Re: Memory leak issues in drm

[Jaswinder Singh Rajput <jaswinder@kernel.org>]

On Thu, 2009-07-16 at 10:37 +0530, Jaswinder Singh Rajput wrote:
> On linus tree, while investigating kmemleak issues in drm :
> 
> unreferenced object 0xf571dea0 (size 32):
>   comm "Xorg", pid 1992, jiffies 4294703188
>   backtrace:
>     [<c1096655>] create_object+0x140/0x210
>     [<c10967f2>] kmemleak_alloc+0x25/0x4b
>     [<c1093b63>] __kmalloc+0xcb/0x153
>     [<c11ae939>] drm_setversion+0x154/0x1f6
>     [<c11ad0b1>] drm_ioctl+0x211/0x296
>     [<c10a2dc9>] vfs_ioctl+0x50/0x69
>     [<c10a3321>] do_vfs_ioctl+0x49b/0x4d5
>     [<c10a3387>] sys_ioctl+0x2c/0x45
>     [<c1002988>] sysenter_do_call+0x12/0x36
>     [<ffffffff>] 0xffffffff
> 

This fixes above memory leak in drm because it was allocating again on
dev->devname without freeing previous instance and more memory related
issues, hope this will be helpful:

diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index 9b9ff46..b39ab86 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -96,25 +96,36 @@ int drm_setunique(struct drm_device *dev, void *data,
 	master->unique = kmalloc(master->unique_size, GFP_KERNEL);
 	if (!master->unique)
 		return -ENOMEM;
-	if (copy_from_user(master->unique, u->unique, master->unique_len))
+	if (copy_from_user(master->unique, u->unique, master->unique_len)) {
+		kfree(master->unique);
+		master->unique_len = 0;
 		return -EFAULT;
+	}
 
 	master->unique[master->unique_len] = '\0';
 
+	/* Free previous dev->devname, if exists */
+	if (dev->devname)
+		kfree(dev->devname);
 	dev->devname = kmalloc(strlen(dev->driver->pci_driver.name) +
 			       strlen(master->unique) + 2, GFP_KERNEL);
-	if (!dev->devname)
+	if (!dev->devname) {
+		kfree(master->unique);
+		master->unique_len = 0;
 		return -ENOMEM;
+	}
 
 	sprintf(dev->devname, "%s@%s", dev->driver->pci_driver.name,
 		master->unique);
 
-	/* Return error if the busid submitted doesn't match the device's actual
+	/*
+	 * Return error if the busid submitted doesn't match the device's actual
 	 * busid.
 	 */
 	ret = sscanf(master->unique, "PCI:%d:%d:%d", &bus, &slot, &func);
 	if (ret != 3)
-		return -EINVAL;
+		goto error;
+
 	domain = bus >> 8;
 	bus &= 0xff;
 
@@ -122,9 +133,15 @@ int drm_setunique(struct drm_device *dev, void *data,
 	    (bus != dev->pdev->bus->number) ||
 	    (slot != PCI_SLOT(dev->pdev->devfn)) ||
 	    (func != PCI_FUNC(dev->pdev->devfn)))
-		return -EINVAL;
+		goto error;
 
 	return 0;
+
+error:
+	kfree(dev->devname);
+	kfree(master->unique);
+
+	return -EINVAL;
 }
 
 static int drm_set_busid(struct drm_device *dev, struct drm_file *file_priv)
@@ -136,25 +153,35 @@ static int drm_set_busid(struct drm_device *dev, struct drm_file *file_priv)
 		return -EBUSY;
 
 	master->unique_len = 40;
-	master->unique_size = master->unique_len;
+	master->unique_size = master->unique_len + 1;
 	master->unique = kmalloc(master->unique_size, GFP_KERNEL);
 	if (master->unique == NULL)
 		return -ENOMEM;
 
-	len = snprintf(master->unique, master->unique_len, "pci:%04x:%02x:%02x.%d",
+	/*
+	 * Using sprintf as it will return number of characters
+	 * (not including the trailing '\0')
+	 */
+	len = sprintf(master->unique, "pci:%04x:%02x:%02x.%d",
 		       drm_get_pci_domain(dev),
 		       dev->pdev->bus->number,
 		       PCI_SLOT(dev->pdev->devfn),
 		       PCI_FUNC(dev->pdev->devfn));
-	if (len >= master->unique_len)
+	if (len > master->unique_len)
 		DRM_ERROR("buffer overflow");
 	else
 		master->unique_len = len;
 
+	/* Free previous dev->devname, if exists */
+	if (dev->devname)
+		kfree(dev->devname);
 	dev->devname = kmalloc(strlen(dev->driver->pci_driver.name) +
 			       master->unique_len + 2, GFP_KERNEL);
-	if (dev->devname == NULL)
+	if (dev->devname == NULL) {
+		kfree(master->unique);
+		master->unique_len = 0;
 		return -ENOMEM;
+	}
 
 	sprintf(dev->devname, "%s@%s", dev->driver->pci_driver.name,
 		master->unique);