The patch titled
Subject: mm/kmemleak.c: wait for scan completion before disabling free
has been added to the -mm tree. Its filename is
mm-kmemleak-wait-for-scan-completion-before-disabling-free.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/mm-kmemleak-wait-for-scan-completion-before-disabling-free.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/mm-kmemleak-wait-for-scan-completion-before-disabling-free.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Vinayak Menon <vinmenon@xxxxxxxxxxxxxx>
Subject: mm/kmemleak.c: wait for scan completion before disabling free
A crash is observed when kmemleak_scan accesses the object->pointer,
likely due to the following race.
TASK A TASK B TASK C
kmemleak_write
(with "scan" and
NOT "scan=on")
kmemleak_scan()
create_object
kmem_cache_alloc fails
kmemleak_disable
kmemleak_do_cleanup
kmemleak_free_enabled = 0
kfree
kmemleak_free bails out
(kmemleak_free_enabled is 0)
slub frees object->pointer
update_checksum
crash - object->pointer
freed (DEBUG_PAGEALLOC)
kmemleak_do_cleanup() waits for the scan thread to complete, but not for
direct call to kmemleak_scan() via kmemleak_write(). So add a wait for
kmemleak_scan() completion before disabling kmemleak_free.
Link: http://lkml.kernel.org/r/1522063429-18992-1-git-send-email-vinmenon@xxxxxxxxxxxxxx
Signed-off-by: Vinayak Menon <vinmenon@xxxxxxxxxxxxxx>
Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/kmemleak.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff -puN mm/kmemleak.c~mm-kmemleak-wait-for-scan-completion-before-disabling-free mm/kmemleak.c
--- a/mm/kmemleak.c~mm-kmemleak-wait-for-scan-completion-before-disabling-free
+++ a/mm/kmemleak.c
@@ -1921,12 +1921,15 @@ static void kmemleak_do_cleanup(struct w
{
stop_scan_thread();
+ mutex_lock(&scan_mutex);
/*
- * Once the scan thread has stopped, it is safe to no longer track
- * object freeing. Ordering of the scan thread stopping and the memory
- * accesses below is guaranteed by the kthread_stop() function.
+ * Once it is made sure that kmemleak_scan has stopped, it is safe to no
+ * longer track object freeing. Ordering of the scan thread stopping and
+ * the memory accesses below is guaranteed by the kthread_stop()
+ * function.
*/
kmemleak_free_enabled = 0;
+ mutex_unlock(&scan_mutex);
if (!kmemleak_found_leaks)
__kmemleak_do_cleanup();
_
Patches currently in -mm which might be from vinmenon@xxxxxxxxxxxxxx are
mm-kmemleak-wait-for-scan-completion-before-disabling-free.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
