Skip to contentSkip to conversation

kprobe: fix a memory leak in function pre_handler_kretprobe()

PATCH In review Jiang Liu 3 participants 3 messages Jan 6, 2012 – Jan 9, 2012 kprobes

lore
Share & tools
lore

Jiang Liu

author
#0 lore raw

PATCH 1/1 kprobe: fix a memory leak in function pre_handler_kretprobe()

From: Jiang Liu<[email protected]>

In function pre_handler_kretprobe(), the allocated kretprobe_instance object will be leaked if the entry_handler callback returns non-zero. This may cause all the preallocated kretprobe_instance objects exhausted. This issue could be reproduced by changing samples/kprobes/kretprobe_example.c to probe "mutex_unlock". And the fix is straight forward, just put the allocated kretprobe_instance object back onto the free_instances list.

Cc Hien Nguyen<[email protected]>
Cc Jim Keniston<[email protected]>
Cc Prasanna S Panchamukhi<[email protected]>
---
 kprobes.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/kprobes.c +5 -1
@@ -1660,8 +1660,12 @@
                ri->rp = rp;
                ri->task = current;
 
-               if (rp->entry_handler&&  rp->entry_handler(ri, regs))
+               if (rp->entry_handler&&  rp->entry_handler(ri, regs)) {
+                       spin_lock_irqsave(&rp->lock, flags);
+                       hlist_add_head(&ri->hlist,&rp->free_instances);
+                       spin_unlock_irqrestore(&rp->lock, flags);
                        return 0;
+               }
 
                arch_prepare_kretprobe(ri, regs);
 
Acked-by on v1 1/1
#1 lore raw
Quoted 9 lines · Jiang Liu

From: Jiang Liu<[email protected]>

In function pre_handler_kretprobe(), the allocated kretprobe_instance object will be leaked if the entry_handler callback returns non-zero. This may cause all the preallocated kretprobe_instance objects exhausted. This issue could be reproduced by changing samples/kprobes/kretprobe_example.c to probe "mutex_unlock". And the fix is straight forward, just put the allocated kretprobe_instance object back onto the free_instances list.

Quoted 4 lines
Cc Hien Nguyen<[email protected]>
Cc Jim Keniston<[email protected]>
Cc Prasanna S Panchamukhi<[email protected]>

BTW, Prasanna is no longer at IBM, and Hien's address is [email protected] . Ananth (cc-ed) is probably IBM's best kprobes reviewer.

Quoted 22 lines
---
  kprobes.c |    6 +++++-
  1 file changed, 5 insertions(+), 1 deletion(-)
kernel/kprobes.c +5 -1
@@ -1660,8 +1660,12 @@
                 ri->rp = rp;
                 ri->task = current;
 
-               if (rp->entry_handler&&  rp->entry_handler(ri, regs))
+               if (rp->entry_handler&&  rp->entry_handler(ri, regs)) {
+                       spin_lock_irqsave(&rp->lock, flags);
+                       hlist_add_head(&ri->hlist,&rp->free_instances);
+                       spin_unlock_irqrestore(&rp->lock, flags);
                         return 0;
+               }
 
                 arch_prepare_kretprobe(ri, regs);
 
Acked-by on v1 1/1
#2 lore raw
In reply to Jiang Liu
Quoted 9 lines · Jiang Liu

From: Jiang Liu<[email protected]>

In function pre_handler_kretprobe(), the allocated kretprobe_instance object will be leaked if the entry_handler callback returns non-zero. This may cause all the preallocated kretprobe_instance objects exhausted. This issue could be reproduced by changing samples/kprobes/kretprobe_example.c to probe "mutex_unlock". And the fix is straight forward, just put the allocated kretprobe_instance object back onto the free_instances list.

Quoted 4 lines
Cc Hien Nguyen<[email protected]>
Cc Jim Keniston<[email protected]>
Cc Prasanna S Panchamukhi<[email protected]>

Thanks for the patch.

Quoted 8 lines
---
 kprobes.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

kernel/kprobes.c line 1668

Quoted 10 lines
kernel/kprobes.c +5 -1
@@ -1660,8 +1660,12 @@
                ri->rp = rp;
                ri->task = current;
 
-               if (rp->entry_handler&&  rp->entry_handler(ri, regs))
+               if (rp->entry_handler&&  rp->entry_handler(ri, regs)) {
+                       spin_lock_irqsave(&rp->lock, flags);
+                       hlist_add_head(&ri->hlist,&rp->free_instances);
+                       spin_unlock_irqrestore(&rp->lock, flags);
                        return 0;
+               }

Please fix up coding style issues and resend with acks from Jim and me. Please also cc [email protected] so this gets included in the earlier kernels too.

Ananth