Messages in this thread Patch in this message | | | Date | Thu, 20 Nov 2008 09:04:57 -0200 | From | Arnaldo Carvalho de Melo <> | Subject | Re: Possible memory leak via slub kmem_cache_create |
| |
Em Thu, Nov 20, 2008 at 09:51:50AM +0000, Catalin Marinas escreveu: > On Wed, 2008-11-19 at 13:22 -0600, Christoph Lameter wrote: > > proto_register could add another field somewhere and store the pointer to > > the name there? Then free the string on proto_unregister. > > The patch below fixes this issue for proto_register. There is another > similar case in net/dccp/ccid.c. I cc'ed the person who added the > original proto_register code and he also seems to be the DCCP > maintainer. > > My point is that the API is slightly different when slub is used since > kmem_cache_name is no longer guaranteed to return the same pointer > passed to kmem_cache_create. Maybe a documentation update: > > diff --git a/mm/slab.c b/mm/slab.c > index ea76bcb..9723a72 100644 > --- a/mm/slab.c > +++ b/mm/slab.c > @@ -2124,6 +2124,8 @@ static int __init_refok setup_cpu_cache(struct kmem_cache > * > * @name must be valid until the cache is destroyed. This implies that > * the module calling this has to destroy the cache before getting unloaded. > + * Note that kmem_cache_name() is not guaranteed to return the same pointer, > + * therefore applications must manage it themselves. > * > * The flags are > * > > And the proto_register fix below (if it looks alright, I'll submit it > separately): > > > Fix memory leak in the proto_register function > > From: Catalin Marinas <catalin.marinas@arm.com> > > If the slub allocator is used, kmem_cache_create() may merge two or more > kmem_cache's into one but the cache name pointer is not updated and > kmem_cache_name() is no longer guaranteed to return the pointer passed > to the former function. This patch stores the kmalloc'ed pointers in the > corresponding request_sock_ops and timewait_sock_ops structures. > > Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Thanks, when I wrote this there X was only 'a' in slXb :-)
Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
| |