Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

atm: idt77252: fix kmemleak when rmmod idt77252

There are memory leaks reported by kmemleak:

unreferenced object 0xffff888106500800 (size 128):
comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380
[<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0
[<000000000e947e2a>] idt77252_init_one+0x2847/0x3c90 [idt77252]
[<000000006efb048e>] local_pci_probe+0xeb/0x1a0
...

unreferenced object 0xffff888106500b00 (size 128):
comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s)
hex dump (first 32 bytes):
00 20 3d 01 80 88 ff ff 00 20 3d 01 80 88 ff ff . =...... =.....
f0 23 3d 01 80 88 ff ff 00 20 3d 01 00 00 00 00 .#=...... =.....
backtrace:
[<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380
[<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0
[<00000000f451c5be>] alloc_scq.constprop.0+0x4a/0x400 [idt77252]
[<00000000e6313849>] idt77252_init_one+0x28cf/0x3c90 [idt77252]

The root cause is traced to the vc_maps which alloced in open_card_oam()
are not freed in close_card_oam(). The vc_maps are used to record
open connections, so when close a vc_map in close_card_oam(), the memory
should be freed. Moreover, the ubr0 is not closed when close a idt77252
device, leading to the memory leak of vc_map and scq_info.

Fix them by adding kfree in close_card_oam() and implementing new
close_card_ubr0() to close ubr0.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Li Zetao <lizetao1@huawei.com>
Reviewed-by: Francois Romieu <romieu@fr.zoreil.com>
Link: https://lore.kernel.org/r/20230320143318.2644630-1-lizetao1@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Li Zetao and committed by
Jakub Kicinski
4fe3c885 032a9540

+11
+11
drivers/atm/idt77252.c
··· 2909 2909 2910 2910 recycle_rx_pool_skb(card, &vc->rcv.rx_pool); 2911 2911 } 2912 + kfree(vc); 2912 2913 } 2913 2914 } 2914 2915 } ··· 2951 2950 clear_bit(VCF_IDLE, &vc->flags); 2952 2951 writel(TCMDQ_START | 0, SAR_REG_TCMDQ); 2953 2952 return 0; 2953 + } 2954 + 2955 + static void 2956 + close_card_ubr0(struct idt77252_dev *card) 2957 + { 2958 + struct vc_map *vc = card->vcs[0]; 2959 + 2960 + free_scq(card, vc->scq); 2961 + kfree(vc); 2954 2962 } 2955 2963 2956 2964 static int ··· 3011 3001 struct idt77252_dev *card = dev->dev_data; 3012 3002 u32 conf; 3013 3003 3004 + close_card_ubr0(card); 3014 3005 close_card_oam(card); 3015 3006 3016 3007 conf = SAR_CFG_RXPTH | /* enable receive path */