From patchwork Tue Oct 27 13:51:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 289829 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D603C5517A for ; Tue, 27 Oct 2020 15:07:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3FAA920720 for ; Tue, 27 Oct 2020 15:07:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603811272; bh=pgU48Lf+PiMP7v6usSDcWLCT0cPhAWdBgvnWQMGxPRw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=odb7isNPZelX8oNkS+OhgXBvFiGpNAaZOJ2CJBH0AFBZCY5RtTudGGAuzZfF4RitW u1TI8nRVW7VB9iL6dqGjBsPmNytRX7a68ImHjivTep/XMJ0BvKvR/P+L2Ya5vrp1ag g/Df2q3RYVZlBD04WLNa/iqD6r5yIlAEneoUnMA8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1793692AbgJ0PHu (ORCPT ); Tue, 27 Oct 2020 11:07:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:39958 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1790981AbgJ0PFd (ORCPT ); Tue, 27 Oct 2020 11:05:33 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DBE7721707; Tue, 27 Oct 2020 15:05:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603811132; bh=pgU48Lf+PiMP7v6usSDcWLCT0cPhAWdBgvnWQMGxPRw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JnapbPAA0eDoHdrO+/pmSwdxLtDUEjTeXyh38+9tVN13dS3s+M+4WcLHgABC1LEBP n/SuJQ9dLuWwQC9XwBgbDVd58OOqmDygoqpws9S/6XEHd5H4gGoLkoatjpPBe2qKzJ B/llDadHeosprXUD/EFEGSWmHr1uk12M1HjtrXHs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, coverity-bot , Kees Cook , "Matthew Wilcox (Oracle)" , Sasha Levin Subject: [PATCH 5.8 344/633] ida: Free allocated bitmap in error path Date: Tue, 27 Oct 2020 14:51:27 +0100 Message-Id: <20201027135538.823685818@linuxfoundation.org> X-Mailer: git-send-email 2.29.1 In-Reply-To: <20201027135522.655719020@linuxfoundation.org> References: <20201027135522.655719020@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Matthew Wilcox (Oracle) [ Upstream commit a219b856a2b993da234108307be772448f22b0ce ] If a bitmap needs to be allocated, and then by the time the thread is scheduled to be run again all the indices which would satisfy the allocation have been allocated then we would leak the allocation. Almost impossible to hit in practice, but a trivial fix. Found by Coverity. Fixes: f32f004cddf8 ("ida: Convert to XArray") Reported-by: coverity-bot Reviewed-by: Kees Cook Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Sasha Levin --- lib/idr.c | 1 + tools/testing/radix-tree/idr-test.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/lib/idr.c b/lib/idr.c index c2cf2c52bbde5..4d2eef0259d2c 100644 --- a/lib/idr.c +++ b/lib/idr.c @@ -470,6 +470,7 @@ int ida_alloc_range(struct ida *ida, unsigned int min, unsigned int max, goto retry; nospc: xas_unlock_irqrestore(&xas, flags); + kfree(alloc); return -ENOSPC; } EXPORT_SYMBOL(ida_alloc_range); diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c index 8995092d541ec..3b796dd5e5772 100644 --- a/tools/testing/radix-tree/idr-test.c +++ b/tools/testing/radix-tree/idr-test.c @@ -523,8 +523,27 @@ static void *ida_random_fn(void *arg) return NULL; } +static void *ida_leak_fn(void *arg) +{ + struct ida *ida = arg; + time_t s = time(NULL); + int i, ret; + + rcu_register_thread(); + + do for (i = 0; i < 1000; i++) { + ret = ida_alloc_range(ida, 128, 128, GFP_KERNEL); + if (ret >= 0) + ida_free(ida, 128); + } while (time(NULL) < s + 2); + + rcu_unregister_thread(); + return NULL; +} + void ida_thread_tests(void) { + DEFINE_IDA(ida); pthread_t threads[20]; int i; @@ -536,6 +555,16 @@ void ida_thread_tests(void) while (i--) pthread_join(threads[i], NULL); + + for (i = 0; i < ARRAY_SIZE(threads); i++) + if (pthread_create(&threads[i], NULL, ida_leak_fn, &ida)) { + perror("creating ida thread"); + exit(1); + } + + while (i--) + pthread_join(threads[i], NULL); + assert(ida_is_empty(&ida)); } void ida_tests(void)