linux-kernel - Another memory leak in drivers/char/vt.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1248859884.2305.7.camel@pc1117.cambridge.arm.com>
Date:	Wed, 29 Jul 2009 10:31:23 +0100
From:	Catalin Marinas <catalin.marinas@....com>
To:	Johannes Weiner <hannes@...xchg.org>,
	Pekka Enberg <penberg@...helsinki.fi>
Cc:	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Another memory leak in drivers/char/vt.c

Hi,

There was a memory leak fixed recently by commit 1a8f458f6d. However,
there seems to be another with this kmemleak trace:

unreferenced object 0xde158000 (size 12288):
  comm "Xorg", pid 1439, jiffies 4294961016
  hex dump (first 32 bytes):
    20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
    20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
  backtrace:
    [<c006f74b>] __save_stack_trace+0x17/0x1c
    [<c006f81d>] create_object+0xcd/0x188
    [<c01f5457>] kmemleak_alloc+0x1b/0x3c
    [<c006e303>] __kmalloc+0xdb/0xe8
    [<c012cc4b>] vc_do_resize+0x73/0x1e0
    [<c012cdf1>] vc_resize+0x15/0x18
    [<c011afc1>] fbcon_init+0x1f9/0x2b8
    [<c0129e87>] visual_init+0x9f/0xdc
    [<c012aff3>] vc_allocate+0x7f/0xfc
    [<c012b087>] con_open+0x17/0x80
    [<c0120e43>] tty_open+0x1f7/0x2e4
    [<c0072fa1>] chrdev_open+0x101/0x118
    [<c006ffad>] __dentry_open+0x105/0x1cc
    [<c00700fd>] nameidata_to_filp+0x2d/0x38
    [<c00788cd>] do_filp_open+0x2c1/0x54c
    [<c006fdff>] do_sys_open+0x3b/0xb4

The problem happens in the vc_allocate() function where vc->vc_screenbuf
is set to the kmalloc() returned value. However, the visual_init()
function called 3 lines before also allocates the vc->vc_screenbuf.

One solution is below (another would be to kfree the vc_screenbuf and
reallocate):

diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 404f4c1..1da75ef 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -770,7 +770,9 @@ int vc_allocate(unsigned int currcons)	/* return 0 on success */
 	    visual_init(vc, currcons, 1);
 	    if (!*vc->vc_uni_pagedir_loc)
 		con_set_default_unimap(vc);
-	    vc->vc_screenbuf = kmalloc(vc->vc_screenbuf_size, GFP_KERNEL);
+	    if (!vc->vc_screenbuf)
+		    vc->vc_screenbuf = kmalloc(vc->vc_screenbuf_size,
+					       GFP_KERNEL);
 	    if (!vc->vc_screenbuf) {
 		kfree(vc);
 		vc_cons[currcons].d = NULL;

Thanks.

-- 
Catalin

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/