linux-kernel - [PATCH 2/6] Driver core: Fix memory leak on bus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 22 Jul 2010 15:09:02 -0700
From:	Patrick Pannuto <ppannuto@...eaurora.org>
To:	linux-kernel@...r.kernel.org
Cc:	ppannuto@...eaurora.org, Greg Kroah-Hartman <gregkh@...e.de>,
	Emese Revfy <re.emese@...il.com>,
	Stephen Hemminger <shemminger@...tta.com>,
	Jens Axboe <jens.axboe@...cle.com>
Subject: [PATCH 2/6] Driver core: Fix memory leak on bus_register error path

There is a subtle memory leak in driver core error path.
Consider the simplified view of bus_register (drivers/base/bus.c):

priv = kzalloc...
kobject_set_name(&priv->subsys.kobj,...) <== allocate in priv->subsys.kobj.name
if kset_register(&priv->subsys) FAILS:
	(1) -- need to free name string here!
	goto out
else
	keep going, assume we fail later...

err_path_after_kset_register:
	kset_unregister(&priv->subsys) <== calls kobject_put(&priv->subsys->kobj),
                                           which is the last reference, which leads
					   to kobject_cleanup, which frees the name
					   field BUT DOES NOT SET IT TO NULL
out:
	(2) Other place we could free name
	kfree(bus->p) // bus->p = priv
	...

Thus, we cannot insert the free'ing of name on the error path (2) since it will
be indeterminite if we need to free the name string or not. kset_register cannot (and
should not) free the name string if it fails since the caller may have other ideas,
leaving only (1) as a viable location to free the name string.

A walk-through of the failure path that will trigger this leak:

bus_register(struct bus_type *bus) {
	...
	priv = kzalloc...
	kobject_set_name(&priv->subsys.kobj,... {
		kobject_set_name_vargs(kobj,... {
			kobj->name = kvasprintf... <== ALLOCATE INTO &priv->subsys.kobj.name

	priv->subsys.kobj.kset = bus_kset
	priv->subsys.kobj.ktype = &bus_ktype

	retval = kset_register(&priv->subsys)...
	if (retval) YES
		goto out;

	...
out:
	kfree(bus->p);
	bus->p = NULL;
	return retval;
}

kset_register(struct kset *k) { // k = &priv->subsys
	kset_init(k) {
		kobject_init_internal(&k->kobj) {
			kref_init(&kobj->kref) {
				kref->refcount = 1

	err = kobject_add_internal(&k->kobj)...
	if (err) YES
		return err;
	...
}

kobject_add_internal(struct kobject *kobj) { // kobj = &priv->subsys.kobj
	...
	if (kobj->kset) YES {
		kobj_kset_join(kobj) {
			kset_get(kobj->kset) <== bus_kset
	...
	error = create_dir(kobj);
	if (error) YES {
		kobj_kset_leave(kobj) {
			kset_put(kobj->kset) <== bus_kset
		... (release parent and make KERN_ERR noise)
	}
	return error
}

Signed-off-by: Patrick Pannuto <ppannuto@...eaurora.org>
---
 drivers/base/bus.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index eb1b7fa..fea1774 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -900,8 +900,10 @@ int bus_register(struct bus_type *bus)
 	priv->drivers_autoprobe = 1;
 
 	retval = kset_register(&priv->subsys);
-	if (retval)
+	if (retval) {
+		kfree(priv->subsys.kobj.name);
 		goto out;
+	}
 
 	retval = bus_create_file(bus, &bus_attr_uevent);
 	if (retval)
-- 
1.7.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/