linux-kernel - Re: [PATCH] proc: add proc_seq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 27 Jun 2018 09:09:40 +0200
From:   Christoph Hellwig <hch@....de>
To:     viro@...iv.linux.org.uk, Chunyu Hu <chuhu@...hat.com>
Cc:     linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] proc: add proc_seq_release

Al, can you pick up this fix from Chunyu?

On Tue, Jun 26, 2018 at 08:20:52AM -0400, Chunyu Hu wrote:
> 
> 
> ----- Original Message -----
> > From: "Christoph Hellwig" <hch@....de>
> > To: "Chunyu Hu" <chuhu@...hat.com>
> > Cc: viro@...iv.linux.org.uk, hch@....de, linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
> > Sent: Monday, June 11, 2018 2:23:54 PM
> > Subject: Re: [PATCH] proc: add proc_seq_release
> > 
> > On Sun, Jun 10, 2018 at 03:51:24AM +0800, Chunyu Hu wrote:
> > > kmemleak reported some memory leak on reading proc files. After adding
> > > some debug lines, find that proc_seq_fops is using seq_release as
> > > release handler, which won't handle the free of 'private' field of
> > > seq_file, while in fact the open handler proc_seq_open could create
> > > the private data with __seq_open_private when state_size is greater
> > > than zero. So after reading files created with proc_create_seq_private,
> > > such as /proc/timer_list and /proc/vmallocinfo, the private mem of a
> > > seq_file is not freed. Fix it by adding the paired proc_seq_release
> > > as the default release handler of proc_seq_ops instead of seq_release.
> > 
> > Indeed, thanks for the patch.
> > 
> > Reviewed-by: Christoph Hellwig <hch@....de>
> > 
> 
> What's our plan for this issue? We can still see the leaking in 4.18-RC2. 
> 
> 1) Run 'cat /proc/timer_list' then
> 2) echo scan > /sys/kernel/debug/kmemleak
> 3) cat /sys/kernel/debug/kmemleak
> 
> each time, it leaks 16 bytes.
> 
> unreferenced object 0xffff880017525120 (size 16):
>   comm "cat", pid 4682, jiffies 4294964743 (age 46.880s)
>   hex dump (first 16 bytes):
>     04 00 00 00 01 00 00 00 42 00 96 e7 3f 00 00 00  ........B...?...
>   backtrace:
>     [<000000006f6b5d90>] seq_open_private+0x25/0x40
>     [<00000000d94d91aa>] proc_seq_open+0xca/0x120
>     [<00000000d5609077>] proc_reg_open+0x1d4/0x5b0
>     [<0000000036a3d49c>] do_dentry_open+0x7d6/0x1010
>     [<00000000d4fb0a82>] vfs_open+0x170/0x2b0
>     [<00000000f3bf21b4>] path_openat+0x760/0x3750
>     [<00000000b0d4e66c>] do_filp_open+0x1bb/0x2c0
>     [<0000000063b53236>] do_sys_open+0x2b2/0x490
>     [<00000000a5249c62>] do_syscall_64+0xd3/0x6e0
>     [<000000006f9f8436>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
>     [<000000001d702cb2>] 0xffffffffffffffff
> 
> 
> -- 
> Regards,
> Chunyu Hu
---end quoted text---