[PATCH v2 1/1] pidfs: Fix memory leak in pidfd_info()

[PATCH v2 1/1] pidfs: Fix memory leak in pidfd_info()

[Adrian Huang (Lenovo)]

After running the program 'ioctl_pidfd03' of Linux Test Project (LTP) or
the program 'pidfd_info_test' in 'tools/testing/selftests/pidfd' of the
kernel source, kmemleak reports the following memory leaks:

  # cat /sys/kernel/debug/kmemleak
  unreferenced object 0xff110020e5988000 (size 8216):
    comm "ioctl_pidfd03", pid 10853, jiffies 4294800031
    hex dump (first 32 bytes):
      02 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00  .@..............
      00 00 00 00 af 01 00 00 80 00 00 00 00 00 00 00  ................
    backtrace (crc 69483047):
      kmem_cache_alloc_node_noprof+0x2fb/0x410
      copy_process+0x178/0x1740
      kernel_clone+0x99/0x3b0
      __do_sys_clone3+0xbe/0x100
      do_syscall_64+0x7b/0x2c0
      entry_SYSCALL_64_after_hwframe+0x76/0x7e
  ...
  unreferenced object 0xff11002097b70000 (size 8216):
  comm "pidfd_info_test", pid 11840, jiffies 4294889165
  hex dump (first 32 bytes):
    06 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00  .@..............
    00 00 00 00 b5 00 00 00 80 00 00 00 00 00 00 00  ................
  backtrace (crc a6286bb7):
    kmem_cache_alloc_node_noprof+0x2fb/0x410
    copy_process+0x178/0x1740
    kernel_clone+0x99/0x3b0
    __do_sys_clone3+0xbe/0x100
    do_syscall_64+0x7b/0x2c0
    entry_SYSCALL_64_after_hwframe+0x76/0x7e
  ...

The leak occurs because pidfd_info() obtains a task_struct via
get_pid_task() but never calls put_task_struct() to drop the reference,
leaving task->usage unbalanced.

Fix the issue by adding '__free(put_task) = NULL' to the local variable
'task', ensuring that put_task_struct() is automatically invoked when
the variable goes out of scope.

Fixes: 7477d7dce48a ("pidfs: allow to retrieve exit information")
Signed-off-by: Adrian Huang (Lenovo) <adrianhuang0701@gmail.com>
---
Changes in v2: Assign NULL to the local variable 'task'

---
 fs/pidfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/pidfs.c b/fs/pidfs.c
index edc35522d75c..108e7527f837 100644
--- a/fs/pidfs.c
+++ b/fs/pidfs.c
@@ -296,12 +296,12 @@ static __u32 pidfs_coredump_mask(unsigned long mm_flags)
 static long pidfd_info(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	struct pidfd_info __user *uinfo = (struct pidfd_info __user *)arg;
+	struct task_struct *task __free(put_task) = NULL;
 	struct pid *pid = pidfd_pid(file);
 	size_t usize = _IOC_SIZE(cmd);
 	struct pidfd_info kinfo = {};
 	struct pidfs_exit_info *exit_info;
 	struct user_namespace *user_ns;
-	struct task_struct *task;
 	struct pidfs_attr *attr;
 	const struct cred *c;
 	__u64 mask;
-- 
2.34.1

Re: [PATCH v2 1/1] pidfs: Fix memory leak in pidfd_info()

[Christian Brauner]

On Thu, 14 Aug 2025 17:44:53 +0800, Adrian Huang (Lenovo) wrote:
> After running the program 'ioctl_pidfd03' of Linux Test Project (LTP) or
> the program 'pidfd_info_test' in 'tools/testing/selftests/pidfd' of the
> kernel source, kmemleak reports the following memory leaks:
> 
>   # cat /sys/kernel/debug/kmemleak
>   unreferenced object 0xff110020e5988000 (size 8216):
>     comm "ioctl_pidfd03", pid 10853, jiffies 4294800031
>     hex dump (first 32 bytes):
>       02 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00  .@..............
>       00 00 00 00 af 01 00 00 80 00 00 00 00 00 00 00  ................
>     backtrace (crc 69483047):
>       kmem_cache_alloc_node_noprof+0x2fb/0x410
>       copy_process+0x178/0x1740
>       kernel_clone+0x99/0x3b0
>       __do_sys_clone3+0xbe/0x100
>       do_syscall_64+0x7b/0x2c0
>       entry_SYSCALL_64_after_hwframe+0x76/0x7e
>   ...
>   unreferenced object 0xff11002097b70000 (size 8216):
>   comm "pidfd_info_test", pid 11840, jiffies 4294889165
>   hex dump (first 32 bytes):
>     06 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00  .@..............
>     00 00 00 00 b5 00 00 00 80 00 00 00 00 00 00 00  ................
>   backtrace (crc a6286bb7):
>     kmem_cache_alloc_node_noprof+0x2fb/0x410
>     copy_process+0x178/0x1740
>     kernel_clone+0x99/0x3b0
>     __do_sys_clone3+0xbe/0x100
>     do_syscall_64+0x7b/0x2c0
>     entry_SYSCALL_64_after_hwframe+0x76/0x7e
>   ...
> 
> [...]

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] pidfs: Fix memory leak in pidfd_info()
      https://git.kernel.org/vfs/vfs/c/0b2d71a7c826