• Zheng Yejian's avatar
    tracing: Fix memleak due to race between current_tracer and trace · eecb91b9
    Zheng Yejian authored
    Kmemleak report a leak in graph_trace_open():
    
      unreferenced object 0xffff0040b95f4a00 (size 128):
        comm "cat", pid 204981, jiffies 4301155872 (age 99771.964s)
        hex dump (first 32 bytes):
          e0 05 e7 b4 ab 7d 00 00 0b 00 01 00 00 00 00 00 .....}..........
          f4 00 01 10 00 a0 ff ff 00 00 00 00 65 00 10 00 ............e...
        backtrace:
          [<000000005db27c8b>] kmem_cache_alloc_trace+0x348/0x5f0
          [<000000007df90faa>] graph_trace_open+0xb0/0x344
          [<00000000737524cd>] __tracing_open+0x450/0xb10
          [<0000000098043327>] tracing_open+0x1a0/0x2a0
          [<00000000291c3876>] do_dentry_open+0x3c0/0xdc0
          [<000000004015bcd6>] vfs_open+0x98/0xd0
          [<000000002b5f60c9>] do_open+0x520/0x8d0
          [<00000000376c7820>] path_openat+0x1c0/0x3e0
          [<00000000336a54b5>] do_filp_open+0x14c/0x324
          [<000000002802df13>] do_sys_openat2+0x2c4/0x530
          [<0000000094eea458>] __arm64_sys_openat+0x130/0x1c4
          [<00000000a71d7881>] el0_svc_common.constprop.0+0xfc/0x394
          [<00000000313647bf>] do_el0_svc+0xac/0xec
          [<000000002ef1c651>] el0_svc+0x20/0x30
          [<000000002fd4692a>] el0_sync_handler+0xb0/0xb4
          [<000000000c309c35>] el0_sync+0x160/0x180
    
    The root cause is descripted as follows:
    
      __tracing_open() {  // 1. File 'trace' is being opened;
        ...
        *iter->trace = *tr->current_trace;  // 2. Tracer 'function_graph' is
                                            //    currently set;
        ...
        iter->trace->open(iter);  // 3. Call graph_trace_open() here,
                                  //    and memory are allocated in it;
        ...
      }
    
      s_start() {  // 4. The opened file is being read;
        ...
        *iter->trace = *tr->current_trace;  // 5. If tracer is switched to
                                            //    'nop' or others, then memory
                                            //    in step 3 are leaked!!!
        ...
      }
    
    To fix it, in s_start(), close tracer before switching then reopen the
    new tracer after switching. And some tracers like 'wakeup' may not update
    'iter->private' in some cases when reopen, then it should be cleared
    to avoid being mistakenly closed again.
    
    Link: https://lore.kernel.org/linux-trace-kernel/20230817125539.1646321-1-zhengyejian1@huawei.com
    
    Fixes: d7350c3f ("tracing/core: make the read callbacks reentrants")
    Signed-off-by: default avatarZheng Yejian <zhengyejian1@huawei.com>
    Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
    eecb91b9
trace_irqsoff.c 17.8 KB