[PATCH] kunit: alloc_string_stream_fragment error handling bug fix

[YoungJun.park]

When it fails to allocate fragment, it does not free and return error.
And check the pointer inappropriately.

Signed-off-by: YoungJun.park <her0g...@gmail.com>
---
lib/kunit/string-stream.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/lib/kunit/string-stream.c b/lib/kunit/string-stream.c
index 72659a9773e3..0228fe814e96 100644
--- a/lib/kunit/string-stream.c
+++ b/lib/kunit/string-stream.c
@@ -23,8 +23,10 @@ static struct string_stream_fragment *alloc_string_stream_fragment(
return ERR_PTR(-ENOMEM);

frag->fragment = kunit_kmalloc(test, len, gfp);
- if (!frag->fragment)
+ if (!frag->fragment) {
+ kunit_kfree(test, frag);
return ERR_PTR(-ENOMEM);
+ }

return frag;
}
@@ -56,7 +58,7 @@ int string_stream_vadd(struct string_stream *stream,
frag_container = alloc_string_stream_fragment(stream->test,
len,
stream->gfp);
- if (!frag_container)
+ if (IS_ERR(frag_container))
return -ENOMEM;

len = vsnprintf(frag_container->fragment, len, fmt, args);
--
2.25.1

[Maíra Canal]

On 10/28/22 11:42, YoungJun.park wrote:
> When it fails to allocate fragment, it does not free and return error.
> And check the pointer inappropriately.
>
> Signed-off-by: YoungJun.park <her0g...@gmail.com>
> ---
> lib/kunit/string-stream.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/lib/kunit/string-stream.c b/lib/kunit/string-stream.c
> index 72659a9773e3..0228fe814e96 100644
> --- a/lib/kunit/string-stream.c
> +++ b/lib/kunit/string-stream.c
> @@ -23,8 +23,10 @@ static struct string_stream_fragment *alloc_string_stream_fragment(
> return ERR_PTR(-ENOMEM);
>
> frag->fragment = kunit_kmalloc(test, len, gfp);
> - if (!frag->fragment)
> + if (!frag->fragment) {
> + kunit_kfree(test, frag);

I don't believe that kunit_kfree is necessary here, because
kunit_kmalloc is like kmalloc, but the allocation is test managed, which
means that the allocation is managed by the test case and is
automatically cleaned up after the test case concludes.

So, the original version seems correct: if the allocation fails,
alloc_string_stream_fragment will return NULL and string_stream_vadd
will check if frag_container is different than NULL.

Best Regards,
- Maíra Canal

[David Gow]

On Fri, Oct 28, 2022 at 10:43 PM YoungJun.park <her0g...@gmail.com> wrote:
>
> When it fails to allocate fragment, it does not free and return error.
> And check the pointer inappropriately.
>
> Signed-off-by: YoungJun.park <her0g...@gmail.com>
> ---

Thanks! As Maíra points out, the added kunit_kfree() call isn't
strictly necessary, though it definitely doesn't hurt (and it's
probably a nice thing to free memory early if we're already in a
pretty dire memory situation). So I think it's an improvement.

The IS_ERR check is definitely a fix, though.

Reviewed-by: David Gow <davi...@google.com>

Cheers,
-- David

> --
> You received this message because you are subscribed to the Google Groups "KUnit Development" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to kunit-dev+...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/kunit-dev/20221028144241.634012-1-her0gyugyu%40gmail.com.

[Daniel Latypov]

On Sat, Oct 29, 2022 at 8:20 PM 'David Gow' via KUnit Development
<kuni...@googlegroups.com> wrote:
>
> On Fri, Oct 28, 2022 at 10:43 PM YoungJun.park <her0g...@gmail.com> wrote:
> >
> > When it fails to allocate fragment, it does not free and return error.
> > And check the pointer inappropriately.
> >
> > Signed-off-by: YoungJun.park <her0g...@gmail.com>
> > ---
>
> Thanks! As Maíra points out, the added kunit_kfree() call isn't
> strictly necessary, though it definitely doesn't hurt (and it's
> probably a nice thing to free memory early if we're already in a
> pretty dire memory situation). So I think it's an improvement.
>
> The IS_ERR check is definitely a fix, though.

Note: the IS_ERR check was fixed already in
https://patchwork.kernel.org/project/linux-kselftest/patch/Y0kt1aCTHO4r2CmL@kili/
That change has made its way into torvalds/master.
So we could rebase this patch and reword it to talk just about the
early kfree().

Re free memory early:
It'll save us sizeof(struct string_stream_fragment) + sizeof(struct
kunit_resource), i.e. 24 + 56 = 80 bytes (on UML/x86_64).
So it's not much, but I guess it could help in edge cases.

Daniel