The patch titled Subject: kernel/relay.c: fix memleak on destroy relay channel has been added to the -mm tree. Its filename is kernel-relayc-fix-memleak-on-destroy-relay-channel.patch

This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/kernel-relayc-fix-memleak-on-destro... and later at http://ozlabs.org/~akpm/mmotm/broken-out/kernel-relayc-fix-memleak-on-destro...

Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated there every 3-4 working days

------------------------------------------------------ From: Wei Yongjun weiyongjun1@huawei.com Subject: kernel/relay.c: fix memleak on destroy relay channel

kmemleak report memory leak as follows:

unreferenced object 0x607ee4e5f948 (size 8): comm "syz-executor.1", pid 2098, jiffies 4295031601 (age 288.468s) hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace: [<00000000ca1de2fa>] relay_open kernel/relay.c:583 [inline] [<00000000ca1de2fa>] relay_open+0xb6/0x970 kernel/relay.c:563 [<0000000038ae5a4b>] do_blk_trace_setup+0x4a8/0xb20 kernel/trace/blktrace.c:557 [<00000000d5e778e9>] __blk_trace_setup+0xb6/0x150 kernel/trace/blktrace.c:597 [<0000000038fdf803>] blk_trace_ioctl+0x146/0x280 kernel/trace/blktrace.c:738 [<00000000ce25a0ca>] blkdev_ioctl+0xb2/0x6a0 block/ioctl.c:613 [<00000000579e47e0>] block_ioctl+0xe5/0x120 fs/block_dev.c:1871 [<00000000b1588c11>] vfs_ioctl fs/ioctl.c:48 [inline] [<00000000b1588c11>] __do_sys_ioctl fs/ioctl.c:753 [inline] [<00000000b1588c11>] __se_sys_ioctl fs/ioctl.c:739 [inline] [<00000000b1588c11>] __x64_sys_ioctl+0x170/0x1ce fs/ioctl.c:739 [<0000000088fc9942>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 [<000000004f6dd57a>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

'chan->buf' is malloced in relay_open() by alloc_percpu() but not free while destroy the relay channel. Fix it by adding free_percpu() before return from relay_destroy_channel().

Link: http://lkml.kernel.org/r/20200817122826.48518-1-weiyongjun1@huawei.com Fixes: 017c59c042d0 ("relay: Use per CPU constructs for the relay channel buffer pointers") Signed-off-by: Wei Yongjun weiyongjun1@huawei.com Reported-by: Hulk Robot hulkci@huawei.com Reviewed-by: Chris Wilson chris@chris-wilson.co.uk Cc: Al Viro viro@zeniv.linux.org.uk Cc: Michael Ellerman mpe@ellerman.id.au Cc: David Rientjes rientjes@google.com Cc: Michel Lespinasse walken@google.com Cc: Daniel Axtens dja@axtens.net Cc: Thomas Gleixner tglx@linutronix.de Cc: Akash Goel akash.goel@intel.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org ---

kernel/relay.c | 1 + 1 file changed, 1 insertion(+)

--- a/kernel/relay.c~kernel-relayc-fix-memleak-on-destroy-relay-channel +++ a/kernel/relay.c @@ -197,6 +197,7 @@ free_buf: static void relay_destroy_channel(struct kref *kref) { struct rchan *chan = container_of(kref, struct rchan, kref); + free_percpu(chan->buf); kfree(chan); }

_

Patches currently in -mm which might be from weiyongjun1@huawei.com are

kernel-relayc-fix-memleak-on-destroy-relay-channel.patch