[PATCH 2/2] net: Fix potential memory leak

[PATCH 2/2] net: Fix potential memory leak

[Huajun Li]

While preparing flow caches, once fail may cause potential memory leak , fix it.

Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
---
 net/core/flow.c |   19 ++++++++++++++++++-
 1 files changed, 18 insertions(+), 1 deletions(-)

diff --git a/net/core/flow.c b/net/core/flow.c
index ba3e617..2dcaa03 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -420,7 +420,7 @@ static int __init flow_cache_init(struct flow_cache *fc)

 	for_each_online_cpu(i) {
 		if (flow_cache_cpu_prepare(fc, i))
-			return -ENOMEM;
+			goto err;
 	}
 	fc->hotcpu_notifier = (struct notifier_block){
 		.notifier_call = flow_cache_cpu,
@@ -433,6 +433,23 @@ static int __init flow_cache_init(struct flow_cache *fc)
 	add_timer(&fc->rnd_timer);

 	return 0;
+err:
+	if (fc->percpu) {
+		free_percpu(fc->percpu);
+		fc->percpu = NULL;
+	}
+
+	/*
+	 * Check each possible CPUs rather than online ones because they may be
+	 * offline before the notifier is registered.
+	 */
+	for_each_possible_cpu(i) {
+		struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, i);
+		kfree(fcp->hash_table);
+		fcp->hash_table = NULL;
+	}
+
+	return -ENOMEM;
 }

 static int __init flow_cache_init_global(void)
-- 
1.7.4.1

Re: [PATCH 2/2] net: Fix potential memory leak

[Eric Dumazet]

Le samedi 24 septembre 2011 à 23:57 +0800, Huajun Li a écrit :
> While preparing flow caches, once fail may cause potential memory leak , fix it.
> 
> Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
> ---
>  net/core/flow.c |   19 ++++++++++++++++++-
>  1 files changed, 18 insertions(+), 1 deletions(-)
> 
> diff --git a/net/core/flow.c b/net/core/flow.c
> index ba3e617..2dcaa03 100644
> --- a/net/core/flow.c
> +++ b/net/core/flow.c
> @@ -420,7 +420,7 @@ static int __init flow_cache_init(struct flow_cache *fc)
> 
>  	for_each_online_cpu(i) {
>  		if (flow_cache_cpu_prepare(fc, i))
> -			return -ENOMEM;
> +			goto err;
>  	}
>  	fc->hotcpu_notifier = (struct notifier_block){
>  		.notifier_call = flow_cache_cpu,
> @@ -433,6 +433,23 @@ static int __init flow_cache_init(struct flow_cache *fc)
>  	add_timer(&fc->rnd_timer);
> 
>  	return 0;
> +err:
> +	if (fc->percpu) {
> +		free_percpu(fc->percpu);
> +		fc->percpu = NULL;
> +	}
> +
> +	/*
> +	 * Check each possible CPUs rather than online ones because they may be
> +	 * offline before the notifier is registered.
> +	 */

Please remove this comment.


> +	for_each_possible_cpu(i) {
> +		struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, i);
> +		kfree(fcp->hash_table);
> +		fcp->hash_table = NULL;
> +	}

You access fc->percpu after freeing it...

> +
> +	return -ENOMEM;
>  }
> 
>  static int __init flow_cache_init_global(void)

Previous to 2.6.37 (commit 83b6b1f5d134), a memory allocation at this
stage was panicing the box, so no worry about mem leak :)

Now I wonder if a proper patch would not print a nice message in
flow_cache_init_global() if flow_cache_init() returns an error, instead
of silently panicing or something worse...

Before submitting a new patch, could you test this case (injecting a
memalloc error in flow_cache_cpu_prepare() for example.

Re: [PATCH 2/2] net: Fix potential memory leak

[Huajun Li]

Eric, thanks for your comment.

2011/9/26 Eric Dumazet <eric.dumazet@gmail.com>:
> Le samedi 24 septembre 2011 à 23:57 +0800, Huajun Li a écrit :
>> While preparing flow caches, once fail may cause potential memory leak , fix it.
>>
>> Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
>> ---
>>  net/core/flow.c |   19 ++++++++++++++++++-
>>  1 files changed, 18 insertions(+), 1 deletions(-)
>>
>> diff --git a/net/core/flow.c b/net/core/flow.c
>> index ba3e617..2dcaa03 100644
>> --- a/net/core/flow.c
>> +++ b/net/core/flow.c
>> @@ -420,7 +420,7 @@ static int __init flow_cache_init(struct flow_cache *fc)
>>
>>       for_each_online_cpu(i) {
>>               if (flow_cache_cpu_prepare(fc, i))
>> -                     return -ENOMEM;
>> +                     goto err;
>>       }
>>       fc->hotcpu_notifier = (struct notifier_block){
>>               .notifier_call = flow_cache_cpu,
>> @@ -433,6 +433,23 @@ static int __init flow_cache_init(struct flow_cache *fc)
>>       add_timer(&fc->rnd_timer);
>>
>>       return 0;
>> +err:
>> +     if (fc->percpu) {
>> +             free_percpu(fc->percpu);
>> +             fc->percpu = NULL;
>> +     }
>> +
>> +     /*
>> +      * Check each possible CPUs rather than online ones because they may be
>> +      * offline before the notifier is registered.
>> +      */
>
> Please remove this comment.
>

Sure.

>
>> +     for_each_possible_cpu(i) {
>> +             struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, i);
>> +             kfree(fcp->hash_table);
>> +             fcp->hash_table = NULL;
>> +     }
>
> You access fc->percpu after freeing it...
>

Yes, need change the order to free memory.

>> +
>> +     return -ENOMEM;
>>  }
>>
>>  static int __init flow_cache_init_global(void)
>
> Previous to 2.6.37 (commit 83b6b1f5d134), a memory allocation at this
> stage was panicing the box, so no worry about mem leak :)
>
> Now I wonder if a proper patch would not print a nice message in
> flow_cache_init_global() if flow_cache_init() returns an error, instead
> of silently panicing or something worse...
>

There prints err msg in flow_cache_cpu_prepare(L369) if fails to
allocate memory. Do you mean it should give more detail error info,
right ?

> Before submitting a new patch, could you test this case (injecting a
> memalloc error in flow_cache_cpu_prepare() for example.
>

Will test it further if new patch comes.  ;)

Re: [PATCH 2/2] net: Fix potential memory leak

[Huajun Li]

2011/9/26 Eric Dumazet <eric.dumazet@gmail.com>:
> Le samedi 24 septembre 2011 à 23:57 +0800, Huajun Li a écrit :
>> While preparing flow caches, once fail may cause potential memory leak , fix it.
>>
>> Signed-off-by: Huajun Li <huajun.li.lee@gmail.com>
>> ---
>>  net/core/flow.c |   19 ++++++++++++++++++-
>>  1 files changed, 18 insertions(+), 1 deletions(-)
>>
>> diff --git a/net/core/flow.c b/net/core/flow.c
>> index ba3e617..2dcaa03 100644
>> --- a/net/core/flow.c
>> +++ b/net/core/flow.c
>> @@ -420,7 +420,7 @@ static int __init flow_cache_init(struct flow_cache *fc)
>>
>>       for_each_online_cpu(i) {
>>               if (flow_cache_cpu_prepare(fc, i))
>> -                     return -ENOMEM;
>> +                     goto err;
>>       }
>>       fc->hotcpu_notifier = (struct notifier_block){
>>               .notifier_call = flow_cache_cpu,
>> @@ -433,6 +433,23 @@ static int __init flow_cache_init(struct flow_cache *fc)
>>       add_timer(&fc->rnd_timer);
>>
>>       return 0;
>> +err:
>> +     if (fc->percpu) {
>> +             free_percpu(fc->percpu);
>> +             fc->percpu = NULL;
>> +     }
>> +
>> +     /*
>> +      * Check each possible CPUs rather than online ones because they may be
>> +      * offline before the notifier is registered.
>> +      */
>
> Please remove this comment.
>
>
>> +     for_each_possible_cpu(i) {
>> +             struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, i);
>> +             kfree(fcp->hash_table);
>> +             fcp->hash_table = NULL;
>> +     }
>
> You access fc->percpu after freeing it...
>
>> +
>> +     return -ENOMEM;
>>  }
>>
>>  static int __init flow_cache_init_global(void)
>
> Previous to 2.6.37 (commit 83b6b1f5d134), a memory allocation at this
> stage was panicing the box, so no worry about mem leak :)
>

To emulate memory allocation fail case, I added code to return
'-ENOMEM' from flow_cache_cpu_prepare(...) even if it could allocate
memory correctly, but did not find panic on my box, maybe the latest
code changed greatly than 2.6.37. :)

Re: [PATCH 2/2] net: Fix potential memory leak

[Eric Dumazet]

Le mardi 27 septembre 2011 à 17:58 +0800, Huajun Li a écrit :

> To emulate memory allocation fail case, I added code to return
> '-ENOMEM' from flow_cache_cpu_prepare(...) even if it could allocate
> memory correctly, but did not find panic on my box, maybe the latest
> code changed greatly than 2.6.37. :)

To panic the box, you need to leave a NULL pointer somewhere and
dereference it later, when code assumes it cant be NULL ;)