linux-kernel - [PATCH] kmemleak: do not leak object after tree insertion error (v2, fixed)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 3 Apr 2012 02:06:56 +0300
From:	Sergey Senozhatsky <sergey.senozhatsky@...il.com>
To:	Catalin Marinas <catalin.marinas@....com>
Cc:	linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: [PATCH] kmemleak: do not leak object after tree insertion error (v2,
 fixed)

 [PATCH] kmemleak: do not leak object after tree insertion error
 
 In case when tree insertion fails due to already existing object
 error, pointer to allocated object gets lost due to lookup_object()
 overwrite. Free allocated object and return the existing one, 
 obtained from lookup_object().
 
 Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@...il.com>
 
---

 mm/kmemleak.c |   19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/mm/kmemleak.c b/mm/kmemleak.c
index 45eb621..4177d83 100644
--- a/mm/kmemleak.c
+++ b/mm/kmemleak.c
@@ -516,7 +516,7 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
 					     int min_count, gfp_t gfp)
 {
 	unsigned long flags;
-	struct kmemleak_object *object;
+	struct kmemleak_object *object, *ex_object;
 	struct prio_tree_node *node;
 
 	object = kmem_cache_alloc(object_cache, gfp_kmemleak_mask(gfp));
@@ -578,17 +578,22 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
 	if (node != &object->tree_node) {
 		kmemleak_stop("Cannot insert 0x%lx into the object search tree "
 			      "(already existing)\n", ptr);
-		object = lookup_object(ptr, 1);
-		spin_lock(&object->lock);
-		dump_object_info(object);
-		spin_unlock(&object->lock);
+		ex_object = lookup_object(ptr, 1);
+		spin_lock(&ex_object->lock);
+		dump_object_info(ex_object);
+		spin_unlock(&ex_object->lock);
 
-		goto out;
+		goto out_error;
 	}
 	list_add_tail_rcu(&object->object_list, &object_list);
-out:
+
 	write_unlock_irqrestore(&kmemleak_lock, flags);
 	return object;
+out_error:
+	write_unlock_irqrestore(&kmemleak_lock, flags);
+	object->flags &= ~OBJECT_ALLOCATED;
+	put_object(object);
+	return ex_object;
 }
 
 /*

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/