lkml.org 
[lkml]   [2012]   [Oct]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
SubjectRE: Fix memory leak in binder
Date


-----Original Message-----
From: Tu, Xiaobing
Sent: Monday, October 15, 2012 3:03 PM
To: 'ccross@android.com'; 'davej@redhat.com'; 'akpm@linux-foundation.org'; 'mingo@elte.hu'; 'rusty@rustcorp.com.au'; 'a.p.zijlstra@chello.nl'; 'linux-kernel@vger.kernel.org'; 'rostedt@goodmis.org'
Cc: Zhang, Di; Ma, Xindong
Subject: Fix memory leak in binder

After enabling kmemleak and run monkey, following memleak is reported:
unreferenced object 0xeed27f80 (size 64):
comm "Binder_8", pid 641, jiffies 4294946341 (age 2275.810s)
hex dump (first 32 bytes):
4f dd 00 00 84 7f d2 ee 84 7f d2 ee 01 00 00 00 O...............
00 00 00 00 00 00 00 00 00 aa 4c d7 00 00 00 00 ..........L.....
backtrace:
[<c184fabc>] kmemleak_alloc+0x3c/0xa0
[<c12f391e>] kmem_cache_alloc_trace+0x9e/0x180
[<c1668bb5>] binder_thread_write+0xcf5/0x23a0
[<c166b091>] binder_ioctl+0x1f1/0x530
[<c130dcf6>] do_vfs_ioctl+0x86/0x5e0
[<c130e282>] sys_ioctl+0x32/0x60
[<c1872e01>] syscall_call+0x7/0xb
[<ffffffff>] 0xffffffff

The work item in async_todo list is not freed when binder released.
Also the async transaction should also be freed in binder_release_work.

Signed-off-by: Leon Ma <xindong.ma@intel.com>
Signed-off-by: Di Zhang <di.zhang@intel.com>
---
drivers/staging/android/binder.c | 7 +++++++
1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 7df2a89..d23de68 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -1281,6 +1281,7 @@ static void binder_send_failed_reply(struct binder_transaction *t,
"already\n", target_thread->proc->pid,
target_thread->pid,
target_thread->return_error);
+ kfree(t);
}
return;
} else {
@@ -2509,6 +2510,11 @@ static void binder_release_work(struct list_head *list)
t = container_of(w, struct binder_transaction, work);
if (t->buffer->target_node && !(t->flags & TF_ONE_WAY))
binder_send_failed_reply(t, BR_DEAD_REPLY);
+ else {
+ t->buffer->transaction = NULL;
+ kfree(t);
+ binder_stats_deleted(BINDER_STAT_TRANSACTION);
+ }
} break;
case BINDER_WORK_TRANSACTION_COMPLETE: {
kfree(w);
@@ -2982,6 +2988,7 @@ static void binder_deferred_release(struct binder_proc *proc)

nodes++;
rb_erase(&node->rb_node, &proc->nodes);
+ binder_release_work(&node->async_todo);
list_del_init(&node->work.entry);
if (hlist_empty(&node->refs)) {
kfree(node);
--
1.7.6
Br
XiaoBing Tu
PSI@System Integration Shanghai





\
 
 \ /
  Last update: 2012-10-15 09:41    [W:3.146 / U:0.604 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site