dinghao.liu@ wrote: > > Ira Weiny wrote: > > > Dinghao Liu wrote: > > > > [snip] > > > > -static int btt_freelist_init(struct arena_info *arena) > > +static int btt_freelist_init(struct device *dev, struct arena_info *arena) > > > > Both struct arena_info and struct btt contain references to struct nd_btt > > which is the device you are passing down this call stack. > > > > Just use the device in the arena/btt rather than passing a device > > structure. That makes the code easier to read and ensures that the device > > associated with this arena or btt is used. > > Thanks for this suggestion! I will fix this in the v3 patch. > > > [snip] > > > > > > > > -static int btt_maplocks_init(struct arena_info *arena) > > > > +static int btt_maplocks_init(struct device *dev, struct arena_info > > > > *arena) > > > > { > > > > u32 i; > > > > > > > > - arena->map_locks = kcalloc(arena->nfree, sizeof(struct > > > > aligned_lock), > > > > + arena->map_locks = devm_kcalloc(dev, arena->nfree, > > > > sizeof(struct aligned_lock), > > > > GFP_KERNEL); > > > > if (!arena->map_locks) > > > > return -ENOMEM; > > > > @@ -805,9 +805,6 @@ static void free_arenas(struct btt *btt) > > > > > > > > list_for_each_entry_safe(arena, next, &btt->arena_list, list) { > > > > list_del(&arena->list); > > > > - kfree(arena->rtt); > > > > - kfree(arena->map_locks); > > > > - kfree(arena->freelist); > > > > > > This does not quite work. > > > > > > free_arenas() is used in the error paths of create_arenas() and > > > discover_arenas(). In those cases devm_kfree() is probably a better way > > > to clean up this. > > Here I'm a little confused about when devm_kfree() should be used.
Over all it should be used whenever memory is allocated for the lifetime of the device. > Code in btt_init() implies that resources allocated by devm_* could be > auto freed in both error and success paths of probe/attach (e.g., btt > allocated by devm_kzalloc is never freed by devm_kfree). > Using devm_kfree() in free_arenas() is ok for me, but I want to know > whether not using devm_kfree() constitutes a bug. Unfortunately I'm not familiar enough with this code to know for sure. After my quick checks before I thought it was. But each time I look at it I get confused. This is why I was thinking maybe not using devm_*() and using no_free_ptr() may be a better solution to make sure things don't leak without changing the success path (which is likely working fine because no bugs have been found.) > > > > > > > However... > > > > > > > debugfs_remove_recursive(arena->debugfs_dir); > > > > kfree(arena); > > > > > > Why can't arena be allocated with devm_*? > > > > > > We need to change this up a bit more to handle the error path vs regular > > > device shutdown free (automatic devm frees). > > > > At first, I think the use of arena is correct. Therefore, allocating arena > with devm_* should be a code style optimization. However, I rechecked > discover_arenas and found arena might also be leaked (e.g., if > alloc_arena() fails in the second loop, the previously allocated > resources in the loop is leaked). The correct code could be found in > create_arenas(), where free_arenas is called on failure of > alloc_arena(). Yea I've not reached that level of detail in my analysis. > > To fix this issue, I think it's better to change the 'goto out_super' > tag to 'goto out'. We could also use devm_* for arena to simplify the > error path in discover_arenas(). I think it is your call at this point as I don't have time to dig in more than I have. Sorry. > > > We might want to look at using no_free_ptr() in this code. See this > > patch[1] for an example of how to inhibit the cleanup and pass the > > pointer on when the function succeeds. > > > > [1] > > https://lore.kernel.org/all/170261791914.1714654.6447680285357545638.st...@dwillia2-xfh.jf.intel.com/ > > > > Ira > > Thanks for this example. But it seems that no_free_ptr() is used to > handle the scope based resource management. Changes in this patch does > not introduce this feature. Do I understand this correctly? You do understand but I was thinking that perhaps using no_free_ptr() rather than devm_*() might be an easier way to fix this bug without trying to decode the lifetime of everything. Ira > > Regards, > Dinghao