linux-kernel - Re: Possible memory leak via slub kmem_cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 20 Nov 2008 09:04:57 -0200
From:	Arnaldo Carvalho de Melo <acme@...hat.com>
To:	Catalin Marinas <catalin.marinas@....com>
Cc:	Christoph Lameter <cl@...ux-foundation.org>,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: Possible memory leak via slub kmem_cache_create

Em Thu, Nov 20, 2008 at 09:51:50AM +0000, Catalin Marinas escreveu:
> On Wed, 2008-11-19 at 13:22 -0600, Christoph Lameter wrote:
> > proto_register could add another field somewhere and store the pointer to
> > the name there? Then free the string on proto_unregister.
> 
> The patch below fixes this issue for proto_register. There is another
> similar case in net/dccp/ccid.c. I cc'ed the person who added the
> original proto_register code and he also seems to be the DCCP
> maintainer.
> 
> My point is that the API is slightly different when slub is used since
> kmem_cache_name is no longer guaranteed to return the same pointer
> passed to kmem_cache_create. Maybe a documentation update:
> 
> diff --git a/mm/slab.c b/mm/slab.c
> index ea76bcb..9723a72 100644
> --- a/mm/slab.c
> +++ b/mm/slab.c
> @@ -2124,6 +2124,8 @@ static int __init_refok setup_cpu_cache(struct kmem_cache 
>   *
>   * @name must be valid until the cache is destroyed. This implies that
>   * the module calling this has to destroy the cache before getting unloaded.
> + * Note that kmem_cache_name() is not guaranteed to return the same pointer,
> + * therefore applications must manage it themselves.
>   *
>   * The flags are
>   *
> 
> And the proto_register fix below (if it looks alright, I'll submit it
> separately):
> 
> 
> Fix memory leak in the proto_register function
> 
> From: Catalin Marinas <catalin.marinas@....com>
> 
> If the slub allocator is used, kmem_cache_create() may merge two or more
> kmem_cache's into one but the cache name pointer is not updated and
> kmem_cache_name() is no longer guaranteed to return the pointer passed
> to the former function. This patch stores the kmalloc'ed pointers in the
> corresponding request_sock_ops and timewait_sock_ops structures.
> 
> Signed-off-by: Catalin Marinas <catalin.marinas@....com>

Thanks, when I wrote this there X was only 'a' in slXb :-)

Acked-by: Arnaldo Carvalho de Melo <acme@...hat.com>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/