Re: [PATCH 1/1] bridge: mdb: report complete_info ptr as not a kmemleak

[Eduardo Valentin]

On Wed, Jul 05, 2017 at 09:05:14AM -0700, Eduardo Valentin wrote:
> On Tue, Jul 04, 2017 at 01:48:42AM -0700, David Miller wrote:
> > From: Eduardo Valentin 
> > Date: Mon, 3 Jul 2017 10:06:34 -0700
> > 
> > > We currently get the following kmemleak report:
> >  ...
> > > This patch flags the complete_info ptr object as not a leak as it will
> > > get freed when .complete_priv() is called,
> > 
> > We don't call .complete_priv().  We call .complete().
> 
> True, I can fix this wording in the commit next version.
> 
> > 
> >  for the br mdb case, it
> > > will be freed at br_mdb_complete().
> > > 
> > > Cc: stable  # v4.9+
> > > Reviewed-by: Vallish Vaidyeshwara 
> > > Signed-off-by: Eduardo Valentin 
> > 
> > I don't understand why kmemleak cannot see this.
> > 
> > We store the pointer globally when we do the switchdev_port_obv_add()
> > call and it should be able to see that.
> 
> I see and agree. But even then I get these reports consistently on RTM_NEWMDB 
> type.
> This is why I am proposing marking as a non-kmemleak.
> 
> To me, this is only a leak if .complete() never gets called.

Ok. So, in fact, I believe the problem I am seeing in more when 
switchdev_port_obj_add() fails.

I will send a patch for that.

> 
> 
> -- 
> All the best,
> Eduardo Valentin

-- 
All the best,
Eduardo Valentin

Re: [PATCH 1/1] bridge: mdb: report complete_info ptr as not a kmemleak

[Eduardo Valentin]

On Tue, Jul 04, 2017 at 01:48:42AM -0700, David Miller wrote:
> From: Eduardo Valentin 
> Date: Mon, 3 Jul 2017 10:06:34 -0700
> 
> > We currently get the following kmemleak report:
>  ...
> > This patch flags the complete_info ptr object as not a leak as it will
> > get freed when .complete_priv() is called,
> 
> We don't call .complete_priv().  We call .complete().

True, I can fix this wording in the commit next version.

> 
>  for the br mdb case, it
> > will be freed at br_mdb_complete().
> > 
> > Cc: stable  # v4.9+
> > Reviewed-by: Vallish Vaidyeshwara 
> > Signed-off-by: Eduardo Valentin 
> 
> I don't understand why kmemleak cannot see this.
> 
> We store the pointer globally when we do the switchdev_port_obv_add()
> call and it should be able to see that.

I see and agree. But even then I get these reports consistently on RTM_NEWMDB 
type.
This is why I am proposing marking as a non-kmemleak.

To me, this is only a leak if .complete() never gets called.


-- 
All the best,
Eduardo Valentin

Re: [PATCH 1/1] bridge: mdb: report complete_info ptr as not a kmemleak

[David Miller]

From: Eduardo Valentin 
Date: Mon, 3 Jul 2017 10:06:34 -0700

> We currently get the following kmemleak report:
 ...
> This patch flags the complete_info ptr object as not a leak as it will
> get freed when .complete_priv() is called,

We don't call .complete_priv().  We call .complete().

 for the br mdb case, it
> will be freed at br_mdb_complete().
> 
> Cc: stable  # v4.9+
> Reviewed-by: Vallish Vaidyeshwara 
> Signed-off-by: Eduardo Valentin 

I don't understand why kmemleak cannot see this.

We store the pointer globally when we do the switchdev_port_obv_add()
call and it should be able to see that.

[PATCH 1/1] bridge: mdb: report complete_info ptr as not a kmemleak

[Eduardo Valentin]

We currently get the following kmemleak report:
unreferenced object 0x8800039d9820 (size 32):
  comm "softirq", pid 0, jiffies 4295212383 (age 792.416s)
  hex dump (first 32 bytes):
00 0c e0 03 00 88 ff ff ff 02 00 00 00 00 00 00  
00 00 00 01 ff 11 00 02 86 dd 00 00 ff ff ff ff  
  backtrace:
[] kmemleak_alloc+0x4a/0xa0
[] kmem_cache_alloc_trace+0xb8/0x1c0
[] __br_mdb_notify+0x2a3/0x300 [bridge]
[] br_mdb_notify+0x6e/0x70 [bridge]
[] br_multicast_add_group+0x109/0x150 [bridge]
[] br_ip6_multicast_add_group+0x58/0x60 [bridge]
[] br_multicast_rcv+0x1d5/0xdb0 [bridge]
[] br_handle_frame_finish+0xcf/0x510 [bridge]
[] br_nf_hook_thresh.part.27+0xb/0x10 [br_netfilter]
[] br_nf_hook_thresh+0x48/0xb0 [br_netfilter]
[] br_nf_pre_routing_finish_ipv6+0x109/0x1d0 
[br_netfilter]
[] br_nf_pre_routing_ipv6+0xd0/0x14c [br_netfilter]
[] br_nf_pre_routing+0x197/0x3d0 [br_netfilter]
[] nf_iterate+0x52/0x60
[] nf_hook_slow+0x5c/0xb0
[] br_handle_frame+0x1a4/0x2c0 [bridge]

This patch flags the complete_info ptr object as not a leak as it will
get freed when .complete_priv() is called, for the br mdb case, it
will be freed at br_mdb_complete().

Cc: stable  # v4.9+
Reviewed-by: Vallish Vaidyeshwara 
Signed-off-by: Eduardo Valentin 
---
 net/bridge/br_mdb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c
index b084548..1c81546 100644
--- a/net/bridge/br_mdb.c
+++ b/net/bridge/br_mdb.c
@@ -5,6 +5,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -319,6 +320,8 @@ static void __br_mdb_notify(struct net_device *dev, struct 
net_bridge_port *p,
if (port_dev && type == RTM_NEWMDB) {
complete_info = kmalloc(sizeof(*complete_info), GFP_ATOMIC);
if (complete_info) {
+   /* This pointer is freed in br_mdb_complete() */
+   kmemleak_not_leak(complete_info);
complete_info->port = p;
__mdb_entry_to_br_ip(entry, _info->ip);
mdb.obj.complete_priv = complete_info;
-- 
2.7.4