Messages in this thread Patch in this message | | | From | "Tu, Xiaobing" <> | Subject | RE: Fix memory leak in binder | Date | Mon, 15 Oct 2012 07:03:32 +0000 |
| |
-----Original Message----- From: Tu, Xiaobing Sent: Monday, October 15, 2012 3:03 PM To: 'ccross@android.com'; 'davej@redhat.com'; 'akpm@linux-foundation.org'; 'mingo@elte.hu'; 'rusty@rustcorp.com.au'; 'a.p.zijlstra@chello.nl'; 'linux-kernel@vger.kernel.org'; 'rostedt@goodmis.org' Cc: Zhang, Di; Ma, Xindong Subject: Fix memory leak in binder
After enabling kmemleak and run monkey, following memleak is reported: unreferenced object 0xeed27f80 (size 64): comm "Binder_8", pid 641, jiffies 4294946341 (age 2275.810s) hex dump (first 32 bytes): 4f dd 00 00 84 7f d2 ee 84 7f d2 ee 01 00 00 00 O............... 00 00 00 00 00 00 00 00 00 aa 4c d7 00 00 00 00 ..........L..... backtrace: [<c184fabc>] kmemleak_alloc+0x3c/0xa0 [<c12f391e>] kmem_cache_alloc_trace+0x9e/0x180 [<c1668bb5>] binder_thread_write+0xcf5/0x23a0 [<c166b091>] binder_ioctl+0x1f1/0x530 [<c130dcf6>] do_vfs_ioctl+0x86/0x5e0 [<c130e282>] sys_ioctl+0x32/0x60 [<c1872e01>] syscall_call+0x7/0xb [<ffffffff>] 0xffffffff
The work item in async_todo list is not freed when binder released. Also the async transaction should also be freed in binder_release_work.
Signed-off-by: Leon Ma <xindong.ma@intel.com> Signed-off-by: Di Zhang <di.zhang@intel.com> --- drivers/staging/android/binder.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c index 7df2a89..d23de68 100644 --- a/drivers/staging/android/binder.c +++ b/drivers/staging/android/binder.c @@ -1281,6 +1281,7 @@ static void binder_send_failed_reply(struct binder_transaction *t, "already\n", target_thread->proc->pid, target_thread->pid, target_thread->return_error); + kfree(t); } return; } else { @@ -2509,6 +2510,11 @@ static void binder_release_work(struct list_head *list) t = container_of(w, struct binder_transaction, work); if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) binder_send_failed_reply(t, BR_DEAD_REPLY); + else { + t->buffer->transaction = NULL; + kfree(t); + binder_stats_deleted(BINDER_STAT_TRANSACTION); + } } break; case BINDER_WORK_TRANSACTION_COMPLETE: { kfree(w); @@ -2982,6 +2988,7 @@ static void binder_deferred_release(struct binder_proc *proc) nodes++; rb_erase(&node->rb_node, &proc->nodes); + binder_release_work(&node->async_todo); list_del_init(&node->work.entry); if (hlist_empty(&node->refs)) { kfree(node); -- 1.7.6 Br XiaoBing Tu PSI@System Integration Shanghai
| |