3c
>
> These are referenced from the main structure above, so they'd be
> reported as leaks as well.
>
> This loop in scmi_device_create() looks strange:
>
> list_for_each_entry(rdev, phead, node) {
> struct scmi_device *sdev;
>
> sdev = __scmi_device_create(np, parent,
> rdev->id_table->protocol_id,
> rdev->id_table->name);
> /* Report errors and carry on... */
> if (sdev)
> scmi_dev = sdev;
> else
> pr_err("(%s) Failed to create device for protocol 0x%x (%s)\n",
> of_node_full_name(parent->of_node),
> rdev->id_table->protocol_id,
> rdev->id_table->name);
> }
>
> We can override scmi_dev a few times in the loop and lose the previous
> sdev allocations. Is this intended?
Yes...it is weird..but by design I would say :P ...
...because this is called to instantiate one single device OR instantiate at
once all the multiple devices needed for a protocol: in this latter case it
returns just one of the created devices to signal success or NULL if all the
devices' creation failed....we dont need to keep the allocated devices references
anyway here since on success those devices are now referenced and kept on the
SCMI bus, so they can be searched/scanned/destroyed from there.
But maybe this is the crux of the matter, or what fools kmemleak...I
will try to reproduce again.
Thanks,
Cristian
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Bug report] Memory leak in scmi_device_create
2025-03-06 15:47 ` Cristian Marussi
@ 2025-03-06 16:18 ` Catalin Marinas
2025-03-06 18:43 ` Cristian Marussi
0 siblings, 1 reply; 9+ messages in thread
From: Catalin Marinas @ 2025-03-06 16:18 UTC (permalink / raw)
To: Cristian Marussi
Cc: Alice Ryhl, Sudeep Holla, linux-arm-kernel, arm-scmi,
linux-kernel
On Thu, Mar 06, 2025 at 03:47:27PM +0000, Cristian Marussi wrote:
> On Thu, Mar 06, 2025 at 02:36:16PM +0000, Catalin Marinas wrote:
> > This loop in scmi_device_create() looks strange:
> >
> > list_for_each_entry(rdev, phead, node) {
> > struct scmi_device *sdev;
> >
> > sdev = __scmi_device_create(np, parent,
> > rdev->id_table->protocol_id,
> > rdev->id_table->name);
> > /* Report errors and carry on... */
> > if (sdev)
> > scmi_dev = sdev;
> > else
> > pr_err("(%s) Failed to create device for protocol 0x%x (%s)\n",
> > of_node_full_name(parent->of_node),
> > rdev->id_table->protocol_id,
> > rdev->id_table->name);
> > }
> >
> > We can override scmi_dev a few times in the loop and lose the previous
> > sdev allocations. Is this intended?
>
> Yes...it is weird..but by design I would say :P ...
>
> ...because this is called to instantiate one single device OR instantiate at
> once all the multiple devices needed for a protocol: in this latter case it
> returns just one of the created devices to signal success or NULL if all the
> devices' creation failed....we dont need to keep the allocated devices references
> anyway here since on success those devices are now referenced and kept on the
> SCMI bus, so they can be searched/scanned/destroyed from there.
Not sure why the pointer isn't found, device_add() should link it with
the parent. Unless something else fails, the parent is freed and the
linked devices unreachable. I'm not familiar at all with this code, I
just saw kmemleak and thought of replying.
The loop is still weird, scmi_chan_setup() seems to use the pointer to
scmi_device for something more meaningful than a pass/fail check. Also
the overall result is based only on what the last __scmi_device_create()
return value was, irrespective of the previous iterations of the loop.
You do have a pr_err() but no early bailing out of the loop on failure.
I'm curious if there are any SCMI errors in the Alice's kernel log.
--
Catalin
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Bug report] Memory leak in scmi_device_create
2025-03-06 16:18 ` Catalin Marinas
@ 2025-03-06 18:43 ` Cristian Marussi
0 siblings, 0 replies; 9+ messages in thread
From: Cristian Marussi @ 2025-03-06 18:43 UTC (permalink / raw)
To: Catalin Marinas
Cc: Cristian Marussi, Alice Ryhl, Sudeep Holla, linux-arm-kernel,
arm-scmi, linux-kernel
On Thu, Mar 06, 2025 at 04:18:38PM +0000, Catalin Marinas wrote:
> On Thu, Mar 06, 2025 at 03:47:27PM +0000, Cristian Marussi wrote:
> > On Thu, Mar 06, 2025 at 02:36:16PM +0000, Catalin Marinas wrote:
> > > This loop in scmi_device_create() looks strange:
> > >
> > > list_for_each_entry(rdev, phead, node) {
> > > struct scmi_device *sdev;
> > >
> > > sdev = __scmi_device_create(np, parent,
> > > rdev->id_table->protocol_id,
> > > rdev->id_table->name);
> > > /* Report errors and carry on... */
> > > if (sdev)
> > > scmi_dev = sdev;
> > > else
> > > pr_err("(%s) Failed to create device for protocol 0x%x (%s)\n",
> > > of_node_full_name(parent->of_node),
> > > rdev->id_table->protocol_id,
> > > rdev->id_table->name);
> > > }
> > >
> > > We can override scmi_dev a few times in the loop and lose the previous
> > > sdev allocations. Is this intended?
> >
> > Yes...it is weird..but by design I would say :P ...
> >
> > ...because this is called to instantiate one single device OR instantiate at
> > once all the multiple devices needed for a protocol: in this latter case it
> > returns just one of the created devices to signal success or NULL if all the
> > devices' creation failed....we dont need to keep the allocated devices references
> > anyway here since on success those devices are now referenced and kept on the
> > SCMI bus, so they can be searched/scanned/destroyed from there.
>
> Not sure why the pointer isn't found, device_add() should link it with
> the parent. Unless something else fails, the parent is freed and the
> linked devices unreachable. I'm not familiar at all with this code, I
> just saw kmemleak and thought of replying.
>
> The loop is still weird, scmi_chan_setup() seems to use the pointer to
> scmi_device for something more meaningful than a pass/fail check. Also
> the overall result is based only on what the last __scmi_device_create()
> return value was, irrespective of the previous iterations of the loop.
> You do have a pr_err() but no early bailing out of the loop on failure.
> I'm curious if there are any SCMI errors in the Alice's kernel log.
>
Yes, the weirdness comes from the fact such function is used alternatively
to create a single named device (and make some use of it, like in
scmi_chan_setup) OR to create a bunch of devices for the same protocol
when no specific device is asked for (name==NULL)...anyway the case at
hand that kmemleak complains about does NOT pass through that weird loop...
...good news is, I was able to reproduce a similar report consistently
with a load/unload/load sequence....the culprit is that when looking for
a device to destroy on unload, the SCMI bus uses device_find_child()
and that bumps the device refcnt implicitly...as a result when the device
is destroyed the refcnt is NEVER found as zero and so NO device_release
is ever called...this results in dev->p private_data to be never released
and that is what kmemleak spotted (at the start of teh chain):
unreferenced object 0xffff00000f583800 (size 512):
comm "insmod", pid 227, jiffies 4294912190
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff 60 36 1d 8a 00 80 ff ff ........`6......
backtrace (crc 114e2eed):
kmemleak_alloc+0xbc/0xd8
__kmalloc_cache_noprof+0x2dc/0x398
device_add+0x954/0x12d0
device_register+0x28/0x40
__scmi_device_create.part.0+0x1bc/0x380
scmi_device_create+0x2d0/0x390
scmi_create_protocol_devices+0x74/0xf8
scmi_device_request_notifier+0x1f8/0x2a8
notifier_call_chain+0x110/0x3b0
blocking_notifier_call_chain+0x70/0xb0
scmi_driver_register+0x350/0x7f0
0xffff80000a3b3038
do_one_initcall+0x12c/0x730
do_init_module+0x1dc/0x640
load_module+0x4b20/0x5b70
init_module_from_file+0xec/0x158
$ ./scripts/faddr2line ./vmlinux device_add+0x954/0x12d0
device_add+0x954/0x12d0:
kmalloc_noprof at include/linux/slab.h:901
(inlined by) kzalloc_noprof at include/linux/slab.h:1037
(inlined by) device_private_init at drivers/base/core.c:3510
(inlined by) device_add at drivers/base/core.c:3561
I am posting a fix.
Thanks for the report and the help.
Any feedback and testing is much welcomed :D
Cristian
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2025-03-06 18:47 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-05 11:59 [Bug report] Memory leak in scmi_device_create Alice Ryhl
2025-03-05 17:10 ` Cristian Marussi
2025-03-06 11:09 ` Alice Ryhl
2025-03-06 12:50 ` Cristian Marussi
2025-03-06 13:25 ` Alice Ryhl
2025-03-06 14:36 ` Catalin Marinas
2025-03-06 15:47 ` Cristian Marussi
2025-03-06 16:18 ` Catalin Marinas
2025-03-06 18:43 ` Cristian Marussi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).