]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ipmi: fix memleak when unload ipmi driver
authorZhang Yuchen <zhangyuchen.lcr@bytedance.com>
Fri, 7 Oct 2022 09:26:17 +0000 (17:26 +0800)
committerCorey Minyard <cminyard@mvista.com>
Mon, 17 Oct 2022 14:51:27 +0000 (09:51 -0500)
commit36992eb6b9b83f7f9cdc8e74fb5799d7b52e83e9
tree524af04941f6353c70142118e940d96730279d68
parentf6f1234d98cce69578bfac79df147a1f6660596c
ipmi: fix memleak when unload ipmi driver

After the IPMI disconnect problem, the memory kept rising and we tried
to unload the driver to free the memory. However, only part of the
free memory is recovered after the driver is uninstalled. Using
ebpf to hook free functions, we find that neither ipmi_user nor
ipmi_smi_msg is free, only ipmi_recv_msg is free.

We find that the deliver_smi_err_response call in clean_smi_msgs does
the destroy processing on each message from the xmit_msg queue without
checking the return value and free ipmi_smi_msg.

deliver_smi_err_response is called only at this location. Adding the
free handling has no effect.

To verify, try using ebpf to trace the free function.

  $ bpftrace -e 'kretprobe:ipmi_alloc_recv_msg {printf("alloc rcv
      %p\n",retval);} kprobe:free_recv_msg {printf("free recv %p\n",
      arg0)} kretprobe:ipmi_alloc_smi_msg {printf("alloc smi %p\n",
        retval);} kprobe:free_smi_msg {printf("free smi  %p\n",arg0)}'

Signed-off-by: Zhang Yuchen <zhangyuchen.lcr@bytedance.com>
Message-Id: <20221007092617.87597-4-zhangyuchen.lcr@bytedance.com>
[Fixed the comment above handle_one_recv_msg().]
Signed-off-by: Corey Minyard <cminyard@mvista.com>
drivers/char/ipmi/ipmi_msghandler.c