* [PATCH 1/1] sched/topology: fix memleak in __sdt_alloc()
@ 2017-08-10 7:52 shuwang
2017-08-10 15:51 ` Peter Zijlstra
2017-08-25 11:57 ` [tip:sched/core] sched/topology: Fix memory leak " tip-bot for Shu Wang
0 siblings, 2 replies; 3+ messages in thread
From: shuwang @ 2017-08-10 7:52 UTC (permalink / raw)
To: mingo, peterz; +Cc: linux-kernel, chuhu, liwang, Shu Wang
From: Shu Wang <shuwang@redhat.com>
Found this issue by kmemleak. the sg and sgc from __sdt_alloc()
might be leaked as each domain holds many groups' ref. And in
destroy_sched_domain(), it only declined the first group ref.
Online and offline a cpu can trigger this leak, and cause OOM.
reproducer for my 6 cpus machine:
while true
do
echo 0 > /sys/devices/system/cpu/cpu5/online;
echo 1 > /sys/devices/system/cpu/cpu5/online;
done
unreferenced object 0xffff88007d772a80 (size 64):
comm "cpuhp/5", pid 39, jiffies 4294719962 (age 35.251s)
hex dump (first 32 bytes):
c0 22 77 7d 00 88 ff ff 02 00 00 00 01 00 00 00 ."w}............
40 2a 77 7d 00 88 ff ff 00 00 00 00 00 00 00 00 @*w}............
backtrace:
[<ffffffff8176525a>] kmemleak_alloc+0x4a/0xa0
[<ffffffff8121efe1>] __kmalloc_node+0xf1/0x280
[<ffffffff810d94a8>] build_sched_domains+0x1e8/0xf20
[<ffffffff810da674>] partition_sched_domains+0x304/0x360
[<ffffffff81139557>] cpuset_update_active_cpus+0x17/0x40
[<ffffffff810bdb2e>] sched_cpu_activate+0xae/0xc0
[<ffffffff810900e0>] cpuhp_invoke_callback+0x90/0x400
[<ffffffff81090597>] cpuhp_up_callbacks+0x37/0xb0
[<ffffffff81090887>] cpuhp_thread_fun+0xd7/0xf0
[<ffffffff810b37e0>] smpboot_thread_fn+0x110/0x160
[<ffffffff810af5d9>] kthread+0x109/0x140
[<ffffffff81770e45>] ret_from_fork+0x25/0x30
[<ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffff88007d772a40 (size 64):
comm "cpuhp/5", pid 39, jiffies 4294719962 (age 35.251s)
hex dump (first 32 bytes):
03 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 ................
00 04 00 00 00 00 00 00 4f 3c fc ff 00 00 00 00 ........O<......
backtrace:
[<ffffffff8176525a>] kmemleak_alloc+0x4a/0xa0
[<ffffffff8121efe1>] __kmalloc_node+0xf1/0x280
[<ffffffff810da16d>] build_sched_domains+0xead/0xf20
[<ffffffff810da674>] partition_sched_domains+0x304/0x360
[<ffffffff81139557>] cpuset_update_active_cpus+0x17/0x40
[<ffffffff810bdb2e>] sched_cpu_activate+0xae/0xc0
[<ffffffff810900e0>] cpuhp_invoke_callback+0x90/0x400
[<ffffffff81090597>] cpuhp_up_callbacks+0x37/0xb0
[<ffffffff81090887>] cpuhp_thread_fun+0xd7/0xf0
[<ffffffff810b37e0>] smpboot_thread_fn+0x110/0x160
[<ffffffff810af5d9>] kthread+0x109/0x140
[<ffffffff81770e45>] ret_from_fork+0x25/0x30
[<ffffffffffffffff>] 0xffffffffffffffff
Reported-by: Chunyu Hu <chuhu@redhat.com>
Signed-off-by: Chunyu Hu <chuhu@redhat.com>
Signed-off-by: Shu Wang <shuwang@redhat.com>
---
kernel/sched/topology.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 79895ae..35c3c4d 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -337,7 +337,8 @@ static void free_sched_groups(struct sched_group *sg, int free_sgc)
if (free_sgc && atomic_dec_and_test(&sg->sgc->ref))
kfree(sg->sgc);
- kfree(sg);
+ if (atomic_dec_and_test(&sg->ref))
+ kfree(sg);
sg = tmp;
} while (sg != first);
}
@@ -345,15 +346,11 @@ static void free_sched_groups(struct sched_group *sg, int free_sgc)
static void destroy_sched_domain(struct sched_domain *sd)
{
/*
- * If its an overlapping domain it has private groups, iterate and
- * nuke them all.
+ * A sched domain has many groups' reference, and an overlapping
+ * domain has private groups, iterate and nuck them all.
*/
- if (sd->flags & SD_OVERLAP) {
- free_sched_groups(sd->groups, 1);
- } else if (atomic_dec_and_test(&sd->groups->ref)) {
- kfree(sd->groups->sgc);
- kfree(sd->groups);
- }
+ free_sched_groups(sd->groups, 1);
+
if (sd->shared && atomic_dec_and_test(&sd->shared->ref))
kfree(sd->shared);
kfree(sd);
@@ -670,6 +667,7 @@ build_group_from_child_sched_domain(struct sched_domain *sd, int cpu)
else
cpumask_copy(sg_span, sched_domain_span(sd));
+ atomic_inc(&sg->ref);
return sg;
}
--
2.5.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH 1/1] sched/topology: fix memleak in __sdt_alloc()
2017-08-10 7:52 [PATCH 1/1] sched/topology: fix memleak in __sdt_alloc() shuwang
@ 2017-08-10 15:51 ` Peter Zijlstra
2017-08-25 11:57 ` [tip:sched/core] sched/topology: Fix memory leak " tip-bot for Shu Wang
1 sibling, 0 replies; 3+ messages in thread
From: Peter Zijlstra @ 2017-08-10 15:51 UTC (permalink / raw)
To: shuwang; +Cc: mingo, linux-kernel, chuhu, liwang
On Thu, Aug 10, 2017 at 03:52:16PM +0800, shuwang@redhat.com wrote:
> From: Shu Wang <shuwang@redhat.com>
>
> Found this issue by kmemleak. the sg and sgc from __sdt_alloc()
> might be leaked as each domain holds many groups' ref. And in
> destroy_sched_domain(), it only declined the first group ref.
>
> Online and offline a cpu can trigger this leak, and cause OOM.
> reproducer for my 6 cpus machine:
> while true
> do
> echo 0 > /sys/devices/system/cpu/cpu5/online;
> echo 1 > /sys/devices/system/cpu/cpu5/online;
> done
>
> unreferenced object 0xffff88007d772a80 (size 64):
> comm "cpuhp/5", pid 39, jiffies 4294719962 (age 35.251s)
> hex dump (first 32 bytes):
> c0 22 77 7d 00 88 ff ff 02 00 00 00 01 00 00 00 ."w}............
> 40 2a 77 7d 00 88 ff ff 00 00 00 00 00 00 00 00 @*w}............
> backtrace:
> [<ffffffff8176525a>] kmemleak_alloc+0x4a/0xa0
> [<ffffffff8121efe1>] __kmalloc_node+0xf1/0x280
> [<ffffffff810d94a8>] build_sched_domains+0x1e8/0xf20
> [<ffffffff810da674>] partition_sched_domains+0x304/0x360
> [<ffffffff81139557>] cpuset_update_active_cpus+0x17/0x40
> [<ffffffff810bdb2e>] sched_cpu_activate+0xae/0xc0
> [<ffffffff810900e0>] cpuhp_invoke_callback+0x90/0x400
> [<ffffffff81090597>] cpuhp_up_callbacks+0x37/0xb0
> [<ffffffff81090887>] cpuhp_thread_fun+0xd7/0xf0
> [<ffffffff810b37e0>] smpboot_thread_fn+0x110/0x160
> [<ffffffff810af5d9>] kthread+0x109/0x140
> [<ffffffff81770e45>] ret_from_fork+0x25/0x30
> [<ffffffffffffffff>] 0xffffffffffffffff
> unreferenced object 0xffff88007d772a40 (size 64):
> comm "cpuhp/5", pid 39, jiffies 4294719962 (age 35.251s)
> hex dump (first 32 bytes):
> 03 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 ................
> 00 04 00 00 00 00 00 00 4f 3c fc ff 00 00 00 00 ........O<......
> backtrace:
> [<ffffffff8176525a>] kmemleak_alloc+0x4a/0xa0
> [<ffffffff8121efe1>] __kmalloc_node+0xf1/0x280
> [<ffffffff810da16d>] build_sched_domains+0xead/0xf20
> [<ffffffff810da674>] partition_sched_domains+0x304/0x360
> [<ffffffff81139557>] cpuset_update_active_cpus+0x17/0x40
> [<ffffffff810bdb2e>] sched_cpu_activate+0xae/0xc0
> [<ffffffff810900e0>] cpuhp_invoke_callback+0x90/0x400
> [<ffffffff81090597>] cpuhp_up_callbacks+0x37/0xb0
> [<ffffffff81090887>] cpuhp_thread_fun+0xd7/0xf0
> [<ffffffff810b37e0>] smpboot_thread_fn+0x110/0x160
> [<ffffffff810af5d9>] kthread+0x109/0x140
> [<ffffffff81770e45>] ret_from_fork+0x25/0x30
> [<ffffffffffffffff>] 0xffffffffffffffff
>
> Reported-by: Chunyu Hu <chuhu@redhat.com>
> Signed-off-by: Chunyu Hu <chuhu@redhat.com>
> Signed-off-by: Shu Wang <shuwang@redhat.com>
Thanks!
^ permalink raw reply [flat|nested] 3+ messages in thread
* [tip:sched/core] sched/topology: Fix memory leak in __sdt_alloc()
2017-08-10 7:52 [PATCH 1/1] sched/topology: fix memleak in __sdt_alloc() shuwang
2017-08-10 15:51 ` Peter Zijlstra
@ 2017-08-25 11:57 ` tip-bot for Shu Wang
1 sibling, 0 replies; 3+ messages in thread
From: tip-bot for Shu Wang @ 2017-08-25 11:57 UTC (permalink / raw)
To: linux-tip-commits
Cc: tglx, chuhu, shuwang, hpa, peterz, torvalds, mingo, linux-kernel
Commit-ID: 213c5a459ae0a7ef0a092f576aae2d5db6819360
Gitweb: http://git.kernel.org/tip/213c5a459ae0a7ef0a092f576aae2d5db6819360
Author: Shu Wang <shuwang@redhat.com>
AuthorDate: Thu, 10 Aug 2017 15:52:16 +0800
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Fri, 25 Aug 2017 11:12:19 +0200
sched/topology: Fix memory leak in __sdt_alloc()
Found this issue by kmemleak: the 'sg' and 'sgc' pointers from
__sdt_alloc() might be leaked as each domain holds many groups' ref,
but in destroy_sched_domain(), it only declined the first group ref.
Onlining and offlining a CPU can trigger this leak, and cause OOM.
Reproducer for my 6 CPUs machine:
while true
do
echo 0 > /sys/devices/system/cpu/cpu5/online;
echo 1 > /sys/devices/system/cpu/cpu5/online;
done
unreferenced object 0xffff88007d772a80 (size 64):
comm "cpuhp/5", pid 39, jiffies 4294719962 (age 35.251s)
hex dump (first 32 bytes):
c0 22 77 7d 00 88 ff ff 02 00 00 00 01 00 00 00 ."w}............
40 2a 77 7d 00 88 ff ff 00 00 00 00 00 00 00 00 @*w}............
backtrace:
[<ffffffff8176525a>] kmemleak_alloc+0x4a/0xa0
[<ffffffff8121efe1>] __kmalloc_node+0xf1/0x280
[<ffffffff810d94a8>] build_sched_domains+0x1e8/0xf20
[<ffffffff810da674>] partition_sched_domains+0x304/0x360
[<ffffffff81139557>] cpuset_update_active_cpus+0x17/0x40
[<ffffffff810bdb2e>] sched_cpu_activate+0xae/0xc0
[<ffffffff810900e0>] cpuhp_invoke_callback+0x90/0x400
[<ffffffff81090597>] cpuhp_up_callbacks+0x37/0xb0
[<ffffffff81090887>] cpuhp_thread_fun+0xd7/0xf0
[<ffffffff810b37e0>] smpboot_thread_fn+0x110/0x160
[<ffffffff810af5d9>] kthread+0x109/0x140
[<ffffffff81770e45>] ret_from_fork+0x25/0x30
[<ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffff88007d772a40 (size 64):
comm "cpuhp/5", pid 39, jiffies 4294719962 (age 35.251s)
hex dump (first 32 bytes):
03 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 ................
00 04 00 00 00 00 00 00 4f 3c fc ff 00 00 00 00 ........O<......
backtrace:
[<ffffffff8176525a>] kmemleak_alloc+0x4a/0xa0
[<ffffffff8121efe1>] __kmalloc_node+0xf1/0x280
[<ffffffff810da16d>] build_sched_domains+0xead/0xf20
[<ffffffff810da674>] partition_sched_domains+0x304/0x360
[<ffffffff81139557>] cpuset_update_active_cpus+0x17/0x40
[<ffffffff810bdb2e>] sched_cpu_activate+0xae/0xc0
[<ffffffff810900e0>] cpuhp_invoke_callback+0x90/0x400
[<ffffffff81090597>] cpuhp_up_callbacks+0x37/0xb0
[<ffffffff81090887>] cpuhp_thread_fun+0xd7/0xf0
[<ffffffff810b37e0>] smpboot_thread_fn+0x110/0x160
[<ffffffff810af5d9>] kthread+0x109/0x140
[<ffffffff81770e45>] ret_from_fork+0x25/0x30
[<ffffffffffffffff>] 0xffffffffffffffff
Reported-by: Chunyu Hu <chuhu@redhat.com>
Signed-off-by: Shu Wang <shuwang@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Chunyu Hu <chuhu@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: liwang@redhat.com
Link: http://lkml.kernel.org/r/1502351536-9108-1-git-send-email-shuwang@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
kernel/sched/topology.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index bd8b6d6..4197f13 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -335,7 +335,8 @@ static void free_sched_groups(struct sched_group *sg, int free_sgc)
if (free_sgc && atomic_dec_and_test(&sg->sgc->ref))
kfree(sg->sgc);
- kfree(sg);
+ if (atomic_dec_and_test(&sg->ref))
+ kfree(sg);
sg = tmp;
} while (sg != first);
}
@@ -343,15 +344,11 @@ static void free_sched_groups(struct sched_group *sg, int free_sgc)
static void destroy_sched_domain(struct sched_domain *sd)
{
/*
- * If its an overlapping domain it has private groups, iterate and
- * nuke them all.
+ * A sched domain has many groups' reference, and an overlapping
+ * domain has private groups, iterate and nuke them all.
*/
- if (sd->flags & SD_OVERLAP) {
- free_sched_groups(sd->groups, 1);
- } else if (atomic_dec_and_test(&sd->groups->ref)) {
- kfree(sd->groups->sgc);
- kfree(sd->groups);
- }
+ free_sched_groups(sd->groups, 1);
+
if (sd->shared && atomic_dec_and_test(&sd->shared->ref))
kfree(sd->shared);
kfree(sd);
@@ -668,6 +665,7 @@ build_group_from_child_sched_domain(struct sched_domain *sd, int cpu)
else
cpumask_copy(sg_span, sched_domain_span(sd));
+ atomic_inc(&sg->ref);
return sg;
}
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-08-25 12:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-08-10 7:52 [PATCH 1/1] sched/topology: fix memleak in __sdt_alloc() shuwang
2017-08-10 15:51 ` Peter Zijlstra
2017-08-25 11:57 ` [tip:sched/core] sched/topology: Fix memory leak " tip-bot for Shu Wang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome