[PATCH] kprobe: fix a memory leak in function pre_handler_kretprobe()

[PATCH] kprobe: fix a memory leak in function pre_handler_kretprobe()

[Jiang Liu]

From: Jiang Liu<liuj97@gmail.com>

In function pre_handler_kretprobe(), the allocated kretprobe_instance object will
be leaked if the entry_handler callback returns non-zero. This may cause all the
preallocated kretprobe_instance objects exhausted. This issue could be reproduced
by changing samples/kprobes/kretprobe_example.c to probe "mutex_unlock". And the
fix is straight forward, just put the allocated kretprobe_instance object back
onto the free_instances list.

Signed-off-by: Jiang Liu<liuj97@gmail.com>
Cc: Hien Nguyen<hien@us.ibm.com>
Cc: Jim Keniston<jkenisto@us.ibm.com>
Cc: Prasanna S Panchamukhi<prasanna@in.ibm.com>
---
  kprobes.c |    6 +++++-
  1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1660,8 +1660,12 @@
                 ri->rp = rp;
                 ri->task = current;

-               if (rp->entry_handler&&  rp->entry_handler(ri, regs))
+               if (rp->entry_handler&&  rp->entry_handler(ri, regs)) {
+                       spin_lock_irqsave(&rp->lock, flags);
+                       hlist_add_head(&ri->hlist,&rp->free_instances);
+                       spin_unlock_irqrestore(&rp->lock, flags);
                         return 0;
+               }

                 arch_prepare_kretprobe(ri, regs);

Re: [PATCH] kprobe: fix a memory leak in function pre_handler_kretprobe()

[Jim Keniston]

On Sat, 2012-01-07 at 00:49 +0800, Jiang Liu wrote:
> From: Jiang Liu<liuj97@gmail.com>
> 
> In function pre_handler_kretprobe(), the allocated kretprobe_instance object will
> be leaked if the entry_handler callback returns non-zero. This may cause all the
> preallocated kretprobe_instance objects exhausted. This issue could be reproduced
> by changing samples/kprobes/kretprobe_example.c to probe "mutex_unlock". And the
> fix is straight forward, just put the allocated kretprobe_instance object back
> onto the free_instances list.
> 
> Signed-off-by: Jiang Liu<liuj97@gmail.com>
> Cc: Hien Nguyen<hien@us.ibm.com>
> Cc: Jim Keniston<jkenisto@us.ibm.com>
> Cc: Prasanna S Panchamukhi<prasanna@in.ibm.com>

Acked-by: Jim Keniston <jkenisto@us.ibm.com>

BTW, Prasanna is no longer at IBM, and Hien's address is
hienqngu@us.ibm.com .  Ananth (cc-ed) is probably IBM's best kprobes
reviewer.

> ---
>   kprobes.c |    6 +++++-
>   1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -1660,8 +1660,12 @@
>                  ri->rp = rp;
>                  ri->task = current;
> 
> -               if (rp->entry_handler&&  rp->entry_handler(ri, regs))
> +               if (rp->entry_handler&&  rp->entry_handler(ri, regs)) {
> +                       spin_lock_irqsave(&rp->lock, flags);
> +                       hlist_add_head(&ri->hlist,&rp->free_instances);
> +                       spin_unlock_irqrestore(&rp->lock, flags);
>                          return 0;
> +               }
> 
>                  arch_prepare_kretprobe(ri, regs);
> 
> 

Re: [PATCH] kprobe: fix a memory leak in function pre_handler_kretprobe()

[Ananth N Mavinakayanahalli]

On Sat, Jan 07, 2012 at 12:49:30AM +0800, Jiang Liu wrote:
> From: Jiang Liu<liuj97@gmail.com>
>
> In function pre_handler_kretprobe(), the allocated kretprobe_instance object will
> be leaked if the entry_handler callback returns non-zero. This may cause all the
> preallocated kretprobe_instance objects exhausted. This issue could be reproduced
> by changing samples/kprobes/kretprobe_example.c to probe "mutex_unlock". And the
> fix is straight forward, just put the allocated kretprobe_instance object back
> onto the free_instances list.
>
> Signed-off-by: Jiang Liu<liuj97@gmail.com>
> Cc: Hien Nguyen<hien@us.ibm.com>
> Cc: Jim Keniston<jkenisto@us.ibm.com>
> Cc: Prasanna S Panchamukhi<prasanna@in.ibm.com>

Thanks for the patch.

Acked-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com>

> ---
>  kprobes.c |    6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -1660,8 +1660,12 @@
>                 ri->rp = rp;
>                 ri->task = current;
>
> -               if (rp->entry_handler&&  rp->entry_handler(ri, regs))
> +               if (rp->entry_handler&&  rp->entry_handler(ri, regs)) {
> +                       spin_lock_irqsave(&rp->lock, flags);
> +                       hlist_add_head(&ri->hlist,&rp->free_instances);
> +                       spin_unlock_irqrestore(&rp->lock, flags);
>                         return 0;
> +               }

Please fix up coding style issues and resend with acks from Jim and me.
Please also cc stable@kernel.org so this gets included in the earlier
kernels too.

Ananth