From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752457AbdHJHwj (ORCPT ); Thu, 10 Aug 2017 03:52:39 -0400 Received: from mx1.redhat.com ([209.132.183.28]:47802 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752370AbdHJHwi (ORCPT ); Thu, 10 Aug 2017 03:52:38 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 115D02DA9BB Authentication-Results: ext-mx05.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx05.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=shuwang@redhat.com From: shuwang@redhat.com To: mingo@redhat.com, peterz@infradead.org Cc: linux-kernel@vger.kernel.org, chuhu@redhat.com, liwang@redhat.com, Shu Wang Subject: [PATCH 1/1] sched/topology: fix memleak in __sdt_alloc() Date: Thu, 10 Aug 2017 15:52:16 +0800 Message-Id: <1502351536-9108-1-git-send-email-shuwang@redhat.com> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.29]); Thu, 10 Aug 2017 07:52:38 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Shu Wang Found this issue by kmemleak. the sg and sgc from __sdt_alloc() might be leaked as each domain holds many groups' ref. And in destroy_sched_domain(), it only declined the first group ref. Online and offline a cpu can trigger this leak, and cause OOM. reproducer for my 6 cpus machine: while true do echo 0 > /sys/devices/system/cpu/cpu5/online; echo 1 > /sys/devices/system/cpu/cpu5/online; done unreferenced object 0xffff88007d772a80 (size 64): comm "cpuhp/5", pid 39, jiffies 4294719962 (age 35.251s) hex dump (first 32 bytes): c0 22 77 7d 00 88 ff ff 02 00 00 00 01 00 00 00 ."w}............ 40 2a 77 7d 00 88 ff ff 00 00 00 00 00 00 00 00 @*w}............ backtrace: [] kmemleak_alloc+0x4a/0xa0 [] __kmalloc_node+0xf1/0x280 [] build_sched_domains+0x1e8/0xf20 [] partition_sched_domains+0x304/0x360 [] cpuset_update_active_cpus+0x17/0x40 [] sched_cpu_activate+0xae/0xc0 [] cpuhp_invoke_callback+0x90/0x400 [] cpuhp_up_callbacks+0x37/0xb0 [] cpuhp_thread_fun+0xd7/0xf0 [] smpboot_thread_fn+0x110/0x160 [] kthread+0x109/0x140 [] ret_from_fork+0x25/0x30 [] 0xffffffffffffffff unreferenced object 0xffff88007d772a40 (size 64): comm "cpuhp/5", pid 39, jiffies 4294719962 (age 35.251s) hex dump (first 32 bytes): 03 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 ................ 00 04 00 00 00 00 00 00 4f 3c fc ff 00 00 00 00 ........O<...... backtrace: [] kmemleak_alloc+0x4a/0xa0 [] __kmalloc_node+0xf1/0x280 [] build_sched_domains+0xead/0xf20 [] partition_sched_domains+0x304/0x360 [] cpuset_update_active_cpus+0x17/0x40 [] sched_cpu_activate+0xae/0xc0 [] cpuhp_invoke_callback+0x90/0x400 [] cpuhp_up_callbacks+0x37/0xb0 [] cpuhp_thread_fun+0xd7/0xf0 [] smpboot_thread_fn+0x110/0x160 [] kthread+0x109/0x140 [] ret_from_fork+0x25/0x30 [] 0xffffffffffffffff Reported-by: Chunyu Hu Signed-off-by: Chunyu Hu Signed-off-by: Shu Wang --- kernel/sched/topology.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 79895ae..35c3c4d 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -337,7 +337,8 @@ static void free_sched_groups(struct sched_group *sg, int free_sgc) if (free_sgc && atomic_dec_and_test(&sg->sgc->ref)) kfree(sg->sgc); - kfree(sg); + if (atomic_dec_and_test(&sg->ref)) + kfree(sg); sg = tmp; } while (sg != first); } @@ -345,15 +346,11 @@ static void free_sched_groups(struct sched_group *sg, int free_sgc) static void destroy_sched_domain(struct sched_domain *sd) { /* - * If its an overlapping domain it has private groups, iterate and - * nuke them all. + * A sched domain has many groups' reference, and an overlapping + * domain has private groups, iterate and nuck them all. */ - if (sd->flags & SD_OVERLAP) { - free_sched_groups(sd->groups, 1); - } else if (atomic_dec_and_test(&sd->groups->ref)) { - kfree(sd->groups->sgc); - kfree(sd->groups); - } + free_sched_groups(sd->groups, 1); + if (sd->shared && atomic_dec_and_test(&sd->shared->ref)) kfree(sd->shared); kfree(sd); @@ -670,6 +667,7 @@ build_group_from_child_sched_domain(struct sched_domain *sd, int cpu) else cpumask_copy(sg_span, sched_domain_span(sd)); + atomic_inc(&sg->ref); return sg; } -- 2.5.0