mm/kmemleak.c: wait for scan completion before disabling free
[ Upstream commit 914b6dfff7
]
A crash is observed when kmemleak_scan accesses the object->pointer,
likely due to the following race.
TASK A TASK B TASK C
kmemleak_write
(with "scan" and
NOT "scan=on")
kmemleak_scan()
create_object
kmem_cache_alloc fails
kmemleak_disable
kmemleak_do_cleanup
kmemleak_free_enabled = 0
kfree
kmemleak_free bails out
(kmemleak_free_enabled is 0)
slub frees object->pointer
update_checksum
crash - object->pointer
freed (DEBUG_PAGEALLOC)
kmemleak_do_cleanup waits for the scan thread to complete, but not for
direct call to kmemleak_scan via kmemleak_write. So add a wait for
kmemleak_scan completion before disabling kmemleak_free, and while at it
fix the comment on stop_scan_thread.
[vinmenon@codeaurora.org: fix stop_scan_thread comment]
Link: http://lkml.kernel.org/r/1522219972-22809-1-git-send-email-vinmenon@codeaurora.org
Link: http://lkml.kernel.org/r/1522063429-18992-1-git-send-email-vinmenon@codeaurora.org
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
pull/10/head
parent
08e9dbd518
commit
28bbb0d963
|
@ -1658,8 +1658,7 @@ static void start_scan_thread(void)
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Stop the automatic memory scanning thread. This function must be called
|
* Stop the automatic memory scanning thread.
|
||||||
* with the scan_mutex held.
|
|
||||||
*/
|
*/
|
||||||
static void stop_scan_thread(void)
|
static void stop_scan_thread(void)
|
||||||
{
|
{
|
||||||
|
@ -1922,12 +1921,15 @@ static void kmemleak_do_cleanup(struct work_struct *work)
|
||||||
{
|
{
|
||||||
stop_scan_thread();
|
stop_scan_thread();
|
||||||
|
|
||||||
|
mutex_lock(&scan_mutex);
|
||||||
/*
|
/*
|
||||||
* Once the scan thread has stopped, it is safe to no longer track
|
* Once it is made sure that kmemleak_scan has stopped, it is safe to no
|
||||||
* object freeing. Ordering of the scan thread stopping and the memory
|
* longer track object freeing. Ordering of the scan thread stopping and
|
||||||
* accesses below is guaranteed by the kthread_stop() function.
|
* the memory accesses below is guaranteed by the kthread_stop()
|
||||||
|
* function.
|
||||||
*/
|
*/
|
||||||
kmemleak_free_enabled = 0;
|
kmemleak_free_enabled = 0;
|
||||||
|
mutex_unlock(&scan_mutex);
|
||||||
|
|
||||||
if (!kmemleak_found_leaks)
|
if (!kmemleak_found_leaks)
|
||||||
__kmemleak_do_cleanup();
|
__kmemleak_do_cleanup();
|
||||||
|
|
Loading…
Reference in New Issue