[PATCH 2/2] net: Fix potential memory leak

While preparing flow caches, once fail may cause potential memory leak , fix it.

Signed-off-by: Huajun Li <redacted>
---
 net/core/flow.c |   19 ++++++++++++++++++-
 1 files changed, 18 insertions(+), 1 deletions(-)

diff --git a/net/core/flow.c b/net/core/flow.c
index ba3e617..2dcaa03 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c

@@ -420,7 +420,7 @@ static int __init flow_cache_init(struct flow_cache *fc)

 	for_each_online_cpu(i) {
 		if (flow_cache_cpu_prepare(fc, i))
-			return -ENOMEM;
+			goto err;
 	}
 	fc->hotcpu_notifier = (struct notifier_block){
 		.notifier_call = flow_cache_cpu,

@@ -433,6 +433,23 @@ static int __init flow_cache_init(struct flow_cache *fc)
 	add_timer(&fc->rnd_timer);

 	return 0;
+err:
+	if (fc->percpu) {
+		free_percpu(fc->percpu);
+		fc->percpu = NULL;
+	}
+
+	/*
+	 * Check each possible CPUs rather than online ones because they may be
+	 * offline before the notifier is registered.
+	 */
+	for_each_possible_cpu(i) {
+		struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, i);
+		kfree(fcp->hash_table);
+		fcp->hash_table = NULL;
+	}
+
+	return -ENOMEM;
 }

 static int __init flow_cache_init_global(void)

-- 
1.7.4.1

Le samedi 24 septembre 2011 à 23:57 +0800, Huajun Li a écrit :

Please remove this comment.

You access fc->percpu after freeing it...

Previous to 2.6.37 (commit 83b6b1f5d134), a memory allocation at this
stage was panicing the box, so no worry about mem leak :)

Now I wonder if a proper patch would not print a nice message in
flow_cache_init_global() if flow_cache_init() returns an error, instead
of silently panicing or something worse...

Before submitting a new patch, could you test this case (injecting a
memalloc error in flow_cache_cpu_prepare() for example.

Eric, thanks for your comment.

2011/9/26 Eric Dumazet [off-list ref]:

Le samedi 24 septembre 2011 à 23:57 +0800, Huajun Li a écrit :

quoted

While preparing flow caches, once fail may cause potential memory leak , fix it.

Signed-off-by: Huajun Li <redacted>
---
 net/core/flow.c |   19 ++++++++++++++++++-
 1 files changed, 18 insertions(+), 1 deletions(-)

diff --git a/net/core/flow.c b/net/core/flow.c
index ba3e617..2dcaa03 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c

@@ -420,7 +420,7 @@ static int __init flow_cache_init(struct flow_cache *fc)

      for_each_online_cpu(i) {
              if (flow_cache_cpu_prepare(fc, i))
-                     return -ENOMEM;
+                     goto err;
      }
      fc->hotcpu_notifier = (struct notifier_block){
              .notifier_call = flow_cache_cpu,

@@ -433,6 +433,23 @@ static int __init flow_cache_init(struct flow_cache *fc)

      add_timer(&fc->rnd_timer);

      return 0;
+err:
+     if (fc->percpu) {
+             free_percpu(fc->percpu);
+             fc->percpu = NULL;
+     }
+
+     /*
+      * Check each possible CPUs rather than online ones because they may be
+      * offline before the notifier is registered.
+      */

Please remove this comment.

Sure.

quoted

+     for_each_possible_cpu(i) {
+             struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, i);
+             kfree(fcp->hash_table);
+             fcp->hash_table = NULL;
+     }

You access fc->percpu after freeing it...

Yes, need change the order to free memory.

quoted

+
+     return -ENOMEM;
 }

 static int __init flow_cache_init_global(void)

Previous to 2.6.37 (commit 83b6b1f5d134), a memory allocation at this
stage was panicing the box, so no worry about mem leak :)

Now I wonder if a proper patch would not print a nice message in
flow_cache_init_global() if flow_cache_init() returns an error, instead
of silently panicing or something worse...

There prints err msg in flow_cache_cpu_prepare(L369) if fails to
allocate memory. Do you mean it should give more detail error info,
right ?

Before submitting a new patch, could you test this case (injecting a
memalloc error in flow_cache_cpu_prepare() for example.

Will test it further if new patch comes.  ;)

2011/9/26 Eric Dumazet [off-list ref]:

Le samedi 24 septembre 2011 à 23:57 +0800, Huajun Li a écrit :

quoted

While preparing flow caches, once fail may cause potential memory leak , fix it.

Signed-off-by: Huajun Li <redacted>
---
 net/core/flow.c |   19 ++++++++++++++++++-
 1 files changed, 18 insertions(+), 1 deletions(-)

diff --git a/net/core/flow.c b/net/core/flow.c
index ba3e617..2dcaa03 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c

@@ -420,7 +420,7 @@ static int __init flow_cache_init(struct flow_cache *fc)

      for_each_online_cpu(i) {
              if (flow_cache_cpu_prepare(fc, i))
-                     return -ENOMEM;
+                     goto err;
      }
      fc->hotcpu_notifier = (struct notifier_block){
              .notifier_call = flow_cache_cpu,

@@ -433,6 +433,23 @@ static int __init flow_cache_init(struct flow_cache *fc)

      add_timer(&fc->rnd_timer);

      return 0;
+err:
+     if (fc->percpu) {
+             free_percpu(fc->percpu);
+             fc->percpu = NULL;
+     }
+
+     /*
+      * Check each possible CPUs rather than online ones because they may be
+      * offline before the notifier is registered.
+      */

Please remove this comment.

quoted

+     for_each_possible_cpu(i) {
+             struct flow_cache_percpu *fcp = per_cpu_ptr(fc->percpu, i);
+             kfree(fcp->hash_table);
+             fcp->hash_table = NULL;
+     }

You access fc->percpu after freeing it...

quoted

+
+     return -ENOMEM;
 }

 static int __init flow_cache_init_global(void)

Previous to 2.6.37 (commit 83b6b1f5d134), a memory allocation at this
stage was panicing the box, so no worry about mem leak :)

To emulate memory allocation fail case, I added code to return
'-ENOMEM' from flow_cache_cpu_prepare(...) even if it could allocate
memory correctly, but did not find panic on my box, maybe the latest
code changed greatly than 2.6.37. :)

Le mardi 27 septembre 2011 à 17:58 +0800, Huajun Li a écrit :

To emulate memory allocation fail case, I added code to return
'-ENOMEM' from flow_cache_cpu_prepare(...) even if it could allocate
memory correctly, but did not find panic on my box, maybe the latest
code changed greatly than 2.6.37. :)

To panic the box, you need to leave a NULL pointer somewhere and
dereference it later, when code assumes it cant be NULL ;)