From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f42.google.com (mail-wm0-f42.google.com [74.125.82.42]) by kanga.kvack.org (Postfix) with ESMTP id 303046B0038 for ; Tue, 1 Dec 2015 09:05:19 -0500 (EST) Received: by wmec201 with SMTP id c201so206920882wme.0 for ; Tue, 01 Dec 2015 06:05:18 -0800 (PST) Received: from mail-wm0-x22b.google.com (mail-wm0-x22b.google.com. [2a00:1450:400c:c09::22b]) by mx.google.com with ESMTPS id g2si73993951wjw.4.2015.12.01.06.05.17 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 01 Dec 2015 06:05:17 -0800 (PST) Received: by wmvv187 with SMTP id v187so208283448wmv.1 for ; Tue, 01 Dec 2015 06:05:17 -0800 (PST) MIME-Version: 1.0 From: Dmitry Vyukov Date: Tue, 1 Dec 2015 15:04:57 +0100 Message-ID: Subject: memory leak in alloc_huge_page Content-Type: text/plain; charset=UTF-8 Sender: owner-linux-mm@kvack.org List-ID: To: Andrew Morton , Naoya Horiguchi , Mike Kravetz , Hillf Danton , David Rientjes , "Kirill A. Shutemov" , Dave Hansen , "linux-mm@kvack.org" , LKML , Hugh Dickins , Greg Thelen Cc: syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin , Eric Dumazet Hello, The following program leaks memory: // autogenerated by syzkaller (http://github.com/google/syzkaller) #include #include #include #define SYS_mlock2 325 int main() { syscall(SYS_mmap, 0x20000000ul, 0x1000ul, 0x3ul, 0x45031ul, 0xfffffffffffffffful, 0x0ul); syscall(SYS_mlock2, 0x20000000ul, 0x1000ul, 0x1ul, 0, 0, 0); return 0; } unreferenced object 0xffff88002eaafd88 (size 32): comm "a.out", pid 5063, jiffies 4295774645 (age 15.810s) hex dump (first 32 bytes): 28 e9 4e 63 00 88 ff ff 28 e9 4e 63 00 88 ff ff (.Nc....(.Nc.... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [< inline >] kmalloc include/linux/slab.h:458 [] region_chg+0x2d4/0x6b0 mm/hugetlb.c:398 [] __vma_reservation_common+0x2c3/0x390 mm/hugetlb.c:1791 [< inline >] vma_needs_reservation mm/hugetlb.c:1813 [] alloc_huge_page+0x19e/0xc70 mm/hugetlb.c:1845 [< inline >] hugetlb_no_page mm/hugetlb.c:3543 [] hugetlb_fault+0x7a1/0x1250 mm/hugetlb.c:3717 [] follow_hugetlb_page+0x339/0xc70 mm/hugetlb.c:3880 [] __get_user_pages+0x542/0xf30 mm/gup.c:497 [] populate_vma_page_range+0xde/0x110 mm/gup.c:919 [] __mm_populate+0x1c7/0x310 mm/gup.c:969 [] do_mlock+0x291/0x360 mm/mlock.c:637 [< inline >] SYSC_mlock2 mm/mlock.c:658 [] SyS_mlock2+0x4b/0x70 mm/mlock.c:648 If this program run in a loop number of objects in kmalloc-32 slab indeed grows infinitely. On commit 31ade3b83e1821da5fbb2f11b5b3d4ab2ec39db8 (Nov 29). There seems to be another leak if nrg is not NULL on this path, but it's not what happens in my case since the WARNING does not fire. Still something to fix: diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 827bb02..e97a31b 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -372,8 +372,10 @@ retry_locked: spin_unlock(&resv->lock); trg = kmalloc(sizeof(*trg), GFP_KERNEL); - if (!trg) + if (!trg) { + WARN_ON(nrg != NULL); return -ENOMEM; + } spin_lock(&resv->lock); list_add(&trg->link, &resv->region_cache); Thanks -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org