Skip to contentSkip to conversation

mm/hmm: Fix struct hmm memory leak

PATCH In review [email protected] 2 participants 2 messages Feb 15, 2019 – Feb 16, 2019

Subsystems (2)
Memory management HMM - Heterogeneous Memory Management
lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 mm/hmm: Fix struct hmm memory leak

From: Ralph Campbell <[email protected]>

The patch [1] introduced reference counting on struct hmm and works fine when calling hmm_mirror_register() and hmm_mirror_unregister(). However, when a process exits without explicitly unregistering, the MMU notifier callback hmm_release() doesn't release the mirror->hmm reference and thus leaks the struct hmm allocation.
Fix this by releasing the reference in hmm_release().

[1] https://marc.info/?l=linux-mm&m=154878089214597&w=2
("mm/hmm: use reference counting for HMM struct")

Signed-off-by Ralph Campbell <[email protected]>
Cc Andrew Morton <[email protected]>
Cc "Jérôme Glisse" <[email protected]>
Cc John Hubbard <[email protected]>
---
 mm/hmm.c | 2 ++
 1 file changed, 2 insertions(+)
mm/hmm.c +2 -0
index 3c9781037918..50523df6ea0c 100644
@@ -179,6 +179,8 @@ static void hmm_release(struct mmu_notifier *mn, struct mm_struct *mm)
 			mirror->ops->release(mirror);
 			down_write(&hmm->mirrors_sem);
 		}
+		hmm_put(mirror->hmm);
+		mirror->hmm = NULL;
 		mirror = list_first_entry_or_null(&hmm->mirrors,
 						  struct hmm_mirror, list);
 	}
Signature · 1 line
2.17.2
#1 lore raw
Quoted 11 lines · On Fri, Feb 15, 2019 at 01:59:22PM -0800, [email protected] wrote:

From: Ralph Campbell <[email protected]>

The patch [1] introduced reference counting on struct hmm and works fine when calling hmm_mirror_register() and hmm_mirror_unregister(). However, when a process exits without explicitly unregistering, the MMU notifier callback hmm_release() doesn't release the mirror->hmm reference and thus leaks the struct hmm allocation.
Fix this by releasing the reference in hmm_release().

[1] https://marc.info/?l=linux-mm&m=154878089214597&w=2
("mm/hmm: use reference counting for HMM struct")

NAK we do not want to free stuff from underneath the driver that was the whole point of the refcounting. Instead for driver that want to free their mirror from the release call back can call the hmm_mirror_unregister() function safely. Sorry if that was not clear.

Quoted 25 lines
Signed-off-by Ralph Campbell <[email protected]>
Cc Andrew Morton <[email protected]>
Cc "Jérôme Glisse" <[email protected]>
Cc John Hubbard <[email protected]>
---
 mm/hmm.c | 2 ++
 1 file changed, 2 insertions(+)
mm/hmm.c +2 -0
index 3c9781037918..50523df6ea0c 100644
@@ -179,6 +179,8 @@ static void hmm_release(struct mmu_notifier *mn, struct mm_struct *mm)
 			mirror->ops->release(mirror);
 			down_write(&hmm->mirrors_sem);
 		}
+		hmm_put(mirror->hmm);
+		mirror->hmm = NULL;
 		mirror = list_first_entry_or_null(&hmm->mirrors,
 						  struct hmm_mirror, list);
 	}
Signature · 1 line
2.17.2